For some reason, when logging to datadog from your applications running on docker swarm, the service names in datadog appears to have the names on the docker image. The application talks to the datadog agent which runs in global mode on swarm.

Setting DATADOG_SERVICE_NAME or DD_SERVICE_NAME as environment variables on the swarm service has zero affect, as they keep showing the service name as the docker image name, as example:

If we inspect the tags, we can see that the docker image shows as the source and maps through as the docker service name. As you can see the swarm service name is what we want to be the service name (not alpine):

One way how to fix this is to setup a pipeline processor, head over to Logs -> Configuration:

Select “Pipelines” and add a new pipeline, select the filter source:alpine to limit down the results to the alpine image, and name your processor:

Next add a new processor and set the type to remapper, select the tag group as “swarm_service” and set the attribute to service and name the processor:

Add a new processor:

Select a service remapper, set the attribute to service and name the processor:

Now when you go back to logs, you will find that the service name is being set to the correct service name in datadog:

When you inspect one of the logs, you will see that the attribute is being set to the log: