OneAgent log ingest API

You can use the local http://localhost:<port>/v2/logs/ingest API endpoint to push locally retrieved logs to Dynatrace over a secure and authenticated channel. This endpoint is available only to local clients and cannot be reached from remote hosts.

The OneAgent log ingest endpoint mimics the behavior of the public Log Monitoring API - POST ingest logs endpoint.

Enable the log ingest API

You need to enable the OneAgent log ingest API at the environment or host level. Note that the host-level configuration overrides the environment configuration.

Enable at the environment level

In the Dynatrace menu, go to Settings and select Preferences > Extension Execution Controller.
Turn on Enable Extension Execution Controller.
Turn on Enable local PIPE/HTTP metric and Log Ingest API.

Enable for a single host

In the Dynatrace menu, go to Hosts and select a host name to open the host overview page.
Select More (…) > Settings.
Select Extension Execution Controller.
Turn on Enable Extension Execution Controller.

Enable for a host group

In the Dynatrace menu, go to Deployment status and select OneAgents.
Filter the table by Host group and select the host group you want to configure.
Select the host group name in any row.
On the host page, select More (…) > Settings.
Select Extension Execution Controller.
Turn on Enable Extension Execution Controller.

Log event format

The request consumes an application/json payload with the charset=utf-8 character set. For more information on the format, see Log Monitoring API - POST ingest logs.

Limits

The log events pushed to Dynatrace using OneAgent log ingest API are a subject the same limits as public Log Monitoring API - POST ingest logs and the following additional limits:

Limit	Value
Number of log events per minute	10,000
Number of requests per minute	1,000
Number of log events in a single request	5,000

Example

With this curl command, you'll ingest the Exception: Custom error log sent via OneAgent log ingest event, with the severity set to error and a custom attribute set to attribute value. As the timestamp isn't provided, the event is automatically timestamped with the event reading time. You'll be able to access the event in Log viewer (Logs Classic).

bash
curl -i -X POST "http://127.0.0.1:14499/v2/logs/ingest" -H "Content-Type: application/json; charset=utf-8" -d "{\"content\":\"Exception: Custom error log sent via Generic Log Ingest\",\"custom.attribute\":\"attribute value\",\"severity\": \"error\"}"

Successful response returns the 204 code.

plaintext
HTTP/1.1 204 No Content
Content-Type: application/json
Server: EEC
Content-Length: 116

Communication port

The default metric ingestion port is 14499. If necessary, you can use the oneagentctl command to check or change the port. Changing the metric ingestion port requires restart of OneAgent. Add --restart-service to the command to restart OneAgent automatically.

Check the ingestion port

Use the --get-extensions-ingest-port parameter to show the current local ingestion port, 14499 by default.

Linux: ./oneagentctl --get-extensions-ingest-port
Windows: .\oneagentctl.exe --get-extensions-ingest-port

Set a custom ingestion port

Use the --set-extensions-ingest-port=<arg> parameter to set a custom local ingestion port.

Linux: ./oneagentctl --set-extensions-ingest-port=14499 --restart-service
Windows: .\oneagentctl.exe --set-extensions-ingest-port=14499 --restart-service

Configure proxy

Configure your host proxy to allow localhost traffic going to the metric ingestion port, 14499 by default.

Note that changing the port for the OneAgent log ingest API also affects OneAgent metric API, Metric scripting integration, and Telegraf metrics integration.