MCPInstall

sap-btp-cloud-logging

by secondskyDevOps & Cloud

This skill provides comprehensive guidance for SAP Cloud Logging service on SAP BTP. Use when setting up Cloud Logging instances, configuring log ingestion from Cloud Foundry or Kyma runtimes, implementing OpenTelemetry observability, analyzing logs/metrics/traces in OpenSearch Dashboards, configuring SAML authentication, managing certificates, or troubleshooting ingestion issues. Covers service plans (dev/standard/large), all 4 instance creation methods (BTP Cockpit, CF CLI, BTP CLI, Service Operator), all 4 ingestion methods (Cloud Foundry, Kyma, OpenTelemetry, JSON API), and security best practices.

Installs
862
Last 24h
—
Trending rank
—
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/secondsky/sap-skills --skill sap-btp-cloud-logging
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads sap-btp-cloud-logging automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

SAP BTP Cloud Logging Skill

Related Skills

  • sap-btp-cloud-platform: Use for BTP subaccount setup, entitlements, and runtime context
  • sap-btp-cloud-identity-services: Use for SAML/IAS authentication and trust configuration
  • sap-btp-developer-guide: Use for application observability patterns across CAP and BTP apps
  • sap-btp-best-practices: Use for production monitoring and operations governance

When to Use This Skill

Use this skill when creating Cloud Logging instances, choosing service plans, configuring Cloud Foundry/Kyma/OpenTelemetry/JSON ingestion, rotating certificates, setting up OpenSearch dashboards, enabling SAML, or troubleshooting missing logs, metrics, traces, or alerts.

Table of Contents

Service Overview

SAP Cloud Logging is an instance-based observability service built on OpenSearch that stores, visualizes, and analyzes application logs, metrics, and traces from SAP BTP Cloud Foundry, Kyma, Kubernetes, and other runtime environments.

Key Capabilities:

  • Ingest logs, metrics, and traces via OpenTelemetry (OTLP) or JSON API
  • Ingest application and request logs from Cloud Foundry runtime
  • Configure data retention (1-90 days)
  • Visualize and analyze data in OpenSearch Dashboards
  • Create custom dashboards and alerts
  • SAML authentication via SAP Identity Authentication Service

Service Plans

PlanCapacityUse CaseAuto-Scaling
dev7.5 GB fixedEvaluation onlyNo
standard75 GB - 375 GBProduction (100 logs/sec)Yes
large750 GB - 3.75 TBProduction (1000 logs/sec)Yes

Important: Plan updates are not supported. Migration requires running instances in parallel.

Quick Start

Prerequisites

  1. SAP BTP Global Account
  2. Subaccount with Cloud Logging entitlement
  3. (Recommended) SAP Cloud Identity Services tenant for SAML authentication

Note for SAP Build Code Users: If using SAP Build Code, follow the SAP Build Code Initial Setup instructions instead. Cloud Logging in SAP Build Code is available for evaluation purposes only.

Instance Creation Options

Choose one method based on your workflow:

Option 1: SAP BTP Cockpit (UI)

  1. Navigate to Subaccount → Instances and Subscriptions → Create
  2. Select cloud-logging service and plan
  3. Configure parameters (see Configuration section)
  4. Create service key for credentials

Option 2: Cloud Foundry CLI

cf create-service cloud-logging standard my-cls-instance -c '{
  "retention_period": 14,
  "backend": { "max_data_nodes": 10 },
  "ingest": { "max_instances": 10 }
}'

# Wait for provisioning
cf services  # Check "last operation" status

# Create service key
cf create-service-key my-cls-instance my-cls-key
cf service-key my-cls-instance my-cls-key

Option 3: SAP BTP CLI

btp create services/instance \
  --subaccount <SUBACCOUNT_ID> \
  --name my-cls-instance \
  --offering-name "cloud-logging" \
  --plan-name standard \
  --parameters '{"retention_period": 14}'

# Create binding
btp create services/binding \
  --subaccount <SUBACCOUNT_ID> \
  --name my-cls-binding \
  --instance-name my-cls-instance

# Get credentials
btp get services/binding --name my-cls-binding --subaccount <SUBACCOUNT_ID>

Option 4: SAP BTP Service Operator (Kubernetes/Kyma)

apiVersion: services.cloud.sap.com/v1
kind: ServiceInstance
metadata:
  name: cloud-logging-instance
  namespace: sap-cloud-logging-integration
spec:
  serviceOfferingName: cloud-logging
  servicePlanName: standard
  parameters:
    retentionPeriod: 14
---
apiVersion: services.cloud.sap.com/v1
kind: ServiceBinding
metadata:
  name: cls-binding
  namespace: sap-cloud-logging-integration
spec:
  serviceInstanceName: cloud-logging-instance
  secretName: sap-cloud-logging

