The Pub/Sub to Datadog template is a streaming pipeline that reads messages from a Pub/Sub subscription and writes the message payload to Datadog by using a Datadog endpoint. The most common use case for this template is to export log files to Datadog.
Before writing to Datadog, you can apply a JavaScript user-defined function to the message payload. Any messages that experience processing failures are forwarded to a Pub/Sub unprocessed topic for further troubleshooting and reprocessing.
As an extra layer of protection for your API keys and secrets, you can also pass in a Cloud KMS key along with the base64-encoded API key parameter encrypted with the Cloud KMS key. For additional details about encrypting your API key parameter, see the Cloud KMS API encryption endpoint.
Pipeline requirements
- The source Pub/Sub subscription must exist prior to running the pipeline.
- The Pub/Sub unprocessed topic must exist prior to running the pipeline.
- The Datadog URL must be accessible from the network of the Dataflow workers.
- The Datadog API key must be generated and available.
Template parameters
Required parameters
- inputSubscription: The Pub/Sub subscription to read the input from. For example,
projects/your-project-id/subscriptions/your-subscription-name
. - url: The Datadog Logs API URL. This URL must be routable from the VPC that the pipeline runs in. See Send logs (https://docs.datadoghq.com/api/latest/logs/#send-logs) in the Datadog documentation for more information. For example,
https://http-intake.logs.datadoghq.com
. - outputDeadletterTopic: The Pub/Sub topic to forward undeliverable messages to. For example,
projects/<PROJECT_ID>/topics/<TOPIC_NAME>
.
Optional parameters
- apiKey: The Datadog API key. You must provide this value if the
apiKeySource
is set toPLAINTEXT
orKMS
. For more information, see API and Application Keys (https://docs.datadoghq.com/account_management/api-app-keys/) in the Datadog documentation. - batchCount: The batch size for sending multiple events to Datadog. The default is
1
(no batching). - parallelism: The maximum number of parallel requests. The default is
1
(no parallelism). - includePubsubMessage: Whether to include the full Pub/Sub message in the payload. The default is
true
(all elements, including the data element, are included in the payload). - apiKeyKMSEncryptionKey: The Cloud KMS key to use to decrypt the API Key. You must provide this parameter if the
apiKeySource
is set toKMS
. If the Cloud KMS key is provided, you must pass in an encrypted API Key. For example,projects/your-project-id/locations/global/keyRings/your-keyring/cryptoKeys/your-key-name
. - apiKeySecretId: The Secret Manager secret ID for the API Key. You must provide this parameter if the
apiKeySource
is set toSECRET_MANAGER
. For example,projects/your-project-id/secrets/your-secret/versions/your-secret-version
. - apiKeySource: The source of the API key. The following values are supported:
PLAINTEXT
,KMS
, andSECRET_MANAGER
. You must provide this parameter if you're using Secret Manager. IfapiKeySource
is set toKMS
, you must also provideapiKeyKMSEncryptionKey
and encryptedAPI Key
. IfapiKeySource
is set toSECRET_MANAGER
, you must also provideapiKeySecretId
. IfapiKeySource
is set toPLAINTEXT
, you must also provideapiKey
. - javascriptTextTransformGcsPath: The Cloud Storage URI of the .js file that defines the JavaScript user-defined function (UDF) to use. For example,
gs://my-bucket/my-udfs/my_file.js
. - javascriptTextTransformFunctionName: The name of the JavaScript user-defined function (UDF) to use. For example, if your JavaScript function code is
myTransform(inJson) { /*...do stuff...*/ }
, then the function name ismyTransform
. For sample JavaScript UDFs, see UDF Examples (https://github.com/GoogleCloudPlatform/DataflowTemplates#udf-examples). - javascriptTextTransformReloadIntervalMinutes: Define the interval that workers may check for JavaScript UDF changes to reload the files. Defaults to: 0.
User-defined function
Optionally, you can extend this template by writing a user-defined function (UDF). The template calls the UDF for each input element. Element payloads are serialized as JSON strings. For more information, see Create user-defined functions for Dataflow templates.
Function specification
The UDF has the following specification:
- Input: the Pub/Sub message data field, serialized as a JSON string.
- Output: the event data to be sent to the Datadog Log endpoint. The output must be a string or a stringified JSON object.
Run the template
Console
- Go to the Dataflow Create job from template page. Go to Create job from template
- In the Job name field, enter a unique job name.
- Optional: For Regional endpoint, select a value from the drop-down menu. The default
region is
us-central1
.For a list of regions where you can run a Dataflow job, see Dataflow locations.
- From the Dataflow template drop-down menu, select the Pub/Sub to Datadog template.
- In the provided parameter fields, enter your parameter values.
