## 4.3.1.8.7 Integrate with SAP Cloud Logging
Learn how to configure the Telemetry module to ingest application and access logs as well as distributed trace data and metrics in instances of SAP Cloud Logging.
## Prerequisites
- Kyma as the target deployment environment.
- Make sure the following Kyma modules are added. For details, see Adding and Deleting a Kyma Module [page 3157]
- Telemetry module
- SAP BTP Operator module (default module)
- If you want to collect Istio access logs: Istio module (default module)
- An instance of SAP Cloud Logging with OpenTelemetry enabled to ingest distributed traces. For details, see Ingest via OpenTelemetry API Endpoint.
##  Tip
Create the instance with the SAP BTP service operator (see Create an SAP Cloud Logging Instance through SAP BTP Service Operator), because it takes care of creation and rotation of the required Secret. However, you can choose any other method of creating the instance and the Secret, as long as the parameter for OTLP ingestion is enabled in the instance. For details, see Configuration Parameters.
- A Secret in the respective namespace in the Kyma cluster, holding the credentials and endpoints for the instance. It's recommended that you rotate your Secret (see SAP BTP Security Recommendation BTP-CLS-0003).
In the following example, the Secret is named 'sap-cloud-logging' and the namespace 'sap-cloud-loggingintegration', as illustrated in the secret-example.yaml .
- Kubernetes CLI (kubectl) (see Install the Kubernetes Command Line Tool ).
- UNIX shell or Windows Subsystem for Linux (WSL) to execute commands.
## Context
The Telemetry module supports shipping logs and ingesting distributed traces as well as metrics from applications and the Istio service mesh to SAP Cloud Logging. Furthermore, you can set up Kyma dashboard integration and use SAP Cloud Logging alerts and dashboards.
SAP Cloud Logging is an instance-based and environment-agnostic observability service to store, visualize, and analyze logs, metrics, and traces.
<!-- image -->
## Ship Logs to SAP Cloud Logging
You can set up shipment of applications and access logs to SAP Cloud Logging. The following instructions distinguish application logs and access logs, which can be configured independently.
## Procedure
## Set Up Application Logs
1. Deploy the LogPipeline for application logs with the following script:
```
kubectl apply -n sap-cloud-logging-integration -f - <<EOF apiVersion: telemetry.kyma-project.io/v1alpha1 kind: LogPipeline metadata: name: sap-cloud-logging-application-logs spec: input: application: containers: exclude: - istio-proxy output: http: dedot: true host: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-mtls-endpoint tls: cert: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-mtls-cert key:
```
```
valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-mtls-key uri: /customindex/kyma EOF
```
2. Wait for the LogPipeline to be in the Running state. T o check the state, run: kubectl get logpipelines .
## Set Up Access Logs
By default, Istio sidecar injection and Istio access logs are disabled in Kyma. To analyze access logs of your workload in the default SAP Cloud Logging dashboards shipped for SAP BTP, Kyma runtime, you must enable them:
3. Enable Istio sidecar injection for your workload. See Enabling Istio Sidecar Proxy Injection [page 1783].
4. Enable Istio access logs for your workload. See Configuring Istio Access Logs [page 1801].
5. Deploy the LogPipeline for Istio access logs and enable access logs in Kyma with the following script:
6. Wait for the LogPipeline to be in the Running state. T o check the state, run: kubectl get logpipelines .
```
kubectl apply -n sap-cloud-logging-integration -f - <<EOF apiVersion: telemetry.kyma-project.io/v1alpha1 kind: LogPipeline metadata: name: sap-cloud-logging-access-logs spec: input: application: containers: include: - istio-proxy output: http: dedot: true host: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-mtls-endpoint tls: cert: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-mtls-cert key: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-mtls-key uri: /customindex/istio-envoy-kyma EOF
```
## Ship Distributed Traces to SAP Cloud Logging
You can set up ingestion of distributed traces from applications and the Istio service mesh to the OTLP endpoint of the SAP Cloud Logging service instance.
## Procedure
1. Deploy the Istio Telemetry resource with the following script:
```
kubectl apply -n istio-system -f - <<EOF apiVersion: telemetry.istio.io/v1alpha1 kind: Telemetry metadata: name: tracing-default spec: tracing: - providers: - name: "kyma-traces" randomSamplingPercentage: 1.0 EOF
```
The default configuration has the randomSamplingPercentage property set to 1.0, meaning it samples 1% of all requests. To change the sampling rate, adjust the property to the desired value, up to 100 percent.
2. Deploy the TracePipeline with the following script:
3. Wait for the TracePipeline to be in the Running state. T o check the state, run: kubectl get tracepipelines .
```
kubectl apply -n sap-cloud-logging-integration -f - <<EOF apiVersion: telemetry.kyma-project.io/v1alpha1 kind: TracePipeline metadata: name: sap-cloud-logging spec: output: otlp: endpoint: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-otlp-endpoint tls: cert: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-otlp-cert key: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-otlp-key EOF
```
## Ship Metrics to SAP Cloud Logging
You can set up ingestion of metrics from applications and the Istio service mesh to the OTLP endpoint of the SAP Cloud Logging service instance.
