Top-level Datadog configuration: API keys, service identity, Agent connection, intake site, hostname, global tags, and proxy settings.

DD_AGENT_HOST

Type: string
Default: localhost
Aliases:DD_TRACE_AGENT_HOSTNAME
The host name to use to connect the Datadog agent for traces. The host name can be IPv4, IPv6, or a domain name. If DD_TRACE_AGENT_URL is specified, the value of DD_AGENT_HOST is ignored.

DD_API_KEY

Type: string
Since: v2.6.0
Aliases:DD-API-KEY
Sets the API key used to authenticate outbound requests when running in agentless mode (sending data directly instead of via a local agent). This key is required for agentless CI test reporting and LLM Observability agentless mode.

DD_APM_TRACING_ENABLED

Type: boolean
Default: true
Aliases:DD_TRACING_ENABLED
Enables or disables sending APM trace data. When disabled, tracing still runs to support other products, but only periodic heartbeat traces and manually kept traces are sent.

DD_ENV

Type: string
Sets the global env tag applied to all telemetry emitted by the tracer (traces, metrics, logs, profiles). Use it to separate environments such as prod, staging, or dev.

DD_EXTERNAL_ENV

Type: string
Sets an external environment identifier attached to emitted telemetry for origin and environment attribution.

DD_HOSTNAME

Type: string
Overrides the hostname used for tagging and telemetry when hostname auto-detection is unreliable. The value must be a valid hostname; invalid values are ignored and hostname auto-detection is used instead.

DD_SERVICE

Type: string
Since: v2.6.0
Sets the service name used for telemetry and generated spans. If unset, the service name defaults to the process name.

DD_SERVICE_MAPPING

Type: map
Since: v2.6.0
Define service name mappings to allow renaming services in traces, for example: postgres:postgresql,defaultdb:postgresql. Available in version 0.47+.

DD_SITE

Type: string
Default: datadoghq.com
Since: v2.6.0
Sets the site domain used to build agentless intake URLs. If unset, a default site is used.

DD_TAGS

Type: map
Custom tags applied to traces, profiles, and metrics, provided as comma-separated key:value pairs (for example, layer:api,team:intake).

DD_VERSION

Type: string

Sets the application’s version, used as the version tag in traces and logs (for example: 1.2.3, 6c44da20, 2020.02.13).

Language-specific notes:

• PHP: starting with version 0.90.0, changes made at runtime through ini_set('datadog.version', ...) are also applied to the current root span.

Core distributed tracing engine: Agent connection, trace and span ID generation, span lifecycle management, peer service mapping, resource normalization, query string obfuscation, and DB client configuration.

DD_TRACE__ANALYTICS_ENABLED

Type: boolean
Default: false
Enables trace analytics for integrations that use the default (unprefixed) analytics toggle by setting the analytics sample rate to 1.0.

DD_TRACE_128_BIT_TRACEID_GENERATION_ENABLED

Type: boolean
Default: true
Controls whether the tracer generates 128-bit W3C trace IDs (32-character hex) or 64-bit Datadog trace IDs (16-character hex). 128-bit IDs are required for full W3C traceparent interoperability.

DD_TRACE_128_BIT_TRACEID_LOGGING_ENABLED

Type: boolean
Default: true
Controls whether 128-bit trace IDs are logged in their full 32-character format or truncated to 16 characters. Set to false for compatibility with systems that expect the shorter format.

DD_TRACE_ABANDONED_SPAN_TIMEOUT

Type: string
Default: 10m
Sets the duration after which an unfinished span is considered abandoned for debugging. Defaults to 10m.

DD_TRACE_AGENT_PORT

Type: int
Default: 8126
The port of the Trace Agent that the tracer submits to. If the Agent configuration sets receiver_port or DD_APM_RECEIVER_PORT to something other than the default 8126, then DD_TRACE_AGENT_PORT or DD_TRACE_AGENT_URL must match it.

DD_TRACE_AGENT_PROTOCOL_VERSION

Type: string
Default: 1.0
Since: v2.7.0
Protocol version to use for requests to the Agent. The version configured must be supported by the Agent version installed or all traces are dropped.

DD_TRACE_AGENT_URL

Type: string
Default: http://localhost:8126
Since: v2.6.0
The URL for connecting the tracer to the Datadog agent. Valid URL schemas include http:// and unix:// (UNIX Domain Sockets). This value takes precedence over DD_AGENT_HOST and DD_TRACE_AGENT_PORT if set.

DD_TRACE_ANALYTICS_ENABLED

Type: boolean
Default: false
Since: v2.6.0
Enables the legacy Trace Analytics feature for all integrations by setting the analytics.sample_rate metric on spans using each integration’s configured analytics sample rate. Superseded by App Analytics in newer Datadog deployments.

DD_TRACE_CLIENT_IP_ENABLED

Type: boolean
Default: false
Enables or disables the automatic collection of client IP addresses from HTTP request headers. When enabled, the IP address is stored in the http.client_ip span tag.

DD_TRACE_CLIENT_IP_HEADER

Type: string
Configures a custom header name from which to source the http.client_ip tag value. If this variable is set, all other IP-related headers are ignored (for example, setting DD_TRACE_CLIENT_IP_HEADER=custom-ip-header and including the header custom-ip-header: 5.6.7.9 in a request results in a span tagged with “http.client_ip”: “5.6.7.9”). If an empty string or null value is passed, IP headers are queried in this order: - x-forwarded-for - x-real-ip - true-client-ip - x-client-ip - x-forwarded - forwarded-for - x-cluster-client-ip - fastly-client-ip - cf-connecting-ip - cf-connecting-ipv6

DD_TRACE_ENABLED

Type: boolean
Default: true
Aliases:DD_TRACING_ENABLED
Enable framework and library instrumentation. When false, the application code doesn’t generate any traces. See also DD_APM_TRACING_ENABLED.

