Some feedback on datadog log explorer:
07 Oct 2018:
-
the pricing is per event , all usual log saas are per GB , it is hard for me to guess how much it would cost
-
it is not 100% clear that when I use exclusion that it will count as an event or not
-
it wasn't clear that I needed the latest of the version 6 , I had latest of 5 dd-agent (took me an hour to realize)
-
in log explorer headers should stay on top (like a freeze row in google docs) + sidebar stays visible
-
in log explorer I'd like to change the column order , not just last added at the end
-
if I specify a metric that is in ms, why show 1 ms as 1000ns
-
in log explorer it would be nice to right click on the title and hide it
-
hiding a facet via Manage facet doesn't hide it for me
-
excluded items do seem to appear in the livetail (this gives the feeling it doesn't work)
-
I can't seem to change the retention time of my main index? (it's grayed out)
-
Now there is only 1 log view (sometimes I'd like to have different log views per customer) when they are running on the same docker cluster
-
it would be nice when I click on a value , say userId that it would ask me to add it to the filter.
-
I would not know how to make level:10, level:20 , level30 , level 50 => to status WARN, INFO , ERROR easiliy
-
When I change something to the pipeline, I expect a save/apply button, now it's instantly
-
I wanted to exclude multiple containers via the DD_AC_EXCLUDE but with the space separation it didn't work
-
DD_AC_EXCLUDE also isn't clear that it needs the full image name , or the datadog/agent or agent or datadog/agent:latest
-
can you create other indexes besides main?
-
also was looking for a way to send my own logs, found this would work
echo "<my-apik-key> { \"name\":\"patrick\"}" | openssl s_client -connect intake.logs.datadoghq.com:10516 -
if this were to be used for example from browser of native device, port 10516 would often be blocked , so either port 443 and/or https ingest would be nice
BUT BUT BUT I love it!
Part2:
- sometimes the auto resizing of a column is good if it is too large for the screen , but if you have enough space it would make sense to allow for field display size to be resized in the overview
- had 3 containers loose their logs - they were logging correctly on stdout , but logs somehow didn't show up in datadog . having ecs restart a new set of containers made the data flow again ... (this one has me worried a bit)
Part3:
- found that max-files=1 made the ecs container stop after it's log size was reached
- still looking on how to alter/rewrite/replace only 1 field in a json structure
- found that hiding facet was only to hide it from the left menu , I needed the menu on the right to hide it from the display
Part4:
- it seems docker labels don't get through to the metadata (ecs) - also DD_TAGS doesn't get through