Configuration Parameters

ParameterTypeDefaultDescription
retention_periodint7Data retention in days (1-90)
backend.max_data_nodesint10Max OpenSearch data nodes (2-10)
dashboards.custom_labelstring-Dashboard identifier (max 20 chars)
ingest.max_instancesint10Max ingest instances for autoscaling (2-10)
ingest.min_instancesint2Min ingest instances (2-10)
ingest_otlp.enabledboolfalseEnable OpenTelemetry Protocol ingestion
feature_flagsarray[]Experimental features (e.g., upgradeToOpenSearchV2)
rotate_root_caboolfalseTrigger CA certificate rotation
samlobject-SAML authentication configuration

Full Configuration Example

{
  "retention_period": 14,
  "feature_flags": ["upgradeToOpenSearchV2"],
  "dashboards": {
    "custom_label": "PROD-CLS"
  },
  "backend": {
    "max_data_nodes": 10
  },
  "ingest": {
    "max_instances": 10,
    "min_instances": 2
  },
  "ingest_otlp": {
    "enabled": true
  },
  "saml": {
    "enabled": true,
    "initiated": true,
    "admin_group": "CLS-Admins",
    "roles_key": "groups",
    "idp": {
      "metadata_url": "https://<tenant>.accounts.ondemand.com/saml2/metadata",
      "entity_id": "https://<tenant>.accounts.ondemand.com"
    },
    "sp": {
      "entity_id": "cloud-logging-<instance-id>"
    }
  }
}

Data Ingestion Methods

1. Cloud Foundry Runtime

Bind applications directly to the Cloud Logging instance:

cf bind-service <app-name> <cls-instance>

Index Patterns:

  • logs-cfsyslog-* - Application logs
  • metrics-otel-v1-* - Resource metrics

For user-provided services with mTLS, see references/cf-ingestion.md.

2. Kyma Runtime

Requires telemetry and btp-operator modules enabled:

# Create namespace
kubectl create namespace sap-cloud-logging-integration

# Deploy ServiceInstance and ServiceBinding (see templates above)
kubectl apply -n sap-cloud-logging-integration -f cls-instance.yaml

Index Patterns:

  • logs-json-istio-envoy-kyma* - Istio access logs
  • logs-json-kyma* - Application logs

3. OpenTelemetry API (OTLP)

Enable with ingest_otlp.enabled: true, then configure your application:

Service Key Credentials:

  • ingest-otlp-endpoint - gRPC endpoint (hostname:443)
  • ingest-otlp-cert - Client certificate (PEM)
  • ingest-otlp-key - Private key (PKCS#8)
  • server-ca - Server CA certificate

Index Patterns:

  • logs-otel-v1-* - Logs
  • metrics-otel-v1-* - Metrics
  • otel-v1-apm-span-* - Traces
  • otel-v1-apm-service-map - Service map

Note: Only gRPC protocol supported. Use OpenTelemetry Collector to convert http/protobuf or http/json.

For Java/Node.js automation libraries, see references/opentelemetry-ingestion.md.

4. JSON API

Send logs via HTTP with mTLS:

curl -X PUT "https://<ingest-endpoint>/v1/ingest" \
  --cert client.crt --key client.key \
  -H "Content-Type: application/json" \
  -d '[{"msg": "log message", "date": "2025-01-15T10:30:00Z"}]'

Index Pattern: logs-json-*

For Fluent Bit configuration, see references/json-api-ingestion.md.

Certificate Management

Certificate Validity

  • Default: 90 days
  • Configurable: 1-180 days via certValidityDays in binding parameters

Root CA Rotation (3-Step Process)

CAUTION: Not following this process causes ingestion interruption.

  1. Create new CA: Update instance with "rotate_root_ca": true
  2. Rebind all applications: Create new bindings for each shipping mechanism
  3. Delete old CA: Update instance with "rotate_root_ca": false

OpenSearch Dashboards

Access

  1. Create service binding/key
  2. Navigate to dashboards-url from credentials
  3. Authenticate (SAML or basic auth)

Pre-built Dashboards

  • Cloud Foundry application performance
  • Request latency and error rates
  • Resource utilization metrics

Custom Dashboards & Alerting

  • Create custom dashboards for specific analysis needs
  • Configure alerting based on observability data
  • Integrate with SAP Alert Notification for SAP BTP for advanced alerting workflows

Index Patterns Summary

SourceIndex Pattern
CF Logslogs-cfsyslog-*
CF Metricsmetrics-otel-v1-*
OTLP Logslogs-otel-v1-*
OTLP Metricsmetrics-otel-v1-*
OTLP Tracesotel-v1-apm-span-*
JSON APIlogs-json-*
Kyma Appslogs-json-kyma*
Kyma Istiologs-json-istio-envoy-kyma*

Note: Attribute names use @ instead of . due to OpenSearch/Lucene limitations.

