> ## Documentation Index
> Fetch the complete documentation index at: https://docs.visiqlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Stream logs to Datadog
> Continuously ship your governance decision and audit logs to your own Datadog organization.
VisIQ can forward your governance **decision** and **audit** logs to your own Datadog organization as they happen, so your existing dashboards, monitors and retention policy cover AI governance the same way they cover everything else.
Set it up at **Connectors → Log Streaming → Datadog**. It takes about three minutes.
***
## Before you start
* A Datadog organization and permission to create an **API key** in it.
* A VisIQ account with the **`settings:update`** permission — the log-destination endpoints are guarded by it.
Streaming starts from the moment you save. There is **no historical backfill** — logs recorded before the destination existed stay in VisIQ's audit trail and are not replayed into Datadog.
***
## Step 1 — Create a Datadog API key
In Datadog, go to **Organization Settings → API Keys → New Key** and copy the key value.
An **API key** is all VisIQ needs, and it is deliberately the least-privileged option:
* Log submission authenticates with the `DD-API-KEY` header and nothing else.
* VisIQ never asks for an **Application key**, which is the credential that can read your Datadog data and change configuration. If you are about to paste something that starts with your user's app key, you have the wrong one.
***
## Step 2 — Pick your site
Datadog runs several independent regions and your API key only works against yours. VisIQ asks you to pick it from a fixed list rather than accepting a URL:
| Site | Region |
| ------------------- | ----------------- |
| `datadoghq.com` | US1 — the default |
| `us3.datadoghq.com` | US3 |
| `us5.datadoghq.com` | US5 |
| `datadoghq.eu` | EU1 |
| `ap1.datadoghq.com` | AP1 · Japan |
| `ap2.datadoghq.com` | AP2 · Australia |
| `uk1.datadoghq.com` | UK1 |
| `ddog-gov.com` | US1-FED |
| `us2.ddog-gov.com` | US2-FED |
To find yours, match your browser's Datadog URL (`app.datadoghq.com` is US1, `us5.datadoghq.com` is US5, `app.datadoghq.eu` is EU1, and so on), or read it at the top of **My Preferences**.
Note that EU1 is `datadoghq.eu` — **not** `eu1.datadoghq.com` — and US1 has no region prefix at all.
### Why a list and not a URL
VisIQ **derives** every Datadog host from the site you pick and never accepts a customer-supplied URL for this connector:
* logs go to `https://http-intake.logs./api/v2/logs`
* the key check goes to `https://api./api/v1/validate`
That removes a whole class of risk: because there is no URL field, there is nothing to point at an internal host, and a typo produces "wrong site" rather than a silent redirection of your compliance logs.
***
## Step 3 — Choose what to stream
Pick at least one stream. Both are on by default.
| Stream | Contents |
| ------------- | -------------------------------------------------------------------- |
| **Decisions** | Action, retrieval, and Human-in-the-Loop governance decision events. |
| **Audit** | Platform configuration and access audit log. |
You can also set an optional **source name** (Datadog's `source` attribute, e.g. `visiq`) to make the events easy to filter alongside your other log sources.
***
## Step 4 — Verify and save
There is no **Test connection** button here. As soon as your key is entered and the configuration is complete, VisIQ sends a test event to your Datadog intake automatically, and **Save** unlocks once it is verified. If it fails, fix the key or the site and VisIQ re-verifies on its own.
Once saved, the connector card shows delivered and failed counts so you can see the stream's health at a glance.
***
## How delivery behaves
Understanding the retry model matters when you are reconciling counts.
* Datadog's intake returns **202** for an accepted batch. That is what VisIQ counts as delivered.
* A **bad key, wrong site, or oversized batch** is a permanent rejection. VisIQ **buffers and backs off** rather than discarding the batch, so you can fix the configuration without losing logs.
* **Rate limits, timeouts, server errors and network failures** are retried.
* Datadog **silently drops** logs older than roughly its 18-hour intake window while still answering 202. VisIQ will not report those as delivered: a batch that has aged past the window is counted as dropped and skipped, so a backlog can never be falsely attested as shipped.
***
## The API behind the card
`GET` needs `settings:view`; `POST` needs `settings:update`.
```json POST /api/log-destinations theme={null}
{
"name": "Datadog — production",
"type": "datadog",
"datadog_site": "us5.datadoghq.com",
"streams": ["decisions", "audit"],
"auth_config": { "api_key": "…" },
"source_name": "visiq",
"enabled": true
}
```
Note the shape: Datadog carries `datadog_site` and **no** `endpoint_url`, because the host is derived. `streams` must be a non-empty subset of `decisions` and `audit`. On a later update, omitting `auth_config` keeps the stored key unchanged.
***
## Troubleshooting
Almost always the wrong **site**. A key issued in EU1 does not authenticate against US1. Match the site to the Datadog URL you use in the browser, then let VisIQ re-verify.
Open the destination — the recorded error names the cause. A permanent status (a rejected key, a site mismatch) means VisIQ is buffering rather than dropping: correct the setting and the buffered batches deliver on the next attempt.
Datadog discards logs older than about 18 hours at intake. VisIQ counts anything that has aged past that window as dropped instead of reporting it delivered — the stream keeps moving rather than wedging on undeliverable history.
Log submission takes an organization **API key**, not an Application key. Create one under Organization Settings → API Keys.
***
## Related
The same streams into your own Elastic deployment, with a least-privilege API key.
InsightIDR Custom Logs, where the webhook URL is the whole credential.