- Click Run job.
gcloud
In your shell or terminal, run the template:
gcloud dataflow jobs run JOB_NAME \ --gcs-location gs://dataflow-templates-REGION_NAME/VERSION/Cloud_PubSub_to_Datadog \ --region REGION_NAME \ --staging-location STAGING_LOCATION \ --parameters \ inputSubscription=projects/PROJECT_ID/subscriptions/INPUT_SUBSCRIPTION_NAME,\ apiKey=API_KEY,\ url=URL,\ outputDeadletterTopic=projects/PROJECT_ID/topics/DEADLETTER_TOPIC_NAME,\ javascriptTextTransformGcsPath=PATH_TO_JAVASCRIPT_UDF_FILE,\ javascriptTextTransformFunctionName=JAVASCRIPT_FUNCTION,\ batchCount=BATCH_COUNT,\ parallelism=PARALLELISM
Replace the following:
JOB_NAME
: a unique job name of your choiceREGION_NAME
: the region where you want to deploy your Dataflow job—for example,us-central1
VERSION
: the version of the template that you want to useYou can use the following values:
latest
to use the latest version of the template, which is available in the non-dated parent folder in the bucket— gs://dataflow-templates-REGION_NAME/latest/- the version name, like
2023-09-12-00_RC00
, to use a specific version of the template, which can be found nested in the respective dated parent folder in the bucket— gs://dataflow-templates-REGION_NAME/
STAGING_LOCATION
: the location for staging local files (for example,gs://your-bucket/staging
)INPUT_SUBSCRIPTION_NAME
: the Pub/Sub subscription nameAPI_KEY
: Datadog's API KeyURL
: the URL for Datadog's endpoint (for example,https://http-intake.logs.datadoghq.com
)DEADLETTER_TOPIC_NAME
: the Pub/Sub topic nameJAVASCRIPT_FUNCTION
: the name of the JavaScript user-defined function (UDF) that you want to useFor example, if your JavaScript function code is
myTransform(inJson) { /*...do stuff...*/ }
, then the function name ismyTransform
. For sample JavaScript UDFs, see UDF Examples.PATH_TO_JAVASCRIPT_UDF_FILE
: the Cloud Storage URI of the.js
file that defines the JavaScript user-defined function (UDF) you want to use—for example,gs://my-bucket/my-udfs/my_file.js
BATCH_COUNT
: the batch size to use for sending multiple events to DatadogPARALLELISM
: the number of parallel requests to use for sending events to Datadog
API
To run the template using the REST API, send an HTTP POST request. For more information on the
API and its authorization scopes, see
projects.templates.launch
.
POST https://dataflow.googleapis.com/v1b3/projects/PROJECT_ID/locations/LOCATION/templates:launch?gcsPath=gs://dataflow-templates-LOCATION/VERSION/Cloud_PubSub_to_Datadog { "jobName": "JOB_NAME", "environment": { "ipConfiguration": "WORKER_IP_UNSPECIFIED", "additionalExperiments": [] }, "parameters": { "inputSubscription": "projects/PROJECT_ID/subscriptions/INPUT_SUBSCRIPTION_NAME", "apiKey": "API_KEY", "url": "URL", "outputDeadletterTopic": "projects/PROJECT_ID/topics/DEADLETTER_TOPIC_NAME", "javascriptTextTransformGcsPath": "PATH_TO_JAVASCRIPT_UDF_FILE", "javascriptTextTransformFunctionName": "JAVASCRIPT_FUNCTION", "batchCount": "BATCH_COUNT", "parallelism": "PARALLELISM" } }
Replace the following:
PROJECT_ID
: the Google Cloud project ID where you want to run the Dataflow jobJOB_NAME
: a unique job name of your choiceLOCATION
: the region where you want to deploy your Dataflow job—for example,us-central1
VERSION
: the version of the template that you want to useYou can use the following values:
latest
to use the latest version of the template, which is available in the non-dated parent folder in the bucket— gs://dataflow-templates-REGION_NAME/latest/- the version name, like
2023-09-12-00_RC00
, to use a specific version of the template, which can be found nested in the respective dated parent folder in the bucket— gs://dataflow-templates-REGION_NAME/
STAGING_LOCATION
: the location for staging local files (for example,gs://your-bucket/staging
)INPUT_SUBSCRIPTION_NAME
: the Pub/Sub subscription nameAPI_KEY
: Datadog's API KeyURL
: the URL for Datadog's endpoint (for example,https://http-intake.logs.datadoghq.com
)DEADLETTER_TOPIC_NAME
: the Pub/Sub topic nameJAVASCRIPT_FUNCTION
: the name of the JavaScript user-defined function (UDF) that you want to useFor example, if your JavaScript function code is
myTransform(inJson) { /*...do stuff...*/ }
, then the function name ismyTransform
. For sample JavaScript UDFs, see UDF Examples.PATH_TO_JAVASCRIPT_UDF_FILE
: the Cloud Storage URI of the.js
file that defines the JavaScript user-defined function (UDF) you want to use—for example,gs://my-bucket/my-udfs/my_file.js
BATCH_COUNT
: the batch size to use for sending multiple events to DatadogPARALLELISM
: the number of parallel requests to use for sending events to Datadog
What's next
- Learn about Dataflow templates.
- See the list of Google-provided templates.