DD_TRACE_FEATURES

Type: array
Comma- or space-separated list of tracer feature flags. Use this to enable optional or experimental behavior such as “discovery”.

DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP

Type: string
Default: (?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}
Since: v2.6.0
Applies a regex to redact sensitive data from query strings on incoming HTTP requests. The default regex matches various sensitive data patterns, including passwords, tokens, API keys, private keys, and authorization terms. Matches are replaced with . If an empty string is passed, no obfuscation occurs. The resulting value is reported in the http.url tag.

DD_TRACE_PARTIAL_FLUSH_ENABLED

Type: boolean
Default: false
Enables incrementally flushing large traces to the Datadog Agent, reducing the chance of rejection by the Agent. Use only when you have long-lived traces or traces with many spans.

DD_TRACE_PARTIAL_FLUSH_MIN_SPANS

Type: int
Default: 1000
Since: v2.6.0
Minimum number of finished spans accumulated in a trace before a partial flush is triggered. Invalid values are ignored.

DD_TRACE_PEER_SERVICE_DEFAULTS_ENABLED

Type: boolean
Default: false
When enabled, the tracer computes default peer.service values for eligible spans using the v1 peer-service default algorithm under Naming Schema v0. When disabled, Naming Schema v0 leaves peer.service unset.

DD_TRACE_PEER_SERVICE_MAPPING

Type: map
Maps detected peer service names to normalized values before they are attached to spans.

DD_TRACE_REMOVE_INTEGRATION_SERVICE_NAMES_ENABLED

Type: boolean
Default: false
When enabled, integrations under Naming Schema v0 stop using inferred service names and fall back to the application service name. Use this to make all spans report under DD_SERVICE regardless of integration.

DD_TRACE_REPORT_HOSTNAME

Type: boolean
Default: false
Whether to report the system’s hostname for each trace. When disabled, the hostname of the Agent is used instead.

DD_TRACE_RESOURCE_RENAMING_ALWAYS_SIMPLIFIED_ENDPOINT

Type: boolean
Default: false
Since: v2.4.0
When enabled, always sets the http.endpoint tag to the result of the Resource Renaming simplification algorithm, even when an explicit endpoint is available.

DD_TRACE_RESOURCE_RENAMING_ENABLED

Type: boolean
Default: false
Since: v2.4.0
Controls whether the http.endpoint tag is computed and added for incoming HTTP requests. This is disabled by default unless application security is enabled at startup, and can be explicitly enabled or disabled with this setting.

DD_TRACE_RETRY_INTERVAL

Type: string
Default: 1ms
Since: v2.6.0
Sets the interval for retrying submitting payloads to the agent

DD_TRACE_SOURCE_HOSTNAME

Type: string
Sets the hostname reported with tracing data. When set, hostname reporting is enabled and uses this value instead of auto-detection.

DD_TRACE_SPAN_ATTRIBUTE_SCHEMA

Type: string
Default: v0
Since: v2.6.0
Selects the span attribute and naming schema version used by integrations. Accepted values: v0, v1.

DD_TRACE_STATS_COMPUTATION_ENABLED

Type: boolean
Default: true
Since: v2.6.0
Aliases:DD_TRACE_TRACER_METRICS_ENABLED
Controls whether client-side trace statistics computation is enabled. When enabled, the tracer pre-aggregates span stats for ingestion.

DD_TRACE_X_DATADOG_TAGS_MAX_LENGTH

Type: int
Default: 512
Maximum length of the x-datadog-tags header for trace tag propagation. Set to 0 to disable.

Sampling rules and rates that determine which traces and spans are kept or dropped, including per-service rules, rate limiting, and priority sampling.

DD_SPAN_SAMPLING_RULES

Type: array
Default: []
Span sampling rules to keep individual spans when the rest of the trace would otherwise be dropped. A JSON array of objects. Rules are applied in configured order to determine the span’s sample rate. The sample_rate value must be between 0.0 and 1.0 (inclusive). For more information, see Ingestion Mechanisms. Example: - Set the span sample rate to 50% for the service my-service and operation name http.request, up to 50 traces per second: [{"service": "my-service", "name": "http.request", "sample_rate":0.5, "max_per_second": 50}].

DD_SPAN_SAMPLING_RULES_FILE

Type: string
Points to a JSON file that contains the span sampling rules. DD_SPAN_SAMPLING_RULES takes precedence over this variable. See DD_SPAN_SAMPLING_RULES for the rule format.

DD_TRACE_RATE_LIMIT

Type: int
Default: 100
Sets the maximum number of traces to sample per second; applies only when either DD_TRACE_SAMPLING_RULES or DD_TRACE_SAMPLE_RATE is set.

DD_TRACE_SAMPLE_RATE

Type: decimal
Default: 1
Since: v2.6.0
Controls the ingestion sample rate (between 0.0 and 1.0) between the Agent and the backend.

DD_TRACE_SAMPLING_RULES

Type: string
Since: v2.6.0
JSON array of sampling rules. The rule is matched in order of specification. The first match in a list is used. Per entry: The item “sample_rate” is required in decimal format. The item “service” is optional in regular expression format, to match on service name. The item “name” is optional in regular expression format, to match on operation name. To give a rate of 50% to any traces in a service starting with the text “cart”: ‘[{“sample_rate”:0.5, “service”:“cart.”}]’ To give a rate of 20% to any traces which have an operation name of “http.request”: ‘[{“sample_rate”:0.2, “name”:“http.request”}]’ To give a rate of 100% to any traces within a service named “background” and with an operation name of “sql.query”: ‘[{“sample_rate”:1.0, “service”:“background”, “name”:“sql.query”}] To give a rate of 10% to all traces ‘[{“sample_rate”:0.1}]’ To configure multiple rules, separate by semi-colon and order from most specific to least specific: ‘[{“sample_rate”:0.5, “service”:“cart.”}, {“sample_rate”:0.2, “name”:“http.request”}, {“sample_rate”:1.0, “service”:“background”, “name”:“sql.query”}, {“sample_rate”:0.1}]’ If no rules are specified, or none match, default internal sampling logic will be used.

