TLDR:
In the Log Streaming integration for Datadog, set the standard env (dd_env) tag and/or let users specify additional custom static value tags to be included in each log.
Details:
Auth0’s Log Streaming integration for Datadog sets the source and service tags. However, it doesn’t set the env (dd_env) tag. This can make managing logs in Datadog by environment more difficult.
In my case, I have two environments and one Datadog account. Across all my infrastructure shipping logs to Datadog, I set an env tag representing the environment. This makes it easy to manage Datadog logs (queries, alerts, etc.) across environments, since there’s a single field shared by all logs that indicates the environment.
Because Log Streaming doesn’t set, or allow me to specify, the env tag, I’m forced to resort to use the data.hostname (which distinguishes the tenant). That’s an exception to my general rule of identifying environments using the same tag name, making it more clumsy to query/filter the logs.
Addendum
It appears to be able to resolve this by setting up a Lookup function in a Datadog Pipeline that processes the logs from Auth0.