Free Datadog Log Management Fundamentals Sample Questions

Correct answer: A — It tails specified log files and can also listen for logs sent over UDP or TCP

• A. Once enabled, the Agent tails configured log files for new lines and can also listen on UDP or TCP sockets to receive logs sent over the network.
• B. Limiting collection to the system journal alone is inaccurate; the Agent is commonly configured to tail arbitrary log files, not just journal output.
• C. The Agent does not operate by polling a Datadog API to pull historical files; it actively collects log data locally as it is written or received.
• D. A DaemonSet is a Kubernetes deployment pattern for running one Agent pod per node; it is not required for the Agent to collect logs on a standalone host.

Correct answer: A — Install the Agent as a DaemonSet (via manifest, Helm chart, or Operator) for one pod per node with auto-tagging

• A. Running the Agent as a DaemonSet, using the manifest, Helm chart, or Operator, places one Agent pod on every node and automatically tags collected logs with pod, namespace, and container metadata.
• B. A single Deployment replica does not run on every node and is not how Kubernetes log collection with automatic metadata tagging is designed to work.
• C. Having every application push logs directly to the intake endpoint would require rewriting each app and would not automatically attach Kubernetes metadata the way the Agent does.
• D. Restricting the Agent to control plane nodes would miss logs from workloads running on the much larger set of worker nodes.

Correct answer: A — The Agent recognizes JSON key-value pairs as attributes automatically, without a grok parser

• A. Because JSON already expresses fields as key-value pairs, the Agent can turn each pair into an attribute without a Grok Parser having to extract fields from unstructured text.
• B. Plain-text logs are still accepted without a custom parser attached; they simply arrive with their content inside `message` as free text until a Grok Parser is configured to extract fields.
• C. JSON logs still pass through the pipeline stage, where processors like remappers and the Category Processor can still run; they are not indexed untouched.
• D. Plain-text logs can include a timestamp within the text; the difference is whether that timestamp is automatically recognized as structured data, not whether one can be present.

Correct answer: A — It flattens the nesting into a dotted attribute name, such as `http.status_code`

• A. Datadog flattens nested JSON objects into dot-notated attribute names, so the inner `status_code` field becomes searchable as `http.status_code` without any extra configuration.
• B. Nested objects are not discarded; their inner fields are preserved and made searchable through the flattening behavior rather than being dropped at the top level.
• C. The nested object is not collapsed into a single opaque string for the parent key; each inner field remains individually addressable as its own attribute.
• D. A Grok Parser is used to extract fields from unstructured text, not to unpack JSON objects, which are already structured and flattened automatically.

Correct answer: A — `version`, because it changes with each deployment and lets telemetry be filtered by release

• A. The `version` tag is expected to change with each new deployment, making it the right tag for isolating telemetry tied to a specific release and comparing error rates before and after that release. This is exactly the scenario unified service tagging's version tag is designed to support.
• B. The `env` tag separates environments like staging and production but does not distinguish between successive releases within the same environment. It would not isolate the specific deployment the team wants to evaluate.
• C. The `service` tag identifies which application component is involved, but it stays constant across releases of that same service. It cannot by itself distinguish the new release from prior ones.
• D. Host identifies the underlying server or container instance, which can change independently of releases and is not part of unified service tagging's three core tags. It is not a reliable way to filter telemetry by deployment version.

Correct answer: C — Agent version 6

• A. This release predates the current Agent's log collection pipeline, which was introduced later, so it cannot forward logs.
• B. This release also predates built-in log collection support, which arrived with a later major version.
• C. Log collection was introduced starting with this major version, making it the minimum version that supports tailing files and forwarding logs.
• D. This later release also supports log collection, but it is not the minimum version required — an earlier major version already introduced the capability.

Correct answers: A, B, C — Tailing a log file with the Datadog Agent; Submitting logs directly through the Log HTTP API; Collecting a container's stdout and stderr streams

• A. The Agent's file-tailing configuration is a documented, supported way to collect logs from an existing file without changing the application.
• B. The Log HTTP API is a supported, language-agnostic path for any process that can make an HTTP request to submit logs directly.
• C. Reading a container's standard output and error streams is a supported collection method for Docker and Kubernetes workloads that log to stdout.
• D. Datadog has no built-in mechanism that polls a database table for log rows; this is not a supported log emission or collection path.
• E. There is no supported Datadog feature that retrieves archived text files from an FTP server as a log source.
• F. SNMP traps are used for network device alerting, not for log emission, and Datadog does not extract logs from them.