DD_TRACE_SAMPLING_RULES_FILE

Type: string
Path to a file containing a JSON array of trace sampling rules. This is used when DD_TRACE_SAMPLING_RULES is not set.

Distributed trace context propagation, extraction and injection behavior, baggage handling, header tagging, HTTP client and server configuration, and SQL comment injection for Database Monitoring.

DD_EXPERIMENTAL_PROPAGATE_PROCESS_TAGS_ENABLED

Type: boolean
Default: true
Since: v2.6.0
Controls whether process-level tags (such as entrypoint metadata) are collected and attached to tracing payloads.

DD_TRACE_HEADER_TAGS

Type: array
Comma-separated list of HTTP headers to apply automatically as span tags. Each entry can be either a bare header name (which is reported under http.request.headers.<header> for incoming requests and http.response.headers.<header> for outgoing responses) or <header>:<custom_tag_name> to control the tag key.

DD_TRACE_HTTP_CLIENT_ERROR_STATUSES

Type: string
Default: 400-499
Aliases:DD_HTTP_CLIENT_ERROR_STATUSES
Comma-separated list of HTTP status codes and ranges to treat as errors for HTTP client spans (for example, 400-499,500). When set, matching responses mark the span as an error.

DD_TRACE_HTTP_CLIENT_TAG_QUERY_STRING

Type: boolean
Default: true
Aliases:DD_HTTP_CLIENT_TAG_QUERY_STRING
By default, query string parameters and fragments are added to the http.url tag on web client spans. Set to false to prevent the collection of this data.

DD_TRACE_HTTP_SERVER_ERROR_STATUSES

Type: string
Default: 500-599
Since: v2.6.0
Comma-separated list of HTTP status codes and ranges to treat as errors for HTTP server spans (for example, 500-599,404). When unset, 5xx responses are treated as errors by default.

DD_TRACE_HTTP_URL_QUERY_STRING_DISABLED

Type: boolean
Default: false
Disables including URL query strings in the http.url tag for incoming HTTP requests. When disabled, only the path is reported.

DD_TRACE_INFERRED_PROXY_SERVICES_ENABLED

Type: boolean
Default: false
Aliases:DD_TRACE_INFERRED_SPANS_ENABLED
When enabled, the tracer registers the inferred-proxy propagator, which reads x-dd-proxy* headers (currently x-dd-proxy=aws-apigateway) and starts an inferred proxy span as the parent of the server span, using header values for service, resource, and tags.

DD_TRACE_PROPAGATION_EXTRACT_FIRST

Type: boolean
Default: false
When set to true, stops extracting after the first successful trace context extraction.

DD_TRACE_PROPAGATION_STYLE

Type: array
Default: datadog,tracecontext,baggage
Since: v2.6.0
Aliases:OTEL_PROPAGATORS
A comma-separated list of header formats from which to attempt to inject and extract distributed tracing propagation data. The first format found with complete and valid headers is used to define the trace to continue. The more specific DD_TRACE_PROPAGATION_STYLE_INJECT and DD_TRACE_PROPAGATION_STYLE_EXTRACT configurations take priority when present.

DD_TRACE_PROPAGATION_STYLE_EXTRACT

Type: array
Default: datadog, tracecontext, baggage
Since: v2.6.0
Aliases:DD_TRACE_PROPAGATION_STYLE
A comma-separated list of header formats from which to attempt to extract distributed tracing propagation data. The first format found with complete and valid headers is used to define the trace to continue.

DD_TRACE_PROPAGATION_STYLE_INJECT

Type: array
Default: datadog, tracecontext, baggage
Since: v2.6.0
Aliases:DD_TRACE_PROPAGATION_STYLE
Comma-separated list of header formats to include to propagate distributed traces between services.

DD_TRACE_SQL_COMMENT_INJECTION_MODE

Type: string
Controls SQL comment injection used for database monitoring correlation. Supported values are disabled, service, and full.

Per-integration tracing configuration: enable/disable, analytics, service name, peer service overrides for library integrations and controls for disabling specific instrumentations.

Configuration Kinds

Each integration can support one or more of these configuration patterns. Replace <INTEGRATION> with the integration name (for example, GRPC, AWS, REDIS).

Per-Integration Settings (32 integrations)

Each section lists all configuration keys available for a specific integration.

Database Monitoring (DBM): SQL comment propagation modes and query identifier hashing for correlating database performance with application traces.

DD_DBM_PROPAGATION_MODE

Type: string
Default: disabled
Enables linking between data sent from APM and the Database Monitoring product when set to service or full. The service option enables the connection between DBM and APM services. The full option enables connection between database spans with database query events. Available for Postgres and MySQL.

Tracer log output settings: log levels, log file paths, log rotation, and startup diagnostics.

DD_LOGGING_RATE

Type: int
Default: 60
Sets how often aggregated internal errors are flushed to logs, in seconds. Set to 0 to log errors immediately.

DD_TRACE_DEBUG

Type: boolean
Default: false
Since: v2.6.0
Aliases:OTEL_LOG_LEVEL

Enables debug mode for the SDK. When set, the SDK emits verbose log messages for troubleshooting. Takes precedence over DD_TRACE_LOG_LEVEL when active. Use OTEL_LOG_LEVEL as an alias.

Language-specific notes:

• PHP: log messages are written to the device or file set in the PHP error_log INI setting. The actual value may differ from php -i output because it can be overridden in PHP-FPM/Apache configuration files.

DD_TRACE_DEBUG_ABANDONED_SPANS

Type: boolean
Default: false
The Datadog Go Tracer also supports logging for potentially abandoned spans. To enable this debug mode in Go, set the environment variable DD_TRACE_DEBUG_ABANDONED_SPANS=true. To change the duration after which spans are considered abandoned (default=10m), set the environment variable DD_TRACE_ABANDONED_SPAN_TIMEOUT to the desired time duration. Abandoned span logs appear at the Info level.

