Duplicated env tag

[einarjohnson]

Hi there,
I am using vector to parse log files from the SoftwareAG platform into Datadog. When the logs arrive in DD the env tag seems to be duplicated like this:

I am setting this tag like so in a remap transform step
.ddtags = "env:${ENVIRONMENT}" and the ENVIRONMENT env var is set to dev on the Windows host machine where the vector pipe is running. I am failing to understand why the other env:development tag is also appearing as we have no other env vars on the machine that might be setting this value. Any ideas what I may be doing wrong here?

[pront]

Hi @einarjohnson, do you happen to have a sample log before it is send to Datadog logs?
You can try vector tap (see usage here) and check what the remap transform outputs.

[einarjohnson]

Sure. Here is one line

{
   "ddsource":"webmethods-application",
   "ddtags":"env:dev",
   "file":"/Users/einar/vector-experiment/test.log",
   "flow":"OgUtils.email:sendEmail",
   "host":"Einars-MacBook-Pro.local",
   "level":"INFO",
   "message":"sending mail to void@void.com",
   "service":"OgUtils",
   "source_type":"file",
   "thread_id":"0a38c3ab70e54f8982120c47cc7943b7",
   "timestamp":"01-06-2024 19:37:04",
   "xml_document":{
      "body":"Message testing"
   }
}

Given that this is being sent to the DD sink I don't really understand why we have the additional env tag.

[pront]

:hmm: We certainly don't insert a development tag. Is the above log passed directly to a DD logs sink?

[jszwedko]

One guess is that this is a host tag that exists in Datadog that is added to all logs for the host after ingestion. I would check the Einars-MacBook-Pro.local host in Datadog and see what tags it has associated. See https://docs.datadoghq.com/getting_started/tagging/assigning_tags/ for all the different places tags can come from.

[einarjohnson]

@jszwedko , that's exactly the issue. thank you so kindly for pointing this out. <3