Why is Datadog Log error tracking not working for Apache/PHP sources?

Monitoring and Observability Datadog
#1

Does Datadog Log error tracking; https://docs.datadoghq.com/logs/error_tracking/backend/?tab=serilog, work for Apache or PHP sources? My Logs are coming in and have the error.stack attribute but i don’t see anything in the Log error tracking explorer…

#2

The source is apache

#3

Hello there,

I would recommend reaching out to help@datadoghq.com so they can look into your specific setup and see if they find anything which could explain the situation.

#4

Hi ! Correctly formatted PHP errors should show up in error tracking. Apache may not work out of the box, you could use a log re-mapper to map error.message and error.type , which the Error Tracking algorithm requires to group. You can use the Apache Integration to help with this. Does this help?

#5

Where can i find the allowed values for error.type and error.message? In can’t find this anywhere in the docs.

I imagine error.message is just a string, but what about error.type?

#6

It should be explained here

#7

Seems like it should be error.kind instead of error.type?

#8

Seems like it yes but that might be something to double check with help@datadoghq.com.

I would lean toward error.kind as it has a specific UI meaning it has a special treatment

#9

How would i fill the error.message when using logs for apache? I tried using the attribute remapper, but looking at the log, the message key doesn’t fall under the attributes key…

	"id": REDACTED,
	"content": {
		"timestamp": "2023-07-17T12:17:02.078Z",
		"tags": [
			REDACTED
		],
		"host": REDACTED,
		"service": "apache",
		"message": REDACTED,
		"attributes": {
			"apacheModule": "authz_core",
			"level": "error",
			"processId": REDACTED,
			"timestamp": 1689603421480,
			"network": REDACTED
		}
	}
}```
#10

In this case you can:
• create a pipeline which filter on status:error source:apache
• add a grok parser which extract the content of the message in error.message
◦ extract_rule %{data:error.message}

#11

Thanks that seems to work!