--- title: "Create a custom destination" method: POST path: "/api/v2/logs/config/custom-destinations" tags: ["Logs Custom Destinations"] --- # Create a custom destination `POST /api/v2/logs/config/custom-destinations` Create a custom destination in your organization. ## Request body - CustomDestinationCreateRequest — The custom destination. - `data` CustomDestinationCreateRequestDefinition — The definition of a custom destination. - `attributes` CustomDestinationCreateRequestAttributes, required — The attributes associated with the custom destination. - `enabled` boolean — Whether logs matching this custom destination should be forwarded or not. - `forward_tags` boolean — Whether tags from the forwarded logs should be forwarded or not. - `forward_tags_restriction_list` string[] — List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter. - `forward_tags_restriction_list_type` 'ALLOW_LIST' | 'BLOCK_LIST' — How `forward_tags_restriction_list` parameter should be interpreted. If `ALLOW_LIST`, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded. `BLOCK_LIST` works the opposite way. It does not forward the tags matching the ones on the list. - `forwarder_destination` union, required — A custom destination's location to forward logs. - CustomDestinationForwardDestinationHttp — The HTTP destination. - `auth` union, required — Authentication method of the HTTP requests. - CustomDestinationHttpDestinationAuthBasic — Basic access authentication. - … - CustomDestinationHttpDestinationAuthCustomHeader — Custom header access authentication. - … - `endpoint` string, required — The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. - `type` 'http', required — Type of the HTTP destination. - CustomDestinationForwardDestinationSplunk — The Splunk HTTP Event Collector (HEC) destination. - `access_token` string, required — Access token of the Splunk HTTP Event Collector. This field is not returned by the API. - `endpoint` string, required — The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. - `sourcetype` string, nullable — The Splunk sourcetype for the events sent to this Splunk destination. If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used. On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept. If set to `null`, the sourcetype field is omitted from the forwarded event entirely. Otherwise, the provided string value is used as the sourcetype. - `type` 'splunk_hec', required — Type of the Splunk HTTP Event Collector (HEC) destination. - CustomDestinationForwardDestinationElasticsearch — The Elasticsearch destination. - `auth` CustomDestinationElasticsearchDestinationAuth, required — Basic access authentication. - `password` string, required — The password of the authentication. This field is not returned by the API. - `username` string, required — The username of the authentication. This field is not returned by the API. - `endpoint` string, required — The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. - `index_name` string, required — Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). - `index_rotation` string — Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-'W'ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation). - `type` 'elasticsearch', required — Type of the Elasticsearch destination. - CustomDestinationForwardDestinationMicrosoftSentinel — The Microsoft Sentinel destination. - `client_id` string, required — Client ID from the Datadog Azure integration. - `data_collection_endpoint` string, required — Azure data collection endpoint. - `data_collection_rule_id` string, required — Azure data collection rule ID. - `stream_name` string, required — Azure stream name. - `tenant_id` string, required — Tenant ID from the Datadog Azure integration. - `type` 'microsoft_sentinel', required — Type of the Microsoft Sentinel destination. - `name` string, required — The custom destination name. - `query` string — The custom destination query and filter. Logs matching this query are forwarded to the destination. - `type` 'custom_destination', required — The type of the resource. The value should always be `custom_destination`. ## Response `200` OK - CustomDestinationResponse — The custom destination. - `data` CustomDestinationResponseDefinition — The definition of a custom destination. - `attributes` CustomDestinationResponseAttributes — The attributes associated with the custom destination. - `enabled` boolean — Whether logs matching this custom destination should be forwarded or not. - `forward_tags` boolean — Whether tags from the forwarded logs should be forwarded or not. - `forward_tags_restriction_list` string[] — List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter. - `forward_tags_restriction_list_type` 'ALLOW_LIST' | 'BLOCK_LIST' — How `forward_tags_restriction_list` parameter should be interpreted. If `ALLOW_LIST`, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded. `BLOCK_LIST` works the opposite way. It does not forward the tags matching the ones on the list. - `forwarder_destination` union — A custom destination's location to forward logs. - CustomDestinationResponseForwardDestinationHttp — The HTTP destination. - `auth` union, required — Authentication method of the HTTP requests. - CustomDestinationResponseHttpDestinationAuthBasic — Basic access authentication. - … - CustomDestinationResponseHttpDestinationAuthCustomHeader — Custom header access authentication. - … - `endpoint` string, required — The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. - `type` 'http', required — Type of the HTTP destination. - CustomDestinationResponseForwardDestinationSplunk — The Splunk HTTP Event Collector (HEC) destination. - `endpoint` string, required — The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. - `sourcetype` string, nullable — The Splunk sourcetype for the events sent to this Splunk destination. If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used. On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept. If set to `null`, the sourcetype field is omitted from the forwarded event entirely. Otherwise, the provided string value is used as the sourcetype. - `type` 'splunk_hec', required — Type of the Splunk HTTP Event Collector (HEC) destination. - CustomDestinationResponseForwardDestinationElasticsearch — The Elasticsearch destination. - `auth` CustomDestinationResponseElasticsearchDestinationAuth, required — Basic access authentication. - `endpoint` string, required — The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. - `index_name` string, required — Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). - `index_rotation` string — Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-'W'ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation). - `type` 'elasticsearch', required — Type of the Elasticsearch destination. - CustomDestinationResponseForwardDestinationMicrosoftSentinel — The Microsoft Sentinel destination. - `client_id` string, required — Client ID from the Datadog Azure integration. - `data_collection_endpoint` string, required — Azure data collection endpoint. - `data_collection_rule_id` string, required — Azure data collection rule ID. - `stream_name` string, required — Azure stream name. - `tenant_id` string, required — Tenant ID from the Datadog Azure integration. - `type` 'microsoft_sentinel', required — Type of the Microsoft Sentinel destination. - `name` string — The custom destination name. - `query` string — The custom destination query filter. Logs matching this query are forwarded to the destination. - `id` string — The custom destination ID. - `type` 'custom_destination' — The type of the resource. The value should always be `custom_destination`. ## Other responses - `400` — Bad Request - `403` — Forbidden - `409` — Conflict - `429` — Too many requests --- [API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)