Apply log processing rules to a specific log collection configurations to:
- Filter logs
- Scrub sensitive data from your logs
- Proceed to multi-line aggregation
- Tail directories by using wildcards
- Encode UTF-16 format logs

# For example, to filter OUT logs that contain a Datadog email address, use the following log_processing_rules: | |
logs_config: | |
- type: file | |
path: /my/test/file.log | |
service: cardpayment | |
source: java | |
log_processing_rules: | |
- type: exclude_at_match | |
name: exclude_datadoghq_users | |
## Regexp can be anything | |
pattern: \w+@datadoghq.com | |
# For example, to filter IN logs that contain a Datadog email address, use the following log_processing_rules: | |
logs_config: | |
- type: file | |
path: /my/test/file.log | |
service: cardpayment | |
source: java | |
log_processing_rules: | |
- type: include_at_match | |
name: include_datadoghq_users | |
## Regexp can be anything | |
pattern: \w+@datadoghq.com | |
# If you want to match one or more patterns you must define them in a single expression: | |
logs_config: | |
- type: file | |
path: /my/test/file.log | |
service: cardpayment | |
source: java | |
log_processing_rules: | |
- type: include_at_match | |
name: include_datadoghq_users | |
pattern: abc|123 | |
# If the patterns are too long to fit legibly on a single line you can break them into multiple lines: | |
logs_config: | |
- type: file | |
path: /my/test/file.log | |
service: cardpayment | |
source: java | |
log_processing_rules: | |
- type: include_at_match | |
name: include_datadoghq_users | |
pattern: "abc\ | |
|123\ | |
|\\w+@datadoghq.com" | |
# Scrub sensitive data from your logs | |
logs_config: | |
- type: file | |
path: /my/test/file.log | |
service: cardpayment | |
source: java | |
log_processing_rules: | |
- type: mask_sequences | |
name: mask_credit_cards | |
replace_placeholder: "[masked_credit_card]" | |
##One pattern that contains capture groups | |
pattern: (?:4[0-9]{12}(?:[0-9]{3})?|[25][1-7][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11}) | |
# Multi-line aggregation | |
logs_config: | |
- type: file | |
path: /var/log/pg_log.log | |
service: database | |
source: postgresql | |
log_processing_rules: | |
- type: multi_line | |
name: new_log_start_with_date | |
pattern: \d{4}\-(0?[1-9]|1[012])\-(0?[1-9]|[12][0-9]|3[01]) | |
# Tail directories by using wildcards | |
logs_config: | |
- type: file | |
path: /var/log/myapp/*.log | |
exclude_paths: | |
- /var/log/myapp/debug.log | |
- /var/log/myapp/trace.log | |
service: mywebapp | |
source: go | |
# Encode UTF-16 format logs | |
logs_config: | |
- type: file | |
path: /test/log/hello-world.log | |
tags: key:value | |
service: utf-16-logs | |
source: mysql | |
encoding: utf-16-be | |
# Global processing rules In the datadog.yaml file: | |
# For Datadog Agent v6.10+, the exclude_at_match, include_at_match, and mask_sequences processing rules can be defined globally in the Agentβs main configuration file or through an environment variable: | |
logs_config: | |
processing_rules: | |
- type: exclude_at_match | |
name: exclude_healthcheck | |
pattern: healthcheck | |
- type: mask_sequences | |
name: mask_user_email | |
pattern: \w+@datadoghq.com | |
replace_placeholder: "MASKED_EMAIL" |











Iβm a DevOps/SRE/DevSecOps/Cloud Expert passionate about sharing knowledge and experiences. I am working at Cotocus. I blog tech insights at DevOps School, travel stories at Holiday Landmark, stock market tips at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at I reviewed , and SEO strategies at Wizbrand.
Please find my social handles as below;
Rajesh Kumar Personal Website
Rajesh Kumar at YOUTUBE
Rajesh Kumar at INSTAGRAM
Rajesh Kumar at X
Rajesh Kumar at FACEBOOK
Rajesh Kumar at LINKEDIN
Rajesh Kumar at PINTEREST
Rajesh Kumar at QUORA
Rajesh Kumar at WIZBRAND