## Procedure
1. Deploy the MetricPipeline with the following script:
```
kubectl apply -n sap-cloud-logging-integration -f - <<EOF apiVersion: telemetry.kyma-project.io/v1alpha1 kind: MetricPipeline metadata: name: sap-cloud-logging spec: input: prometheus: enabled: false istio: enabled: false runtime: enabled: false output: otlp: endpoint: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-otlp-endpoint tls: cert: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-otlp-cert key: valueFrom: secretKeyRef: name: sap-cloud-logging namespace: sap-cloud-logging-integration key: ingest-otlp-key EOF
```
By default, the MetricPipeline assures that a gateway is running in the cluster to push OTLP metrics.
2. If you want to use additional metric collection, configure the presets under input .
For the available options, see Metrics [page 1992].
3. Wait for the MetricPipeline to be in the Running state. T o check the state, run: kubectl get metricpipelines .
## Set Up Kyma Dashboard Integration
For easier access from the Kyma dashboard, add links to the navigation under SAP Cloud Logging , and add deep links to the Pod , Deployment , and Namespace views.
## Context
Depending on the output you use in your LogPipeline , apply the ConfigMap . If your Secret has a different name or namespace, then download the file first and adjust the namespace and name accordingly in the dataSources section of the file.
## Procedure
- For OTLP, run:
kubectl apply
-f https://raw.githubusercontent.com/kyma-project/telemetry-manager/main/docs/ user/integration/sap-cloud-logging/kyma-dashboard-configmap.yaml
- For HTTP, run:
kubectl apply
-f https://raw.githubusercontent.com/kyma-project/telemetry-manager/main/docs/ user/integration/sap-cloud-logging/kyma-dashboard-http-configmap.yaml
## Use SAP Cloud Logging Alerts
Learn how to define and import recommended alerts for SAP Cloud Logging. The following alerts are based on JSON documents defining a Monitor for the alerting plugin.
## Procedure
1. Define a destination , which will be used by all your alerts.
2. To import a monitor, use the development tools of the SAP Cloud Logging dashboard.
3. Execute POST \_plugins/\_alerting/monitors , followed by the contents of the respective JSON file.
4. Depending on the pipelines you are using, enable some or all of the following alerts:
## Recommended Alerts
| Category                   | File                      | Description                                                                                                                                                  |
|----------------------------|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP Cloud Logging          | OpenSearch cluster health | The OpenSearch cluster might be- come unhealthy, which is indicated by a red status using the cluster health API .                                           |
| Kyma Telemetry Integration | Application log ingestion | The LogPipeline for shipping ap- plication logs might lose connectivity to SAP Cloud Logging, with the effect that no application logs are ingested anymore. |
| Kyma Telemetry Integration | Access log ingestion      | The LogPipeline for shipping ac- cess logs might lose connectivity to SAP Cloud Logging, with the effect that no access logs are ingested any- more.         |
| Kyma Telemetry Integration | Trace ingestion           | The TracePipeline for shipping traces might lose connectivity to SAP Cloud Logging, with the effect that no traces are ingested anymore.                     |
| Kyma Telemetry Integration | Metric ingestion          | The MetricPipeline for shipping metrics might lose connectivity to SAP Cloud Logging, with the effect that no metrics are ingested anymore.                  |
| Kyma Telemetry Integration | Kyma Telemetry Status     | The Telemetry module might report a non-ready state indicating a configu- ration or data flow problem.                                                       |
5. Edit notification action: Add the destination and adjust the intervals and thresholds to your needs.
6. Verify that the new monitor definition is listed among the SAP Cloud Logging alerts.
## Use SAP Cloud Logging Dashboards
You can view logs, traces, and metrics in SAP Cloud Logging dashboards:
## Procedure
- To view the traffic and application logs, use the SAP Cloud Logging dashboards prefixed with Kyma\_ , which are based on both kinds of log ingestion: application and access logs.
- To view distributed traces, use the OpenSearch plugin Observability .
- To view the container- and Pod-related metrics collected by the MetricPipeline runtime input, use the dashboard [OTel] K8s Container Metrics .
- To view the Kubernetes Node-related metrics collected by the MetricPipeline runtime input, manually import the file K8s Nodes .
- To view the Kubernetes Volume-related metrics collected by the MetricPipeline runtime input, manually import the file K8s Volumes .
- To view the Kubernetes Workload-related metrics collected by the MetricPipeline runtime input, manually import the file K8s Workloads .
- To view the status of the SAP Cloud Logging integration with the Kyma Telemetry module, manually import the file Kyma Telemetry Status .
- To use the dashboard for Istio metrics of Pods that have an active Istio sidecar injection (collected by the MetricPipeline istio input), manually import the file Kyma Istio Service Metrics .