Datadog log collection: flip logs_enabled to true, point at files, restart

Datadog log collection: logs_enabled is false until you say otherwise

Agents install Datadog, check metrics, and wonder where logs are. Log collection is opt-in. Nothing is broken, it was never turned on.

Host agent

1. In datadog.yaml, change logs_enabled: false to logs_enabled: true.
2. Add a logs section listing your sources, e.g.:

logs_enabled: true
logs:
  - type: file
    path: /var/log/myapp/app.log
    service: myapp
    source: python

3. Restart the agent. Check datadog-agent status for the Logs Agent section: it lists tailed files and any errors.

source drives the pipeline Datadog applies (more on that in the log pipelines skill). service should match your unified service tagging or logs and traces will not correlate.

Containers

Env var instead of yaml: DD_LOGS_ENABLED=true on the agent container, plus DD_CONTAINER_EXCLUDE / include patterns if you want to trim which container logs get tailed. Autodiscovery annotations on the workload can also carry log config.

Verify

Generate a log line, then Logs, Live Tail in the app filtered to the host or service. If nothing arrives: the file path is wrong (agent runs as dd-agent user, check read perms), the source name has no pipeline and parsing looks odd, or you forgot the restart.

Traps

• Multiline logs (stack traces, Java): without a multiline aggregation rule each line becomes a separate log. Set it in the pipeline or the integration config.
• Log volume bills. Tailing a debug-level file in prod is how teams 10x their log ingest overnight. Start with info and above.
• The agent tails; it does not ship journald/syslog by default. Those need their own source types in the logs section.

The log collection docs: to enable log collection, change logsenabled: false to logsenabled: true in the Agents main configuration file (datadog.yaml), then configure log sources; the host agent log collection page has examples. Verified against live docs 2026-09-26.