DD_TRACE_DEBUG_SEELOG_WORKAROUND

Type: boolean
Default: true
Controls whether a workaround for seelog-related goroutine leaks is applied. Set to false to disable the workaround.

DD_TRACE_DEBUG_STACK

Type: boolean
Default: true
Since: v2.6.0
Controls whether stack traces are captured for spans that finish with an error.

DD_TRACE_LOG_DIRECTORY

Type: string
Sets a directory where tracer logs are written. The directory must exist; otherwise logs remain on stderr.

DD_TRACE_STARTUP_LOGS

Type: boolean
Default: true
Since: v2.6.0
Enables emission of startup configuration and diagnostic log lines when the tracer initializes.

Continuous Profiler configuration: enable/disable, upload settings, profiling types, engine options, code hotspots, endpoint profiling, and experimental features.

DD_PROFILING_AGENTLESS

Type: boolean
Default: false
Enables agentless profile upload, sending profiles directly to the Datadog backend instead of through a Datadog Agent.

DD_PROFILING_CODE_HOTSPOTS_COLLECTION_ENABLED

Type: boolean
Default: true
Controls whether spans add pprof labels (span ID and local-root span ID) used to link profiles to specific trace code hotspots in the Datadog UI.

DD_PROFILING_DEBUG_COMPRESSION_SETTINGS

Type: string
Default: zstd
Compression algorithm and level used when preparing profiles for upload. Accepted values include legacy, gzip, and zstd-<level> (for example, zstd-3).

DD_PROFILING_DELTA

Type: boolean
Default: true
Controls whether delta profiles are enabled. When enabled, profile values are reported as changes since the previous profile instead of absolute values.

DD_PROFILING_ENABLED

Type: string
Default: true
Since: v2.6.0
Enables the continuous profiler, which collects CPU, heap, goroutine, and other runtime profiles and uploads them to Datadog.

DD_PROFILING_ENDPOINT_COLLECTION_ENABLED

Type: boolean
Default: true
Aliases:DD_PROFILING_EXPERIMENTAL_ENDPOINT_COLLECTION_ENABLED
Controls whether spans add a pprof label with the top-level request endpoint so profiles can be grouped by endpoint in the Datadog UI.

DD_PROFILING_ENDPOINT_COUNT_ENABLED

Type: boolean
Default: false
Enables counting endpoint hits while the profiler is running and includes those counts with uploaded profiles.

DD_PROFILING_EXECUTION_TRACE_ENABLED

Type: boolean
Default: true
Controls whether runtime execution traces are collected and uploaded. Defaults to enabled on amd64 and arm64.

DD_PROFILING_EXECUTION_TRACE_LIMIT_BYTES

Type: int
Default: 5242880
Sets the approximate maximum size, in bytes, of a collected execution trace. Defaults to 5MB.

DD_PROFILING_EXECUTION_TRACE_PERIOD

Type: string
Default: 15m
Sets the time between execution trace collections. Defaults to 15m.

DD_PROFILING_FLUSH_ON_EXIT

Type: boolean
Default: false
Controls whether the profiler attempts to finish uploading buffered profiles when the process is stopping. When disabled, pending uploads are cancelled on shutdown.

DD_PROFILING_OUTPUT_DIR

Type: string
Writes a copy of collected profiles to the specified directory for debugging. No cleanup is performed, so the directory can grow over time.

DD_PROFILING_UPLOAD_TIMEOUT

Type: string
Default: 10s
Since: v2.6.0
Sets the timeout for profile upload HTTP requests. Defaults to 10s and must be greater than 0.

DD_PROFILING_URL

Type: string
Default: https://intake.profile.datadoghq.com/v1/input
Since: v2.6.0
Overrides the profiling intake URL used for agentless uploads. This is primarily intended for testing or debugging.

DD_PROFILING_WAIT_PROFILE

Type: boolean
Default: false
Enables an experimental goroutine wait profile when set. This collects stack traces and wait durations for goroutines that remain blocked for more than a minute.

DD_PROFILING_WAIT_PROFILE_MAX_GOROUTINES

Type: int
Default: 1000
Sets the maximum number of goroutines allowed when collecting the goroutine wait profile. If the process exceeds this limit, the wait profile is skipped.

Application Security configuration: ASM threat detection and blocking, user event tracking, IAST vulnerability detection, API Security schema discovery, and error tracking.

DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE

Type: decimal
Default: 0.5
Since: v2.7.0
Defines the probability of a downstream request body being sampled, or said differently, defines the overall number of requests for which the request and response body should be sampled / analysed.

DD_API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE

Type: decimal
Default: 0.5
Since: v2.6.0
Defines the probability of a downstream request body being sampled, or said differently, defines the overall number of requests for which the request and response body should be sampled / analysed.

DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED

Type: boolean
Default: true
Since: v2.6.0
Controls whether API endpoint definitions are collected and reported for use in API Catalog. Disable to suppress endpoint discovery.

DD_API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT

Type: int
Default: 300
Since: v2.6.0
Sets the maximum number of API endpoints included in a single endpoint-collection telemetry message. If unset, a default limit is used.

DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS

Type: int
Default: 1
Since: v2.4.0
The maximum number of downstream requests per request for which the request and response body should be analysed.

DD_APPSEC_BODY_PARSING_SIZE_LIMIT

Type: int
Default: 10485760
Since: v2.6.0
Sets the maximum number of bytes of HTTP request and response bodies to buffer and analyze for security features when running behind a proxy/external processing integration. Values of 0 or less disable body analysis, and bodies larger than the limit are truncated.

DD_APPSEC_ENABLED

Type: boolean
Default: false
Enables or disables the AppSec product inside the tracer. When enabled, the tracer initializes the AppSec module (in-app WAF, header/body collection, and AppSec telemetry).

DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML

Type: string
Since: v2.6.0
Path to a local HTML template file that will be returned when a request is blocked and the response should be HTML. If unset or invalid, the tracer uses the default blocking HTML template defined by the product RFC. The tracer decides HTML or JSON according to Accept header or the block action’s parameters.

DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON

Type: string
Since: v2.6.0
Path to a local JSON template file returned when a request is blocked and the response should be JSON. If unset or invalid, the tracer uses the default blocking JSON template defined by the product RFC. The tracer chooses HTML or JSON based on the Accept header or the block action’s parameters.

DD_APPSEC_MAX_STACK_TRACE_DEPTH

Type: int
Default: 32
Aliases:DD_APPSEC_MAX_STACKTRACE_DEPTH
Maximum number of stack frames retained for any stack trace attached to an AppSec event. When the limit is reached, deeper frames are truncated and the top-of-stack frames are preserved. Lower the value to reduce event payload size.

DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP

Type: string
Default: (?i)pass|pw(?:or)?d|secret|(?:api|private|public|access)[_-]?key|token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\.net[_-]sessionid|sid|jwt
Since: v2.6.0
Regular expression used by the AppSec obfuscator to identify parameter keys whose entire value must be redacted. When a key path matches, the parameter is replaced with <redacted by datadog>. The default matches common credential names (password, token, authorization, jwt, etc.). Set to an empty string to disable key-based redaction.

DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP

Type: string
Default: (?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key(?:[_-]?id)?|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?|jsessionid|phpsessid|asp\\.net(?:[_-]|-)sessionid|sid|jwt)(?:\\s*=([^;&]+)|\"\\s*:\\s*(\"[^\"]+\"|\\d+))|bearer\\s+([a-z0-9\\._\\-]+)|token\\s*:\\s*([a-z0-9]{13})|gh[opsu]_([0-9a-zA-Z]{36})|ey[I-L][\\w=-]+\\.(ey[I-L][\\w=-]+(?:\\.[\\w.+\\/-=]+)?)|[\\-]{5}BEGIN[a-z\\s]+PRIVATE\\sKEY[\\-]{5}([^\\-]+)[\\-]{5}END[a-z\\s]+PRIVATE\\sKEY|ssh-rsa\\s*([a-z0-9\\/\\.+]{100,})
Since: v2.6.0
Regular expression used to find and redact sensitive substrings inside parameter values and highlights. Matches are replaced with <redacted by datadog>. Runs after the key regexp, which takes precedence. The default pattern targets tokens, JWTs, private key blocks, and other credential shapes. Set to an empty string to disable value-based redaction.

DD_APPSEC_RULES

Type: string
Since: v2.6.0
Path to a JSON rules file that overrides the default AppSec rules shipped with the tracer.

DD_APPSEC_SCA_ENABLED

Type: boolean
Default: false
Since: v2.6.0
Enables the tracer’s runtime Software Composition Analysis (SCA), which reports runtime dependency/SBOM data and powers runtime vulnerability detection. SCA may have billing implications and language-compatibility constraints described in the SCA documentation.

DD_APPSEC_STACK_TRACE_ENABLED

Type: boolean
Default: true
Since: v2.6.0
Aliases:DD_APPSEC_STACK_TRACE_ENABLE
Enables generation of stack traces attached to AppSec security events. Disable to omit stack traces from event payloads.

DD_APPSEC_WAF_TIMEOUT

Type: string
Default: 2ms
Since: v2.6.0
Maximum synchronous execution time for a single WAF evaluation, expressed as a Go duration (for example, 2ms, 500us). Requests that exceed this budget skip WAF checks. Raise the value if you see frequent WAF timeouts; lower it to bound request-path overhead.

Remote debugging capabilities: Dynamic Instrumentation for live probes, Exception Replay for automatic variable capture, Symbol Database for source-level debugging, and Code Origin for Spans for linking spans back to source code.

DD_DYNAMIC_INSTRUMENTATION_ENABLED

Type: boolean
Default: false
Enables Dynamic Instrumentation, allowing log probes and metric probes to be added to running services from the Datadog UI without redeploying.

CI Visibility and Test Optimization: test reporting, code coverage collection, git metadata, flaky test management, test skipping, and CI provider integration.

DD_ACTION_EXECUTION_ID

Type: string
Sets the action execution ID reported as CI metadata for AWS CodePipeline builds. This value is used as the CI job identifier when running a CodeBuild job initiated by CodePipeline.

DD_CIVISIBILITY_AGENTLESS_ENABLED

Type: boolean
Default: false
Enables agentless mode for CI Visibility, sending test data directly to the Datadog intake instead of through a local Agent.

DD_CIVISIBILITY_AGENTLESS_URL

Type: string
Overrides the intake base URL used for agentless CI test reporting. When set, payloads are sent to this URL instead of the default site-based intake URL.

DD_CIVISIBILITY_AUTO_INSTRUMENTATION_PROVIDER

Type: string
Marks CI test sessions as running under an auto-instrumentation workflow. Any non-empty value enables this marker for telemetry.

DD_CIVISIBILITY_ENABLED

Type: boolean
Default: false
Enables CI Visibility instrumentation for test executions, reporting test sessions, modules, suites, and individual test results to Datadog.

DD_CIVISIBILITY_FLAKY_RETRY_COUNT

Type: int
Default: 5
Can be set to any non-negative number to change the maximum number of retries per test case.

DD_CIVISIBILITY_FLAKY_RETRY_ENABLED

Type: boolean
Default: true
Kill switch for the CI Visibility automatic test retries feature. When false, failing tests are not automatically re-run, even if remote settings would enable retries.

DD_CIVISIBILITY_IMPACTED_TESTS_DETECTION_ENABLED

Type: boolean
Default: true
Enables CI Visibility impacted tests detection (TIA). When enabled, impacted-tests detection is requested/applied as part of execution settings propagated to child processes.

