Sap Btp Cloud Logging

SAP BTP Cloud Logging Skill

Related Skills

• sap-btp-cloud-platform: Use for BTP subaccount setup, entitlements, and runtime context
• sap-btp-cloud-identity-services: Use for SAML/IAS authentication and trust configuration
• sap-btp-developer-guide: Use for application observability patterns across CAP and BTP apps
• sap-btp-best-practices: Use for production monitoring and operations governance

When to Use This Skill

Use this skill when creating Cloud Logging instances, choosing service plans, configuring Cloud Foundry/Kyma/OpenTelemetry/JSON ingestion, rotating certificates, setting up OpenSearch dashboards, enabling SAML, or troubleshooting missing logs, metrics, traces, or alerts.

Table of Contents

• Service Overview
• Service Plans
• Quick Start
  • Prerequisites
  • Instance Creation Options
• Configuration Parameters
  • Full Configuration Example
• Data Ingestion Methods
  • 1. Cloud Foundry Runtime
  • 2. Kyma Runtime
  • 3. OpenTelemetry API (OTLP)
  • 4. JSON API
• Certificate Management
  • Certificate Validity
• Bundled Resources
  • Root CA Rotation (3-Step Process)
• OpenSearch Dashboards
  • Access
  • Pre-built Dashboards
  • Custom Dashboards & Alerting
  • Index Patterns Summary
• Security Best Practices
  • Security Recommendations
  • SAML Authentication Setup
• Backup & Recovery
  • Automatic Backups
  • Restoration Process
• Common Issues & Troubleshooting
• Reference Files
• Documentation Links
  • Official Sources
  • Related Documentation
• Data Protection Notice

Service Overview

SAP Cloud Logging is an instance-based observability service built on OpenSearch that stores, visualizes, and analyzes application logs, metrics, and traces from SAP BTP Cloud Foundry, Kyma, Kubernetes, and other runtime environments.

Key Capabilities:

• Ingest logs, metrics, and traces via OpenTelemetry (OTLP) or JSON API
• Ingest application and request logs from Cloud Foundry runtime
• Configure data retention (1-90 days)
• Visualize and analyze data in OpenSearch Dashboards
• Create custom dashboards and alerts
• SAML authentication via SAP Identity Authentication Service

Service Plans

Important: Plan updates are not supported. Migration requires running instances in parallel.

Quick Start

Prerequisites

1. SAP BTP Global Account
2. Subaccount with Cloud Logging entitlement
3. (Recommended) SAP Cloud Identity Services tenant for SAML authentication

Note for SAP Build Code Users: If using SAP Build Code, follow the SAP Build Code Initial Setup instructions instead. Cloud Logging in SAP Build Code is available for evaluation purposes only.

Instance Creation Options

Choose one method based on your workflow:

Option 1: SAP BTP Cockpit (UI)

1. Navigate to Subaccount → Instances and Subscriptions → Create
2. Select cloud-logging service and plan
3. Configure parameters (see Configuration section)
4. Create service key for credentials

Option 2: Cloud Foundry CLI

cf create-service cloud-logging standard my-cls-instance -c '{
  "retention_period": 14,
  "backend": { "max_data_nodes": 10 },
  "ingest": { "max_instances": 10 }
}'

# Wait for provisioning
cf services  # Check "last operation" status

# Create service key
cf create-service-key my-cls-instance my-cls-key
cf service-key my-cls-instance my-cls-key

Option 3: SAP BTP CLI

btp create services/instance \
  --subaccount <SUBACCOUNT_ID> \
  --name my-cls-instance \
  --offering-name "cloud-logging" \
  --plan-name standard \
  --parameters '{"retention_period": 14}'

# Create binding
btp create services/binding \
  --subaccount <SUBACCOUNT_ID> \
  --name my-cls-binding \
  --instance-name my-cls-instance