Security Best Practices

Security Recommendations

  • BTP-CLS-0001: Configure SAML authentication with Identity Authentication Service (critical)
  • BTP-CLS-0002: Rotate service keys regularly; deletion doesn't automatically invalidate credentials
  • BTP-CLS-0003: Review Kyma runtime and JSON API security configuration

Note: Only BTP-CLS-0001 (critical level) is currently reported to SAP Cloud ALM. Other recommendations must be manually verified.

SAML Authentication Setup

  1. Create SAML 2.0 application in SAP Identity Authentication
  2. Configure "groups" attribute from Identity Directory
  3. Set Name ID Format to "E-mail"
  4. Enable request signing (recommended)
  5. Configure saml parameters in instance configuration
  6. The admin_group maps to all_access role

See references/saml-authentication.md for detailed setup.

Backup & Recovery

Automatic Backups

Backed up: OpenSearch settings, roles, role mappings, tenants, groups, security configs, saved objects, ISM policies Not backed up: Alerts

Restoration Process

Create SAP support ticket with component BC-CP-CLS including:

  1. Dashboard URL
  2. Instance configuration
  3. Deprovisioning timestamp
  4. Target restoration date (max 7 days)
  5. Owner information
  6. Business justification

Common Issues & Troubleshooting

Instance Creation Fails

  • Verify entitlement in subaccount
  • Check service plan availability in region
  • Validate JSON configuration syntax

Ingestion Not Working

  • Verify binding credentials are current (check certificate expiry)
  • For CF: Binding takes effect without restaging
  • For OTLP: Ensure ingest_otlp.enabled: true
  • Check network connectivity to ingest endpoint

Dashboard Access Issues

  • Verify SAML configuration if enabled
  • Check user is in configured admin group
  • Validate IdP metadata URL accessibility

Certificate Expiration

  • Default validity: 90 days
  • Create new binding before expiration
  • Consider root CA rotation if widespread

Reference Files

For detailed information, see bundled reference files:

Configuration & Setup

  • references/service-plans.md (183 lines) - Service plans comparison and capacity planning
  • references/configuration-parameters.md (270 lines) - Complete parameter reference with examples

Ingestion Methods

  • references/cf-ingestion.md (211 lines) - Cloud Foundry ingestion details
  • references/kyma-ingestion.md (293 lines) - Kyma runtime integration
  • references/opentelemetry-ingestion.md (363 lines) - OTLP setup with Java/Node.js automation
  • references/json-api-ingestion.md (435 lines) - JSON API and Fluent Bit configuration

Security & Authentication

  • references/saml-authentication.md (329 lines) - SAML setup with Identity Authentication Service

Documentation Links

Official Sources

Bundled Resources

Reference Documentation

  • references/cf-ingestion.md - Cloud Foundry runtime ingestion guide
  • references/kyma-ingestion.md - Kyma/Cloud Foundry Kyma runtime ingestion
  • references/opentelemetry-ingestion.md - OpenTelemetry data ingestion
  • references/json-api-ingestion.md - JSON API ingestion methods
  • references/saml-authentication.md - SAML authentication configuration
  • references/service-plans.md - Service plans comparison and selection

Related Documentation

Data Protection Notice

SAP Cloud Logging is not designed for personal or business-critical data. Take measures to prevent transmission of such data. Data is stored regionally but physical data center locations may differ from consumption locations within the same region.

FAQ

What does the sap-btp-cloud-logging skill do?

This skill provides comprehensive guidance for SAP Cloud Logging service on SAP BTP. Use when setting up Cloud Logging instances, configuring log ingestion from Cloud Foundry or Kyma runtimes, implementing OpenTelemetry observability, analyzing logs/metrics/traces in OpenSearch Dashboards, configuring SAML authentication, managing certificates, or troubleshooting ingestion issues. Covers service plans (dev/standard/large), all 4 instance creation methods (BTP Cockpit, CF CLI, BTP CLI, Service Operator), all 4 ingestion methods (Cloud Foundry, Kyma, OpenTelemetry, JSON API), and security best practices.

How do I install sap-btp-cloud-logging?

Run npx skills add https://github.com/secondsky/sap-skills --skill sap-btp-cloud-logging in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sap-btp-cloud-logging/ (personal) or .claude/skills/sap-btp-cloud-logging/ (project).

Which AI agents can use sap-btp-cloud-logging?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is sap-btp-cloud-logging safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains sap-btp-cloud-logging?

It is published by secondsky in secondsky/sap-skills. It has 862 recorded installs.