DD_CIVISIBILITY_LOGS_ENABLED

Type: boolean
Default: false
Enables direct submission of CI test logs to the Datadog Logs intake.

DD_CIVISIBILITY_SUBTEST_FEATURES_ENABLED

Type: boolean
Default: true
Since: v2.5.0
Kill-switch for subtest-specific CI test management and retry features. Set to false to disable subtest features even if they are enabled by remote settings.

DD_CIVISIBILITY_TOTAL_FLAKY_RETRY_COUNT

Type: int
Default: 1000
Maximum total number of automatic test retries allowed across the entire CI test session, applied when automatic flaky-test retries are enabled.

DD_CIVISIBILITY_USE_NOOP_TRACER

Type: boolean
Default: false
Since: v2.5.0
When set in CI test reporting mode, replaces the tracer with a no-op implementation to minimize any change to test behavior.

DD_CUSTOM_TRACE_ID

Type: string
Custom trace ID propagated by the Jenkins Datadog Plugin, used to correlate Jenkins pipeline executions with traces emitted by the application under test.

DD_GIT_BRANCH

Type: string
Overrides the Git branch value used by CI Visibility for repository and commit correlation.

DD_GIT_COMMIT_AUTHOR_DATE

Type: string
Overrides the commit-author date, in ISO 8601 format, reported as CI metadata.

DD_GIT_COMMIT_AUTHOR_EMAIL

Type: string
Overrides the git commit author email reported as CI metadata.

DD_GIT_COMMIT_AUTHOR_NAME

Type: string
Overrides the git commit author name reported as CI metadata.

DD_GIT_COMMIT_COMMITTER_DATE

Type: string
Overrides the commit-committer date, in ISO 8601 format, reported as CI metadata.

DD_GIT_COMMIT_COMMITTER_EMAIL

Type: string
Overrides the git commit committer email reported as CI metadata.

DD_GIT_COMMIT_COMMITTER_NAME

Type: string
Overrides the git commit committer name reported as CI metadata.

DD_GIT_COMMIT_MESSAGE

Type: string
Overrides the git commit message reported as CI metadata.

DD_GIT_COMMIT_SHA

Type: string
Overrides the git commit SHA reported as CI metadata and used for git metadata tagging when enabled.

DD_GIT_REPOSITORY_URL

Type: string
Overrides the git repository URL reported as CI metadata and used for git metadata tagging when enabled. Any embedded credentials in the URL are stripped before use.

DD_GIT_TAG

Type: string
Overrides the Git tag used by CI Visibility for repository and release correlation.

DD_PIPELINE_EXECUTION_ID

Type: string
Sets the pipeline execution ID reported as CI metadata for AWS CodePipeline builds. This value is used as the CI pipeline identifier when running a CodeBuild job initiated by CodePipeline.

DD_TEST_MANAGEMENT_ATTEMPT_TO_FIX_RETRIES

Type: int
Default: -1
Since: v2.6.0
Overrides the maximum number of retries for the test management attempt-to-fix feature. When set, it replaces the value provided by remote settings.

DD_TEST_MANAGEMENT_ENABLED

Type: boolean
Default: true
Local kill switch for CI Visibility Test Management features (disabled, quarantined, and attempt-to-fix tests). Set to false to disable Test Management even when remote settings would enable it.

DD_TEST_OPTIMIZATION_ENV_DATA_FILE

Type: string
Sets the path to a JSON file containing CI/environment metadata used for test reporting. If not set, a default file next to the test binary is used.

DD_TEST_SESSION_NAME

Type: string
Overrides the auto-generated test session name reported to CI Visibility. When unset, the tracer builds a name from the detected CI provider, repository, and branch information.

DD_TRACE_GIT_METADATA_ENABLED

Type: boolean
Default: true
When enabled, the tracer attaches Git repository URL and commit SHA tags to root spans, allowing traces to be linked back to the corresponding source code in the Datadog UI.

Direct log submission to Datadog, agentless log forwarding, log injection for trace-log correlation, and OpenTelemetry log export.

DD_LOGS_OTEL_ENABLED

Type: boolean
Default: false
Since: v2.7.0
Enables collection and export of logs produced via the OpenTelemetry Logs API.

Runtime metrics collection and DogStatsD connection configuration for metric submission.

DD_DOGSTATSD_HOST

Type: string
Default: localhost
Aliases:DD_DOGSTATSD_HOSTNAME
Override the address of the trace Agent host that the default tracer attempts to submit DogStatsD metrics to. Use DD_AGENT_HOST to override DD_DOGSTATSD_HOST.

DD_DOGSTATSD_PORT

Type: int
Default: 8125
The port of the DogStatsD Agent that metrics are submitted to. If the Agent configuration sets dogstatsd_port or DD_DOGSTATSD_PORT to something other than the default 8125, then this tracing library DD_DOGSTATSD_PORT must match it.

DD_RUNTIME_METRICS_ENABLED

Type: boolean
Default: false
Enables or disables the collection of runtime metrics (such as garbage collection stats, memory usage, and thread counts) for the application.

DD_RUNTIME_METRICS_V2_ENABLED

Type: boolean
Default: true
Controls whether runtime metrics v2 are emitted. Defaults to true.

Data Streams Monitoring for tracking end-to-end latency across message queues and streaming pipelines.

DD_DATA_STREAMS_ENABLED

Type: boolean
Default: false
Enables Data Streams Monitoring (DSM) and its checkpoint propagation. When enabled, the tracer registers the DSM propagator and reports pathway statistics and payloads.

Tracer self-reporting telemetry: heartbeat intervals, dependency and log collection, and telemetry forwarder configuration.

DD_INSTRUMENTATION_TELEMETRY_ENABLED

Type: boolean
Default: true
Allows Datadog to collect environmental and diagnostic information about your application and runtime to improve the product. Set to false to opt out of instrumentation telemetry.

DD_TELEMETRY_DEBUG

Type: boolean
Default: false
Enables debug mode for instrumentation telemetry. When set, it forces telemetry debug mode on regardless of other configuration.