Correct answer: A — v6.0+

• A. Log collection support was introduced starting with this major version, making it the minimum version required for the feature to exist.
• B. This earlier major version predates the introduction of log collection support in the Agent.
• C. This version relates to when HTTPS became the default transport for logs, not the minimum version needed for log collection to exist.
• D. This version also relates to the HTTPS-by-default transport change, not the earliest version that supports log collection.

Correct answer: A — `docker`

• A. This type tells the Agent to collect logs directly from the container runtime's stdout/stderr stream rather than tailing a file or listening on a network port.
• B. This type expects a file system path to tail and is meant for logs written to disk, not for reading a container's stdout/stderr stream.
• C. This type reads from the systemd journal on the host and is unrelated to collecting a Docker container's own stdout/stderr output.
• D. This type expects the application to open a TCP connection and send logs over the network, which does not match collecting a container's console output.

Correct answer: A — Mask

• A. Mask obfuscates the value in place but is documented as reversible by authorized users for logs, APM, and RUM data, which matches the requirement to recover the original value later.
• B. Hash replaces the value with a non-reversible unique identifier, so the original value cannot be recovered afterward, which does not satisfy a reversibility requirement.
• C. Redact replaces the matched value with a fixed token and discards the original content, so the original value is not recoverable later.
• D. Partially redact obscures only part of a value permanently and does not provide a way to reconstruct the original full value afterward.

Correct answer: A — A mask_sequences rule with a pattern matching three digits, two digits, and four digits separated by hyphens

• A. A mask_sequences rule with a pattern for the digit-hyphen-digit-hyphen-digit shape matches the social security number format and replaces just that substring with a token, leaving the rest of the line intact.
• B. Excluding the entire line whenever nine digits appear would drop unrelated log lines that happen to contain other nine-digit numbers, and it removes the whole line rather than masking just the number.
• C. This would drop every line containing any hyphenated digit sequence, which is both overly broad and removes whole lines instead of masking the specific number in place.
• D. A multi_line rule controls how lines are grouped into a single log event and does not redact or remove sensitive substrings.

Correct answer: A — usr

• A. The usr namespace groups identity-related attributes for the user associated with a log entry, including id, name, and email.
• B. The network namespace covers connection details such as client IP and bytes transferred, not user identity fields.
• C. The http namespace covers request details such as method and URL path, not user identity fields.
• D. The error namespace covers exception details such as message, stack, and type, not user identity fields.

Correct answer: A — It groups processors together and applies them in sequence to logs that match its filter, standardizing them into a common format.

• A. A pipeline tests each incoming log against its filter, and for logs that match, runs the pipeline's processors sequentially so raw fields get parsed and standardized into a common structure.
• B. Cost and volume reporting is handled by usage and billing views, not by pipelines, which are concerned with parsing and attribute standardization rather than spend tracking.
• C. Enabling log collection on a host still requires Agent-side configuration such as `logs_enabled: true`; pipelines operate on logs after they arrive in Datadog, not on the Agent's collection settings.
• D. Daily indexing quotas are an index-level control that determines whether a log is indexed for search, a separate mechanism from pipelines, which parse and structure log content.

Correct answers: A, B, C — Date Remapper; Status Remapper; Message Remapper

• A. The Date Remapper directly designates a chosen attribute as the log's official date, one of the standard reserved attributes.
• B. The Status Remapper directly designates a chosen attribute as the log's official status, another standard reserved attribute.
• C. The Message Remapper directly designates a chosen attribute as the log's official message, also a standard reserved attribute.
• D. The Category Processor adds a new custom attribute based on search query matches; it does not assign a value to a standard reserved attribute.
• E. The Grok Parser extracts fields from unstructured text into new custom attributes, but assigning one of those extracted attributes as a standard attribute still requires a remapper processor.
• F. The URL Parser extracts components such as query parameters from a URL attribute into new custom attributes, not into one of the standard reserved attributes.

Correct answers: A, D — A remapper processor only changes a standard attribute if it finds the specified source attribute on that log; A log can pass through multiple pipelines, and a later remapper can overwrite a standard attribute an earlier one set

• A. A remapper processor looks for its configured source attribute on the log, and if that attribute is absent, the remapper has nothing to remap and the standard attribute is left unchanged by it.
• B. Integration pipelines also include their own remapping processors that set standard attributes automatically, so custom pipelines are not the only source of these assignments.
• C. Integration pipelines can already assign a status attribute through their built-in remappers, so a log does not need to pass through a custom pipeline to receive one.
• D. Because pipelines and their processors run sequentially, a remapper later in the sequence that targets the same standard attribute overwrites the value a prior remapper had set.
• E. Pipeline listed order determines execution sequence, so it directly affects which remapper runs last and therefore which value wins for a shared standard attribute.

