> ## Documentation Index
> Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# beacon endpoint datadog

> Generate Datadog Agent custom log collection content and validation events for Beacon endpoint events.

## Forwarding Command

Use `beacon endpoint datadog` to generate Datadog Agent custom log collection content for Beacon endpoint events. The generated pack tails Beacon's local `runtime.jsonl` file with the Datadog Agent and tags events with `service:beacon-endpoint-agent`, `source:beacon`, `vendor:beacon`, and `product:endpoint-agent`.

Beacon does not store Datadog API keys or site configuration. Keep Datadog credentials, site settings, and transport in the Datadog Agent or your endpoint-management secret store.

```bash title="Command syntax" theme={null}
beacon endpoint datadog [command]
```

## Commands

<Columns cols={2}>
  <Card title="beacon endpoint datadog print-config" icon="file-lines" href="#beacon-endpoint-datadog-print-config">
    Print a Datadog Agent custom log config for the configured runtime log.
  </Card>

  <Card title="beacon endpoint datadog install-pack" icon="box-archive" href="#beacon-endpoint-datadog-install-pack">
    Write Datadog Agent custom log integration content to a directory.
  </Card>

  <Card title="beacon endpoint datadog validate" icon="check" href="#beacon-endpoint-datadog-validate">
    Write and describe a Beacon Datadog validation event.
  </Card>
</Columns>

## Runtime log paths

| Mode        | Path                                    |
| ----------- | --------------------------------------- |
| User mode   | `~/.beacon/endpoint/logs/runtime.jsonl` |
| System mode | `/var/log/beacon-agent/runtime.jsonl`   |

## beacon endpoint datadog print-config

`beacon endpoint datadog print-config` prints a Datadog Agent custom log config for the configured Beacon runtime JSONL log.

```bash title="Print the configuration" theme={null}
beacon endpoint datadog print-config
```

Use this command when you want to copy the custom log configuration into an existing Datadog Agent configuration workflow.

### Examples

Print config for the default per-user Beacon install:

```bash title="Print config for the default per-user Beacon install" theme={null}
beacon endpoint datadog print-config
```

Print config for a system-mode MDM deployment:

```bash title="Print config for a system-mode MDM deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint datadog print-config --system
```

Print config for a custom runtime log:

```bash title="Print config for a custom runtime log" theme={null}
beacon endpoint datadog print-config --log-path /path/to/runtime.jsonl
```

### Flags

| Flag                | Description                                     |
| ------------------- | ----------------------------------------------- |
| `--user`            | Use per-user endpoint paths. Enabled by default |
| `--system`          | Use system endpoint paths and launch daemon     |
| `--log-path <path>` | Runtime JSONL log path                          |

## beacon endpoint datadog install-pack

`beacon endpoint datadog install-pack` writes Datadog Agent custom log integration content to a directory.

```bash title="Generate the integration pack" theme={null}
beacon endpoint datadog install-pack --output ./beacon-datadog-pack
```

The pack includes Datadog Agent `conf.yaml`, setup instructions, and sample Beacon endpoint events.

### Examples

Generate a content pack for the default per-user install:

```bash title="Generate a content pack for the default per-user install" theme={null}
beacon endpoint datadog install-pack --output ./beacon-datadog-pack
```

Generate a content pack for a system-mode deployment:

```bash title="Generate a content pack for a system-mode deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint datadog install-pack \
  --system \
  --output ./beacon-datadog-pack
```

Generate a content pack for a custom runtime log:

```bash title="Generate a content pack for a custom runtime log" theme={null}
beacon endpoint datadog install-pack \
  --output ./beacon-datadog-pack \
  --log-path /path/to/runtime.jsonl
```

### Flags

| Flag                | Description                                                                      |
| ------------------- | -------------------------------------------------------------------------------- |
| `--output <dir>`    | Output directory for the Datadog content pack. Defaults to `beacon-datadog-pack` |
| `--user`            | Use per-user endpoint paths. Enabled by default                                  |
| `--system`          | Use system endpoint paths and launch daemon                                      |
| `--log-path <path>` | Runtime JSONL log path                                                           |

## beacon endpoint datadog validate

`beacon endpoint datadog validate` writes a Beacon validation event to the runtime JSONL log and prints the expected Datadog fields and validation query.

```bash title="Run the validation check" theme={null}
beacon endpoint datadog validate
```

### Examples

Write a validation event for the default per-user install:

```bash title="Write a validation event for the default per-user install" theme={null}
beacon endpoint datadog validate
```

Write a validation event for a system-mode deployment:

```bash title="Write a validation event for a system-mode deployment" theme={null}
sudo /opt/beacon/bin/beacon endpoint datadog validate --system
```

Write a validation event to a custom runtime log:

```bash title="Write a validation event to a custom runtime log" theme={null}
beacon endpoint datadog validate --log-path /path/to/runtime.jsonl
```

The validation command prints a Datadog Log Explorer query:

```text theme={null}
service:beacon-endpoint-agent "Beacon endpoint datadog validation event"
```

### Flags

| Flag                | Description                                     |
| ------------------- | ----------------------------------------------- |
| `--user`            | Use per-user endpoint paths. Enabled by default |
| `--system`          | Use system endpoint paths and launch daemon     |
| `--log-path <path>` | Runtime JSONL log path                          |

## Related

<Columns cols={2}>
  <Card title="Datadog forwarding" icon="chart-line" href="/log-forwarding/datadog">
    Configure Datadog Agent custom log collection for Beacon events.
  </Card>

  <Card title="Log forwarding" icon="tower-broadcast" href="/log-forwarding">
    Review forwarding patterns and validation steps.
  </Card>

  <Card title="Endpoint agent" icon="desktop" href="/cli/endpoint">
    Install and inspect the local endpoint agent.
  </Card>

  <Card title="Endpoint event schema" icon="code" href="/telemetry-schema/event-schema">
    Review normalized Beacon JSONL fields and example events.
  </Card>
</Columns>