DD_TELEMETRY_DEPENDENCY_COLLECTION_ENABLED

Type: boolean
Default: true
Enables the instrumentation telemetry dependency collector, which detects application dependencies at runtime and reports them to Datadog.

DD_TELEMETRY_LOG_COLLECTION_ENABLED

Type: boolean
Default: true
Controls whether internal tracer logs are forwarded as part of instrumentation telemetry.

DD_TELEMETRY_METRICS_ENABLED

Type: boolean
Default: true
Controls whether instrumentation telemetry sends internal metrics.

Remote Configuration for receiving live configuration updates from Datadog.

DD_REMOTE_CONFIGURATION_ENABLED

Type: boolean
Default: true
Aliases:DD_REMOTE_CONFIG_ENABLED
Enable or disable remote configuration.

Standard OpenTelemetry environment variables supported by Datadog SDKs: resource attributes, propagators, trace sampler, OTLP exporter configuration, and batch span processor settings.

DD_METRICS_OTEL_ENABLED

Type: boolean
Default: false
Since: v2.5.0
Enables OpenTelemetry metrics export. Metrics are disabled by default and are only enabled when this is set to a truthy value.

OTEL_BLRP_EXPORT_TIMEOUT

Type: int
Default: 30000
Since: v2.7.0
Maximum time, in milliseconds, allowed for a single OTLP log export request before it is cancelled.

OTEL_BLRP_MAX_EXPORT_BATCH_SIZE

Type: int
Default: 512
Since: v2.7.0
Maximum number of records in a single OTLP Payload. Must be less than or equal to max queue size.

OTEL_BLRP_MAX_QUEUE_SIZE

Type: int
Default: 2048
Since: v2.7.0
Maximum number of log records held in memory. New records are dropped when this limit is reached.

OTEL_BLRP_SCHEDULE_DELAY

Type: int
Default: 1000
Since: v2.7.0
Interval, in milliseconds, between two consecutive OTLP log export operations.

OTEL_EXPORTER_OTLP_ENDPOINT

Type: string
Default: http://localhost:4318
Since: v2.6.0
Sets the OTLP exporter endpoint used by OpenTelemetry metrics export. When set, it overrides the default endpoint derived from agent configuration.

OTEL_EXPORTER_OTLP_HEADERS

Type: map
Since: v2.6.0
Configuration key to set custom headers for OTLP export (fallback for metrics-specific headers). Used when metrics-specific OTLP headers are not set. Format: api-key=key,other=value.

OTEL_EXPORTER_OTLP_LOGS_ENDPOINT

Type: string
Since: v2.7.0
Aliases:OTEL_EXPORTER_OTLP_ENDPOINT
URL for sending OTLP logs. Takes precedence over OTEL_EXPORTER_OTLP_ENDPOINT. Defaults to http://localhost:4317 for gRPC and http://localhost:4318/v1/logs for HTTP.

OTEL_EXPORTER_OTLP_LOGS_HEADERS

Type: string
Since: v2.7.0
Aliases:OTEL_EXPORTER_OTLP_HEADERS
Specifies a comma-separated list of key-value pairs to be used as headers on outgoing OTLP logs requests. Takes precedence over the general OTEL_EXPORTER_OTLP_HEADERS.

OTEL_EXPORTER_OTLP_LOGS_PROTOCOL

Type: string
Default: http/json
Since: v2.7.0
Specifies the OTLP transport protocol to be used for log data.

OTEL_EXPORTER_OTLP_LOGS_TIMEOUT

Type: int
Default: 10000
Since: v2.7.0
Aliases:OTEL_EXPORTER_OTLP_TIMEOUT
Specifies the timeout (in milliseconds) for a single outgoing OTLP logs request. Takes precedence over the general OTEL_EXPORTER_OTLP_TIMEOUT.

OTEL_EXPORTER_OTLP_METRICS_ENDPOINT

Type: string
Default: http://localhost:4318
Since: v2.6.0
URL for sending OTLP metrics. Takes precedence over OTEL_EXPORTER_OTLP_ENDPOINT. Defaults to http://localhost:4317 for gRPC and http://localhost:4318/v1/metrics for HTTP. For HTTP protocols, the SDK automatically appends /v1/metrics when the general OTEL_EXPORTER_OTLP_ENDPOINT is used as a fallback.

OTEL_EXPORTER_OTLP_METRICS_HEADERS

Type: string
Since: v2.6.0
Aliases:OTEL_EXPORTER_OTLP_HEADERS
Sets additional headers to include in OTLP exporter requests for metrics. When set, it takes precedence over OTEL_EXPORTER_OTLP_HEADERS for metrics export.

OTEL_EXPORTER_OTLP_METRICS_PROTOCOL

Type: string
Default: http/protobuf
Since: v2.6.0
Aliases:OTEL_EXPORTER_OTLP_PROTOCOL
Selects the protocol used for OpenTelemetry OTLP metrics export. Only http/protobuf is supported.

OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE

Type: string
Default: delta
Since: v2.5.0
Controls metrics aggregation temporality. Accepted values: delta or cumulative (case-insensitive); empty/invalid values are treated as delta.

OTEL_EXPORTER_OTLP_METRICS_TIMEOUT

Type: int
Default: 10000
Since: v2.6.0
Aliases:OTEL_EXPORTER_OTLP_TIMEOUT
Timeout, in milliseconds, for a single outgoing OTLP metrics request. Takes precedence over OTEL_EXPORTER_OTLP_TIMEOUT.

OTEL_EXPORTER_OTLP_PROTOCOL

Type: string
Default: http/protobuf
Since: v2.5.0
Specifies the transport protocol to use for all signals unless overridden. Accepted values: grpc, http/protobuf, http/json.

OTEL_EXPORTER_OTLP_TIMEOUT

Type: int
Default: 10000
Since: v2.6.0
Default timeout, in milliseconds, for OTLP export requests. Used as a fallback when a signal-specific timeout is not set.