Correct answer: A — It passes through Log Pipelines and is structured, processed, and enriched, the same as any indexed log

• A. Logs flowing through Live Tail are structured, processed, and enriched by Log Pipelines just like logs headed for the index, so what is displayed reflects post-processing content rather than raw input. This keeps the live view consistent with indexed data structure.
• B. Live Tail does not bypass pipeline processing; skipping parsing would mean the displayed fields would not match what appears in indexed search. Pipeline enrichment applies before display.
• C. Writing to an archive first would add latency incompatible with a near-real-time stream, and archiving is an independent, parallel process rather than a prerequisite for display. Live Tail does not depend on archive writes.
• D. Metric generation is a separate, optional processor applied to log data for specific configured queries; it does not replace or precede the display of the original log content. The raw structured log is what gets shown.

Correct answer: A — The log was excluded from the relevant index by an exclusion filter, so it never became searchable there

• A. The most common reason a log appears live but not in indexed search is that an exclusion filter kept it out of the index entirely, which matches Live Tail's ability to show both indexed and non-indexed logs. This directly explains the discrepancy described.
• B. There is no restriction preventing integration-pipeline logs from appearing in the live stream; pipelines apply the same processing regardless of source before display. Source type is not what causes this discrepancy.
• C. Key:value search queries do not require a facet to be declared beforehand, so a missing facet declaration would not cause a log to be unsearchable. Facet declaration is unrelated to whether a log reached the index.
• D. Live Tail is not restricted to already-expired logs; it shows logs as they are currently streaming in, which is the opposite of only showing expired ones. This does not describe real behavior.

Correct answer: A — @region:us-east-1

• @region:us-east-1. Custom attributes that are not part of Datadog's reserved set must be prefixed with @ so the search syntax parses them as attribute filters.
• region:us-east-1. Omitting the @ prefix works only for reserved attributes such as host, source, status, or service; a custom attribute like region needs the prefix to be matched correctly.
• #region:us-east-1. The # prefix denotes a calculated field derived from other attributes, not a raw custom attribute, so this syntax does not reference the region field.
• $region:us-east-1. A dollar sign is not part of Datadog's log search syntax for attributes, so this query would not resolve to the region field.

Correct answer: A — -@http.status_code:*

• -@http.status_code:*. Excluding the wildcard match for the attribute returns logs where that facet is absent, since the wildcard alone matches any log where the attribute exists.
• @http.status_code:null. Datadog does not treat the literal word null as a special existence marker, so this would search for an actual attribute value of null rather than absence.
• @http.status_code:"". Querying for an empty quoted string looks for a blank value rather than an attribute that was never indexed on the log.
• @http.status_code:missing. The word missing has no special meaning in Datadog's query syntax and would be interpreted as a literal value to match against the attribute.

Correct answer: A — An indexed tag or attribute that can be searched, filtered, and used for analytics in the Explorer

• A. Facets are indexed tags or attributes that power search, filtering, and analytics within the Explorer and other Datadog features like monitors and dashboards. This is exactly what a facet is.
• B. A stored Explorer layout with a query and column set describes a saved view, not a facet. Saved views reuse a page configuration; they do not index attribute values for analytics.
• C. This describes the opposite of a facet: a facet is created specifically so a tag or attribute becomes indexed and searchable. An unindexed field cannot yet be filtered this way.
• D. A timeseries graph is a display mode for queried log data over time, not an indexing structure. Facets exist independently of which visualization is chosen.

Correct answer: A — A measure aggregates numeric values such as duration or size and supports range filtering and sorting

• A. Measures aggregate numeric fields, such as long integers or doubles representing duration or size, and support unit-aware range filtering and sorting. This behavior is what separates a measure from a qualitative facet.
• B. Displaying a top list of unique string values with counts describes a qualitative facet's behavior, not a measure. Measures work with numeric ranges and slider bounds instead of value lists.
• C. Reserved attributes are not automatically converted into measures, and facets in general are created deliberately rather than forced. This claim misstates how facets and measures come into existence.
• D. Measures are used for analytics and filtering on indexed logs in the Explorer, not restricted to Live Tail. Live Tail is a separate, unsampled real-time stream unrelated to facet or measure availability.

Correct answer: A — @http.status_code:[400 TO 499]

• A. Bracket range syntax with `TO` is the documented way to search a numeric facet for an inclusive range, so this correctly matches status codes from 400 through 499.
• B. This comparison syntax is malformed for a single query term and also excludes the boundary value 400 by using a strict greater-than operator without repeating the attribute name.
• C. Parenthesized hyphen ranges are not valid Datadog log search syntax for numeric ranges.
• D. Double-dot range notation is not part of Datadog's log search syntax; ranges must use the bracket and `TO` format.

