Datadog Agent

The gateway accepts the Datadog Agent's own wire formats, so the Agent can send straight to Watchtower with no Collector in between. Use an ingestion key as the Agent's api_key (the DD-API-KEY header is the key). The key needs ingest:traces for APM, ingest:metrics for metrics and ingest:logs for logs.

Agent (datadog.yaml), pointing metrics, logs and APM traffic at the gateway HTTP address:

api_key: wti_replace_with_your_ingestion_key
dd_url: https://ingest.example.com
apm_config:
  enabled: true
  apm_dd_url: https://ingest.example.com
logs_config:
  logs_dd_url: ingest.example.com:443

Mapping. Traces: the 64-bit trace_id is widened to 128 bits with the high half taken from the span meta _dd.p.tid (zero when absent); service becomes service.name, resource becomes resource.name, meta entries become string attributes, metrics entries become numeric attributes, meta["span.kind"] sets the span kind, and a non-zero error marks the span as failed. Metrics: a gauge stays a gauge; a count becomes a delta sum; a rate becomes a delta sum of rate * interval (interval defaults to 10 s). Tags key:value become attributes and the host resource becomes host.name. Logs: message is the body, service becomes service.name, hostname becomes host.name, ddtags become attributes and status sets the severity. Request bodies may use the Agent's deflate encoding. Payloads are size-limited and msgpack nesting deeper than 32 levels is rejected.

DogStatsD (UDP 8125) is not served by the gateway; it is an input of the Watchtower agent. Run the Watchtower agent with its DogStatsD module, or keep the Datadog Agent's own DogStatsD and let it forward the metrics as above.

Delivery is at-least-once: the Agent retries failed flushes, so duplicates are possible, and data the Agent buffered in memory is lost if it crashes. Do not set wt.* tags; the gateway deletes them.

Alternative: through your own Collector

If you already run an OpenTelemetry Collector (contrib), the Agent can send to its datadog receiver and the Collector forwards over OTLP/HTTP. Logs are not covered by that receiver; use the direct endpoint above, Fluent Bit or Vector. Set WT_OTLP_ENDPOINT (for example https://ingest.example.com) and WT_INGEST_KEY for the Collector. Point the Agent's dd_url and apm_config.apm_dd_url at http://otel-collector:8126. Keep that Collector on a trusted network: the datadog receiver does no authentication.

receivers:
  datadog:
    endpoint: 0.0.0.0:8126
processors:
  batch: {}
exporters:
  otlphttp:
    endpoint: ${env:WT_OTLP_ENDPOINT}
    headers:
      Authorization: "Bearer ${env:WT_INGEST_KEY}"
service:
  pipelines:
    traces:
      receivers: [datadog]
      processors: [batch]
      exporters: [otlphttp]
    metrics:
      receivers: [datadog]
      processors: [batch]
      exporters: [otlphttp]

Status: unit-tested against hand-built payloads, not yet run against the real Agent. The Agent's v0.5 trace format and its protobuf /api/v0.2/traces are not accepted; leave the Agent on its default JSON/msgpack v0.4 output.