beacon endpoint datadog

Generate Datadog Agent custom log collection content and validation events for Beacon endpoint events.

Forwarding Command

Use beacon endpoint datadog to generate Datadog Agent custom log collection content for Beacon endpoint events. The generated pack tails Beacon’s local runtime.jsonl file with the Datadog Agent and tags events with service:beacon-endpoint-agent, source:beacon, vendor:beacon, and product:endpoint-agent.

Beacon does not store Datadog API keys or site configuration. Keep Datadog credentials, site settings, and transport in the Datadog Agent or your endpoint-management secret store.

Command syntax

beacon endpoint datadog [command]

Commands

beacon endpoint datadog print-config

Print a Datadog Agent custom log config for the configured runtime log.

beacon endpoint datadog install-pack

Write Datadog Agent custom log integration content to a directory.

beacon endpoint datadog validate

Write and describe a Beacon Datadog validation event.

Runtime log paths

Mode	Path
User mode	~/.beacon/endpoint/logs/runtime.jsonl
System mode	/var/log/beacon-agent/runtime.jsonl

beacon endpoint datadog print-config

beacon endpoint datadog print-config prints a Datadog Agent custom log config for the configured Beacon runtime JSONL log.

Print the configuration

beacon endpoint datadog print-config

Use this command when you want to copy the custom log configuration into an existing Datadog Agent configuration workflow.

Examples

Print config for the default per-user Beacon install:

Print config for the default per-user Beacon install

beacon endpoint datadog print-config

Print config for a system-mode MDM deployment:

Print config for a system-mode MDM deployment

sudo /opt/beacon/bin/beacon endpoint datadog print-config --system

Print config for a custom runtime log:

Print config for a custom runtime log

beacon endpoint datadog print-config --log-path /path/to/runtime.jsonl

Flags

Flag	Description
--user	Use per-user endpoint paths. Enabled by default
--system	Use system endpoint paths and launch daemon
--log-path <path>	Runtime JSONL log path

beacon endpoint datadog install-pack

beacon endpoint datadog install-pack writes Datadog Agent custom log integration content to a directory.

Generate the integration pack

beacon endpoint datadog install-pack --output ./beacon-datadog-pack

The pack includes Datadog Agent conf.yaml, setup instructions, and sample Beacon endpoint events.

Examples

Generate a content pack for the default per-user install:

Generate a content pack for the default per-user install

beacon endpoint datadog install-pack --output ./beacon-datadog-pack

Generate a content pack for a system-mode deployment:

Generate a content pack for a system-mode deployment

sudo /opt/beacon/bin/beacon endpoint datadog install-pack \
  --system \
  --output ./beacon-datadog-pack

Generate a content pack for a custom runtime log:

Generate a content pack for a custom runtime log

beacon endpoint datadog install-pack \
  --output ./beacon-datadog-pack \
  --log-path /path/to/runtime.jsonl

Flags

Flag	Description
--output <dir>	Output directory for the Datadog content pack. Defaults to beacon-datadog-pack
--user	Use per-user endpoint paths. Enabled by default
--system	Use system endpoint paths and launch daemon
--log-path <path>	Runtime JSONL log path

beacon endpoint datadog validate

beacon endpoint datadog validate writes a Beacon validation event to the runtime JSONL log and prints the expected Datadog fields and validation query.

Run the validation check

beacon endpoint datadog validate

Examples

Write a validation event for the default per-user install:

Write a validation event for the default per-user install

beacon endpoint datadog validate

Write a validation event for a system-mode deployment:

Write a validation event for a system-mode deployment

sudo /opt/beacon/bin/beacon endpoint datadog validate --system

Write a validation event to a custom runtime log:

Write a validation event to a custom runtime log

beacon endpoint datadog validate --log-path /path/to/runtime.jsonl

The validation command prints a Datadog Log Explorer query:

service:beacon-endpoint-agent "Beacon endpoint datadog validation event"

Flags

Flag	Description
--user	Use per-user endpoint paths. Enabled by default
--system	Use system endpoint paths and launch daemon
--log-path <path>	Runtime JSONL log path

Related

Datadog forwarding

Configure Datadog Agent custom log collection for Beacon events.

Log forwarding

Review forwarding patterns and validation steps.

Endpoint agent

Install and inspect the local endpoint agent.

Endpoint event schema

Review normalized Beacon JSONL fields and example events.