Correct answer: A — A visual breakdown of aggregated values within that pattern's logs, such as how many hosts, regions, or data centers are involved.

• A. The Pattern Inspector visually breaks down aggregated values inside a pattern's logs, helping an investigator see scope details like how many hosts, regions, or data centers are affected.
• B. The Pattern Inspector describes the current scope of a pattern's logs, it does not produce a forecast of future log volume for that pattern.
• C. Listing monitors tied to a message format is not a function of the Pattern Inspector; it focuses on breaking down the existing logs within the selected pattern.
• D. Comparing grok rule versions is unrelated to the Pattern Inspector, which is about exploring the aggregated content of a pattern's logs, not pipeline configuration history.

Correct answers: A, C, E — Count, unique count, and statistical operations such as min, max, average, and percentile can all be computed per group.; Percentile and average calculations operate on the numerical values present in the query results, computed separately for each group.; Unique count reports the number of distinct values found for the chosen field within each group.

• A. Fields aggregation supports count of logs, unique count, and statistical operations like min, max, average, and percentile, each computed separately for every group produced by the group-by.
• B. A dedicated sum-of-values measure is not part of the documented built-in set alongside count, unique count, and the min/max/avg/percentile operations.
• C. Percentile and average both work on numerical values within the query results, and each group gets its own independently computed value rather than a single dataset-wide number.
• D. Numeric attributes are exactly what statistical operations like min, max, average, and percentile are meant to be applied to; restricting measures to string attributes would make those operations meaningless.
• E. Unique count is specifically the measure that reports how many distinct values a chosen field has within each group, which is useful for things like counting unique sessions per customer.
• F. Average and percentile are computed per group when a group-by is applied, not just once across the whole result set; the group-by dimensions directly determine how many separate values are produced.

Correct answer: A — Up to three facets, ranked according to the values of the primary measure chosen for the query.

• A. A Nested Table shows top values from up to three facets, and the ranking within and across those facets is driven by the chosen primary measure.
• B. Ranking is driven by the primary measure's values, not by alphabetizing the facet name, so this describes the wrong sort behavior.
• C. Four facets exceeds the documented limit for Nested Tables, and ranking by recency does not match how this visualization orders rows.
• D. A single facet undercounts the documented limit, and ranking by a unique-value count across the whole window is not how this visualization orders results.

Correct answer: A — Build a Timeseries visualization grouped by service and split the graph by the service facet, showing up to three lines.

• A. Splitting a Timeseries by a facet produces separate lines per value, and up to three facet values can be split this way, matching the request for three services on one time-based chart.
• B. A ranked list shows a single point-in-time ordering of services rather than a trend line across the week.
• C. A percentage-of-whole chart shows relative share at a point in time rather than plotting a week-long trend for each service.
• D. A ranked table of top facet combinations does not plot a continuous trend line over the week for each service.

Correct answer: A — The absence of expected logs matching the query during the window

• A. A below-1 condition fires when zero logs match the query in the evaluation window, which is the standard way to detect that an expected log, such as a heartbeat, stopped arriving.
• B. The daily indexing quota is a separate index-level setting and is not what a log count threshold like below 1 measures.
• C. The number of active pipelines is a pipeline configuration detail, unrelated to a monitor's log count threshold.
• D. Standard attribute application happens during log processing and is not tracked by a monitor's threshold condition.

Correct answer: A — Every 10 seconds

• A. Log-based metrics are generated at a fixed 10-second granularity, matching the aggregation interval used to produce their data points.
• B. A 1-second granularity is finer than what log-based metrics actually use; the fixed interval for these metrics is 10 seconds, not 1 second.
• C. A 60-second granularity is coarser than the actual fixed interval used by log-based metrics, which generate data points every 10 seconds.
• D. A 5-minute granularity does not match the fixed interval Datadog uses for log-based metric data points, which is 10 seconds.

Correct answer: A — The metric is evaluated against the log stream at ingestion time, before any exclusion filter or index-level decision is applied

• A. Datadog evaluates a log-based metric's query against the log stream as logs are ingested, prior to index-level decisions like exclusion filters or daily quotas. This is why the resulting metric keeps reflecting the full ingested volume even when most of those logs never reach the index.
• B. Log-based metrics are not produced by periodically re-reading an archive; they are computed continuously from the live ingestion stream, not from a nightly batch process over archived data.
• C. Exclusion filters remove logs from being indexed, which means those logs also stop appearing in the Log Explorer, not just Live Tail; they remain visible in Live Tail and continue feeding metric generation regardless.
• D. Log-based metrics do not re-index excluded logs on any interval; they are computed once at ingestion time from the log stream, independent of the index entirely.