More from secondsky/sap-skills

View all →

sap-abap

secondsky/sap-skills

Comprehensive ABAP development skill for SAP systems. Use when writing ABAP code, working with internal tables, structures, ABAP SQL, object-oriented programming, RAP (RESTful Application Programming Model), CDS views, EML statements, ABAP Cloud development, string processing, dynamic programming, RTTI/RTTC, field symbols, data references, exception handling, or ABAP unit testing. Covers both classic ABAP and modern ABAP for Cloud Development patterns.

Data & Databases1.3K installs

sap-fiori-tools

secondsky/sap-skills

Develops SAP Fiori applications using SAP Fiori tools extensions for VS Code and SAP Business Application Studio. Use when: generating Fiori Elements or Freestyle SAPUI5 applications, configuring Page Editor for List Report or Object Page, working with annotations and Service Modeler, setting up deployment to ABAP or Cloud Foundry, creating adaptation projects, using Guided Development, previewing with mock data or live data, configuring SAP Fiori launchpad, or using AI-powered generation with Project Accelerator/Joule. Technologies: SAP Fiori Elements, SAPUI5, OData V2/V4, CAP, SAP BTP, ABAP, Cloud Foundry, fiori-mcp-server (MCP tools for AI-assisted generation).

AI & Agents1.2K installs

sap-cap-capire

secondsky/sap-skills

SAP Cloud Application Programming Model (CAP) development skill using Capire documentation. Use when: building CAP applications, defining CDS models, implementing services, working with SAP HANA/SQLite/PostgreSQL databases, deploying to SAP BTP Cloud Foundry or Kyma, implementing Fiori UIs, handling authorization, multitenancy, or messaging. Covers CDL/CQL/CSN syntax, Node.js and Java runtimes, event handlers, OData services, and CAP plugins.

Backend & APIs1.2K installs

sap-btp-developer-guide

secondsky/sap-skills

Develops business applications on SAP Business Technology Platform (BTP) using CAP (Node.js/Java) or ABAP Cloud. Use when: building cloud applications on SAP BTP, deploying to Cloud Foundry or Kyma runtimes, integrating with SAP HANA Cloud, implementing SAP Fiori UIs, connecting to remote SAP systems, building multitenant SaaS applications, extending SAP S/4HANA or SuccessFactors, setting up CI/CD pipelines, implementing observability, or following SAP development best practices. Keywords: SAP BTP, Business Technology Platform, CAP, Cloud Application Programming Model, ABAP Cloud, Cloud Foundry, Kyma, SAP HANA Cloud, SAP Fiori, SAPUI5, CI/CD, observability, multitenant, SaaS, SAP BTP ABAP environment, SAP Business Application Studio, SAP Cloud SDK, SAP Integration Suite, SAP Event Mesh, SAP Connectivity Service, SAP Destination Service, XSUAA, OAuth, OpenID Connect, OData, CDS, Core Data Services, ABAP CDS, ABAP RESTful Application Programming Model, RAP, ABAP development, SAP BTP deve

DevOps & Cloud1.1K installs

sap-btp-best-practices

secondsky/sap-skills

SAP BTP best practices for enterprise architecture, account management, security, and operations, with verification evidence tracked in the repository ledger. Use when planning BTP implementations, setting up account hierarchies, configuring environments, implementing authentication, designing CI/CD pipelines, establishing governance, building Platform Engineering teams, implementing failover strategies, or managing application lifecycle on SAP BTP. Keywords: SAP BTP, account hierarchy, global account, directory, subaccount, Cloud Foundry, Kyma, ABAP, SAP Identity Authentication, CI/CD, governance, Platform Engineering, failover, multi-region, SAP BTP best practices

Code Quality & Workflow1K installs

sap-btp-connectivity

secondsky/sap-skills

SAP BTP Connectivity skill covering Destination Service, Connectivity Service, Cloud Connector, Connectivity Proxy, and Transparent Proxy for Kubernetes. Use when configuring destinations (HTTP, RFC, LDAP, MAIL, TCP), setting up cloud-to-on-premise connectivity, implementing OAuth and principal propagation, deploying connectivity proxies in Kubernetes/Kyma, troubleshooting connectivity errors (405, 407, 503), or configuring multitenancy.

DevOps & Cloud950 installs

Popular devops & cloud skills

View category →

microsoft-foundry

microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure

OfficialDevOps & Cloud579.1K installs

azure-diagnostics

microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.

OfficialDevOps & Cloud569.8K installs

azure-prepare

microsoft/azure-skills

Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.

OfficialDevOps & Cloud569K installs

azure-ai

microsoft/azure-skills

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.

OfficialDevOps & Cloud568.8K installs

azure-deploy

microsoft/azure-skills

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.

OfficialDevOps & Cloud568.6K installs

azure-validate

microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.

OfficialDevOps & Cloud568K installs