# Get credentials
btp get services/binding --name my-cls-binding --subaccount <SUBACCOUNT_ID>

Option 4: SAP BTP Service Operator (Kubernetes/Kyma)

apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: cloud-logging-instance
  namespace: sap-cloud-logging-integration
spec:
  serviceOfferingName: cloud-logging
  servicePlanName: standard
  parameters:
    retentionPeriod: 14
---
apiVersion: services.cloud.sap.com/v1
kind: ServiceBinding
metadata:
  name: cls-binding
  namespace: sap-cloud-logging-integration
spec:
  serviceInstanceName: cloud-logging-instance
  secretName: sap-cloud-logging

Configuration Parameters

Full Configuration Example

{
  "retention_period": 14,
  "feature_flags": ["upgradeToOpenSearchV2"],
  "dashboards": {
    "custom_label": "PROD-CLS"
  },
  "backend": {
    "max_data_nodes": 10
  },
  "ingest": {
    "max_instances": 10,
    "min_instances": 2
  },
  "ingest_otlp": {
    "enabled": true
  },
  "saml": {
    "enabled": true,
    "initiated": true,
    "admin_group": "CLS-Admins",
    "roles_key": "groups",
    "idp": {
      "metadata_url": "https://<tenant>.accounts.ondemand.com/saml2/metadata",
      "entity_id": "https://<tenant>.accounts.ondemand.com"
    },
    "sp": {
      "entity_id": "cloud-logging-<instance-id>"
    }
  }
}

Data Ingestion Methods

1. Cloud Foundry Runtime

Bind applications directly to the Cloud Logging instance:

cf bind-service <app-name> <cls-instance>

Index Patterns:

• logs-cfsyslog-* - Application logs
• metrics-otel-v1-* - Resource metrics

For user-provided services with mTLS, see references/cf-ingestion.md.

2. Kyma Runtime

Requires telemetry and btp-operator modules enabled:

# Create namespace
kubectl create namespace sap-cloud-logging-integration

# Deploy ServiceInstance and ServiceBinding (see templates above)
kubectl apply -n sap-cloud-logging-integration -f cls-instance.yaml

Index Patterns:

• logs-json-istio-envoy-kyma* - Istio access logs
• logs-json-kyma* - Application logs

3. OpenTelemetry API (OTLP)

Enable with ingest_otlp.enabled: true, then configure your application:

Service Key Credentials:

• ingest-otlp-endpoint - gRPC endpoint (hostname:443)
• ingest-otlp-cert - Client certificate (PEM)
• ingest-otlp-key - Private key (PKCS#8)
• server-ca - Server CA certificate

Index Patterns:

• logs-otel-v1-* - Logs
• metrics-otel-v1-* - Metrics
• otel-v1-apm-span-* - Traces
• otel-v1-apm-service-map - Service map

Note: Only gRPC protocol supported. Use OpenTelemetry Collector to convert http/protobuf or http/json.

For Java/Node.js automation libraries, see references/opentelemetry-ingestion.md.

4. JSON API

Send logs via HTTP with mTLS:

curl -X PUT "https://<ingest-endpoint>/v1/ingest" \
  --cert client.crt --key client.key \
  -H "Content-Type: application/json" \
  -d '[{"msg": "log message", "date": "2025-01-15T10:30:00Z"}]'

Index Pattern: logs-json-*

For Fluent Bit configuration, see references/json-api-ingestion.md.

Certificate Management

Certificate Validity

• Default: 90 days
• Configurable: 1-180 days via certValidityDays in binding parameters

Root CA Rotation (3-Step Process)

CAUTION: Not following this process causes ingestion interruption.

1. Create new CA: Update instance with "rotate_root_ca": true
2. Rebind all applications: Create new bindings for each shipping mechanism
3. Delete old CA: Update instance with "rotate_root_ca": false

OpenSearch Dashboards

Access

1. Create service binding/key
2. Navigate to dashboards-url from credentials
3. Authenticate (SAML or basic auth)

Pre-built Dashboards

• Cloud Foundry application performance
• Request latency and error rates
• Resource utilization metrics

Custom Dashboards & Alerting

• Create custom dashboards for specific analysis needs
• Configure alerting based on observability data
• Integrate with SAP Alert Notification for SAP BTP for advanced alerting workflows