OTEL_LOG_LEVEL

Type: string
Since: v2.6.0
OTEL_LOG_LEVEL maps to DD_TRACE_DEBUG and enables the debug mode of the tracer. It only accepts “debug” as a valid value.

OTEL_LOGS_EXPORTER

Type: string
Controls the OpenTelemetry logs exporter selection. This setting is not supported and is ignored.

OTEL_METRIC_EXPORT_INTERVAL

Type: int
Default: 10000
Since: v2.5.0
Interval, in milliseconds, between metric export attempts. The default of 10000 (10s) is Datadog’s recommended value and differs from the OpenTelemetry specification default of 60000 ms.

OTEL_METRIC_EXPORT_TIMEOUT

Type: int
Default: 7500
Since: v2.5.0
Maximum time, in milliseconds, allowed to collect and export a single batch of metrics. The default of 7500 (7.5s) is Datadog’s recommended value and differs from the OpenTelemetry specification default of 30000 ms.

OTEL_METRICS_EXPORTER

Type: string
Since: v2.6.0
OTEL_METRICS_EXPORTER is not used to choose an exporter. It is effectively only honored for none, which forces metrics off. When unset it does not enable metrics on its own it needs DD_METRICS_OTEL_ENABLED set to true to effectively produce metrics

OTEL_PROPAGATORS

Type: string
Since: v2.6.0
Specifies trace context propagation formats for both extraction and injection (comma-separated list). Lowest precedence; ignored if any other Datadog trace context propagation environment variable is set.

OTEL_RESOURCE_ATTRIBUTES

Type: string
Since: v2.6.0
Sets OpenTelemetry resource attributes that are mapped to tracer tags when the corresponding tracer tag setting is not set. Reserved attributes for service, environment, and version are mapped to standard tags, and only the first 10 attributes are applied.

OTEL_SERVICE_NAME

Type: string
Since: v2.6.0
Sets the application’s default service name. Alias for DD_SERVICE when DD_SERVICE is not set.

OTEL_TRACES_EXPORTER

Type: string
Since: v2.6.0
Not used to choose an exporter. The only effective value is none, which disables tracing (equivalent to DD_TRACE_ENABLED=false). Any other value is ignored. DD_TRACE_ENABLED takes precedence when set.

OTEL_TRACES_SAMPLER

Type: string
Since: v2.6.0
Sets the trace sampler via OpenTelemetry configuration and maps it to the tracer’s sample rate when the corresponding setting is not set. Parent-based samplers are supported; unsupported values are ignored.

OTEL_TRACES_SAMPLER_ARG

Type: decimal
Default: 1.0
Sets the argument for OTEL_TRACES_SAMPLER when using the traceidratio sampler (for example, OTEL_TRACES_SAMPLER_ARG=0.25). This is used to derive the tracer sample rate when mapping OpenTelemetry configuration.

AI observability features: AI Guard content scanning, LLM Observability, and per-provider integration settings.

DD_LLMOBS_AGENTLESS_ENABLED

Type: boolean
Since: v2.6.0
Controls whether LLM Observability sends data directly to the intake (agentless mode) or through an agent/proxy. If unset, the mode is chosen automatically based on agent support; setting it to false requires an agent that supports LLM Observability.

DD_LLMOBS_ML_APP

Type: string
Since: v2.6.0
Sets the default ML app name used for LLM Observability data. This value is required when LLM Observability is enabled.

Instrumentation setup and platform-specific configuration: auto-injection, third-party library detection, and platform adapters.

DD_HAPROXY_SPOA_HEALTHCHECK_PORT

Type: int
Default: 3080
Since: v2.4.0
Port on which the HAProxy SPOA integration exposes its health check HTTP server.

DD_HAPROXY_SPOA_HOST

Type: string
Default: 0.0.0.0
Since: v2.4.0
Host address on which the HAProxy SPOA integration server listens.

DD_HAPROXY_SPOA_PORT

Type: int
Default: 3000
Since: v2.4.0
Port on which the HAProxy SPOA integration server listens.

DD_REQUEST_MIRROR_HEALTHCHECK_ADDR

Type: string
Default: :8081
Address (host:port) on which the request-mirror integration exposes its health check HTTP server.

DD_REQUEST_MIRROR_LISTEN_ADDR

Type: string
Default: :8080
Address (host:port) on which the request-mirror integration’s HTTP server listens.

DD_SERVICE_EXTENSION_HEALTHCHECK_PORT

Type: int
Default: 80
Port on which the service-extension health check HTTP server listens.

DD_SERVICE_EXTENSION_HOST

Type: string
Default: 0.0.0.0
IP address on which the service-extension servers listen.

DD_SERVICE_EXTENSION_OBSERVABILITY_MODE

Type: boolean
Default: false
Enables observability mode for the service extension. When enabled, blocking actions are disabled.

DD_SERVICE_EXTENSION_PORT

Type: int
Default: 443
Port on which the service-extension gRPC server listens.

DD_SERVICE_EXTENSION_TLS

Type: boolean
Default: true
Since: v2.4.0
Controls whether TLS is enabled on the service-extension gRPC server.

DD_SERVICE_EXTENSION_TLS_CERT_FILE

Type: string
Default: localhost.crt
Since: v2.4.0
Path to the TLS certificate file used by the service-extension gRPC server.

DD_SERVICE_EXTENSION_TLS_KEY_FILE

Type: string
Default: localhost.key
Since: v2.4.0
Path to the TLS private key file used by the service-extension gRPC server.

Configuration keys that don't fit into the other categories yet. Treat this list as a backlog: each key here should eventually find a real home.

DD_EXPERIMENTAL_FLAGGING_PROVIDER_ENABLED

Type: boolean
Default: false
Since: v2.4.0
Enables the experimental feature-flag provider that evaluates flags from remote configuration. If not enabled, the provider is a no-op and returns default values.