Datadog Integration

MTE Relay v5 emits structured JSON logs (see the Event Schema Reference). Datadog parses them automatically — no custom parsing rules are required. This guide ships logs to Datadog, installs the log pipeline, declares facets/measures, and imports the prebuilt dashboard and monitors.

Artifacts

File	Purpose
mte-relay-v5-dashboard.json	Importable dashboard (traffic, latency, phase breakdown, security, errors)
mte-relay-v5-monitors.json	Five recommended monitors (security, panics, state store, latency, capacity)
mte-relay-v5-log-pipeline.json	Log pipeline (status/date/service/message remappers)

1. Ship the logs

MTE Relay writes all logs to stderr as one JSON object per line. Keep USE_CONSOLE_LOGS=false (the default) wherever Datadog ingests logs. Pick the path that matches your deployment:

Docker (Datadog Agent)

Run the Agent with log collection enabled and label the relay container:

# docker-compose excerpt
services:
  mte-relay:
    image: <your-registry>/mrs-go-v5:5.0.x
    labels:
      com.datadoghq.ad.logs: '[{"source": "mte-relay", "service": "mte-relay"}]'
  datadog-agent:
    image: gcr.io/datadoghq/agent:7
    environment:
      - DD_API_KEY=<YOUR_API_KEY>
      - DD_LOGS_ENABLED=true
      - DD_LOGS_CONFIG_CONTAINER_COLLECT_ALL=false
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro

Kubernetes / AKS (Datadog Agent DaemonSet)

Install the Agent with the Helm chart (datadog.logs.enabled=true) and annotate the relay pods:

metadata:
  annotations:
    ad.datadoghq.com/mte-relay.logs: '[{"source": "mte-relay", "service": "mte-relay"}]'

ECS Fargate (FireLens)

Add a FireLens log router to the task definition and point it at Datadog:

"logConfiguration": {
  "logDriver": "awsfirelens",
  "options": {
    "Name": "datadog",
    "apikey": "<YOUR_API_KEY>",
    "dd_service": "mte-relay",
    "dd_source": "mte-relay",
    "provider": "ecs"
  }
}

Logs already in CloudWatch

If the relay already logs to CloudWatch (ECS awslogs driver), deploy the Datadog Forwarder Lambda and subscribe it to the relay log group. No changes to the relay task are needed.

2. Install the log pipeline

The pipeline maps zerolog's fields onto Datadog's reserved attributes (level → status, time → timestamp, service, message).

Via API:

curl -X POST "https://api.datadoghq.com/api/v1/logs/config/pipelines" \
  -H "DD-API-KEY: ${DD_API_KEY}" \
  -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
  -H "Content-Type: application/json" \
  -d @mte-relay-v5-log-pipeline.json

Or recreate it in the UI (Logs → Pipelines → New Pipeline, filter service:mte-relay) with the processors listed in the JSON file.

3. Declare facets and measures

Log-based dashboards aggregate over measures (numeric) and group by facets (string). Create these once in Logs → Explorer (click a value in a matching log → Create facet/measure), or via the facets API:

Path	Type
@product	Facet
@instance	Facet
@correlation_id	Facet
@performance_event.event_type	Facet
@performance_event.status_code	Facet
@performance_event.total_time_ms	Measure
@performance_event.decryption_ms	Measure
@performance_event.validation_ms	Measure
@performance_event.proxy_ms	Measure
@performance_event.encryption_ms	Measure
@performance_event.encrypted_data_bytes	Measure
@performance_event.decrypted_data_bytes	Measure
@security_event.event_type	Facet
@security_event.severity	Facet
@security_event.origin	Facet
@encryption_event.event_type	Facet
@encryption_event.mte_type	Facet
@encryption_event.decryption_time_ms	Measure
@encryption_event.encryption_time_ms	Measure
@error_event.event_type	Facet

4. Import the dashboard

Dashboards → New Dashboard → ⚙ → Import dashboard JSON, then paste mte-relay-v5-dashboard.json. The dashboard has product (MRS/MAR) and instance template variables.

5. Create the monitors

Each element of mte-relay-v5-monitors.json is one monitor definition. Create them via API (replace @your-team-handle in the messages first):

jq -c '.[]' mte-relay-v5-monitors.json | while read -r monitor; do
  curl -X POST "https://api.datadoghq.com/api/v1/monitor" \
    -H "DD-API-KEY: ${DD_API_KEY}" \
    -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
    -H "Content-Type: application/json" \
    -d "$monitor"
done

Included monitors:

Monitor	Fires when
High/critical security event	Any high/critical security_event in 5 min
Handler panic recovered	Any error_event.event_type:panic in 5 min
State store persistence failures	> 5 state_save_failed/state_not_found in 10 min
Elevated request latency	Avg total_time_ms > 500 ms over 10 min (tune)
Client pair exhaustion spike	> 50 client_pairs_exhausted in 15 min (tune)

Cost control

Per-request performance events dominate volume. On high-traffic deployments set PERF_EVENT_SAMPLE_PERCENT=10 on the relay — rates and percentiles on the dashboard remain statistically sound. Security, error, and encryption-audit events are never sampled.