Correct answer: A — Archives store all ingested logs in customer-owned cloud storage for long-term retention outside index-based daily quotas

• A. Log Archives forward all ingested logs to a customer-owned S3, Azure Storage, or GCS bucket, giving organizations indefinite, cost-effective retention that is not tied to an index's daily quota or retention period. This is the core purpose of archiving in Datadog's log pipeline.
• B. Converting log events into custom metrics is the job of the Generate Metrics processor, not Log Archives. Archives store raw log events for long-term storage rather than deriving metrics from them.
• C. Exclusion filters are configured at the index level and determine which logs get indexed, not archived. Archiving happens independently of exclusion filters, so this describes indexing behavior rather than the benefit of archiving.
• D. Log Monitors evaluate log queries over indexed data in near real time; they are not triggered from archive files. Archives are a storage destination and play no role in monitor evaluation.

Correct answer: A — Exclusion filters do not apply to rehydrated historical views, so previously excluded logs can be restored

• A. Historical views created by rehydration are not subject to the source index's exclusion filters, which is precisely what allows logs that were previously excluded from indexing to be restored and searched.
• B. Exclusion filters are not re-applied during rehydration. If they were, the feature would be unable to recover logs that were originally excluded, which contradicts its core purpose.
• C. Rehydration query filters are defined independently by the user creating the historical view; they are not auto-generated from the index's exclusion filter configuration.
• D. Exclusion filters on an index have no effect on whether a rehydration job can run; rehydration operates against the archive, not the live index configuration.

Correct answer: A — In a `conf.yaml` file under `conf.d/<integration>.d/`, inside a `logs:` section listing `type`, `path`, `service`, and `source`.

• A. This is correct. Per-integration log configuration lives in that integration's own `conf.yaml` under `conf.d/<integration>.d/`, with a `logs:` section defining the input type, file path, service, and source tags.
• B. This is incorrect. `datadog.yaml` holds global Agent settings like `logs_enabled` and the API key, not the per-integration list of log inputs, which live in their own `conf.d` subdirectories.
• C. This is incorrect. The Agent does not use a JSON file at its installation root for log configuration; log inputs are declared in YAML within each integration's own configuration directory.
• D. This is incorrect. Log inputs are declared declaratively in YAML files, not through environment variables named per integration, so this mechanism does not exist for standard log collection setup.

Correct answer: A — Generate a flare and share it with Datadog support so they can inspect the bundled configuration, logs, and diagnostics for a deeper cause.

• A. This is correct. Once the common local causes have been ruled out and `agent status` reports no errors, generating a flare and involving Datadog support is the appropriate next step, since it packages deeper diagnostic data that is not visible from the standard checks already performed.
• B. This is incorrect. A clean `agent status` output indicates the configuration parsed and loaded correctly, so there is no evidence of file corruption that would justify rebuilding the folder structure from scratch.
• C. This is incorrect. If the quota had been reached, the logs would still appear in Live Tail rather than being entirely invisible, and `agent status` would not report the source as healthy in that scenario.
• D. This is incorrect. Exclusion filters remove already-ingested logs from indexing; adding one would make logs less visible, not restore an already-missing source, and it does not address a case where nothing has reached Datadog at all.

Correct answer: A — The log is excluded only once, based on the first active exclusion filter it matches

• A. Exclusion filters are evaluated in order, and once a log matches the first active filter, it is excluded based on that match alone; it is not re-evaluated against subsequent filters.
• B. There is no cumulative or multiplied exclusion effect from matching several filters; a log that matches more than one filter is still excluded only once.
• C. Filters do not cancel each other out; the first matching active filter determines the outcome, so the log is excluded rather than indexed by default.
• D. There is no quarantine index for logs matching multiple filters; the log is simply excluded from the index based on the first filter it matches.

Correct answer: A — The Agent only collects logs written after it begins tailing the file, so pre-existing lines are not retroactively collected

• A. The Agent tails log files going forward from the moment it starts watching them, so lines already written to the file before collection began are not picked up retroactively, regardless of how recent they are.
• B. A quota affects logs that have already been ingested and would show in Live Tail even if excluded from the index; since these lines were never collected by the Agent at all, quota exhaustion does not explain their absence.
• C. The lines are described as being from the past few hours, well within the 18-hour window, so timestamp age at intake is not the cause; the issue is that the lines were never collected by the Agent in the first place.
• D. Rehydration applies to logs that were previously ingested and sent to a long-term archive; these lines were never ingested at all, so there is nothing in an archive to rehydrate.