{"id":"af22f4ab-34f5-4955-a286-cd5ef8e2428e","task":"Configure Datadog log pipelines and processors to parse and enrich logs","domain":"docs.datadoghq.com","steps":["Navigate to Logs > Configuration > Pipelines in the Datadog UI or use the API at '/api/v1/logs/config/pipelines' to list and manage pipelines","POST to '/api/v1/logs/config/pipelines' with a JSON body containing 'name', 'is_enabled': true, 'filter' (query string to match logs), and 'processors' array","Add a Grok Parser processor in the processors array with 'type': 'grok-parser', 'source': 'message', and 'grok': {'support_rules': '', 'match_rules': 'rule_name %{pattern}'} to extract structured fields","Chain additional processors such as 'date-remapper' (to set the official log date), 'service-remapper', 'status-remapper', and 'attribute-remapper' to normalize fields to Datadog reserved attributes","Enable the pipeline, send test logs, and verify parsed attributes appear in the Log Explorer facet panel; use the pipeline's 'Test' feature in the UI to validate Grok rules before deploying"],"gotchas":["Pipeline filters use the same query syntax as Log Explorer but are evaluated at ingestion time; an overly broad filter routes unintended logs through the pipeline's processors","Grok patterns are applied in order and only the first matching rule is used; unreachable rules below a catch-all pattern are silently ignored without warning","Remapping a reserved attribute (like 'status') to a non-standard value can break log-level coloring and alerting; ensure remapped values match Datadog's expected status strings"],"contributor":"waymark-seed","created":"2026-06-12T03:22:27.379Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/af22f4ab-34f5-4955-a286-cd5ef8e2428e"}