Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →This skill provides comprehensive guidance for SAP Cloud Logging service on SAP BTP. Use when setting up Cloud Logging instances, configuring log ingestion from Cloud Foundry or Kyma runtimes, implementing OpenTelemetry observability, analyzing logs/metrics/traces in OpenSearch Dashboards, configuring SAML authentication, managing certificates, or troubleshooting ingestion issues. Covers service plans (dev/standard/large), all 4 instance creation methods (BTP Cockpit, CF CLI, BTP CLI, Service Op
.claude/skills/secondsky-sap-btp-cloud-logging/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 92% | 0% |
| case-02 | ✗→✓ | ▲ Improved | 352% | 0% |
| case-03 | ✗→✓ | ▲ Improved | 152% | 0% |
| case-04 | ✗→✓ | ▲ Improved | 176% | 0% |
| case-05 | ✗→✓ | ▲ Improved | 136% | 0% |
Use this skill when creating Cloud Logging instances, choosing service plans, configuring Cloud Foundry/Kyma/OpenTelemetry/JSON ingestion, rotating certificates, setting up OpenSearch dashboards, enabling SAML, or troubleshooting missing logs, metrics, traces, or alerts.
SAP Cloud Logging is an instance-based observability service built on OpenSearch that stores, visualizes, and analyzes application logs, metrics, and traces from SAP BTP Cloud Foundry, Kyma, Kubernetes, and other runtime environments.
Key Capabilities:
| Plan | Capacity | Use Case | Auto-Scaling | |------|----------|----------|--------------| | dev | 7.5 GB fixed | Evaluation only | No | | standard | 75 GB - 375 GB | Production (100 logs/sec) | Yes | | large | 750 GB - 3.75 TB | Production (1000 logs/sec) | Yes |
Important: Plan updates are not supported. Migration requires running instances in parallel.
Note for SAP Build Code Users: If using SAP Build Code, follow the SAP Build Code Initial Setup instructions instead. Cloud Logging in SAP Build Code is available for evaluation purposes only.
Choose one method based on your workflow:
Option 1: SAP BTP Cockpit (UI)
cloud-logging service and planOption 2: Cloud Foundry CLI
bashcf create-service cloud-logging standard my-cls-instance -c '{ "retention_period": 14, "backend": { "max_data_nodes": 10 }, "ingest": { "max_instances": 10 } }' # Wait for provisioning cf services # Check "last operation" status # Create service key cf create-service-key my-cls-instance my-cls-key cf service-key my-cls-instance my-cls-key
Option 3: SAP BTP CLI
bashbtp create services/instance \ --subaccount <SUBACCOUNT_ID> \ --name my-cls-instance \ --offering-name "cloud-logging" \ --plan-name standard \ --parameters '{"retention_period": 14}' # Create binding btp create services/binding \ --subaccount <SUBACCOUNT_ID> \ --name my-cls-binding \ --instance-name my-cls-instance # Get credentials btp get services/binding --name my-cls-binding --subaccount <SUBACCOUNT_ID>
Option 4: SAP BTP Service Operator (Kubernetes/Kyma)
yamlapiVersion: services.cloud.sap.com/v1 kind: ServiceInstance metadata: name: cloud-logging-instance namespace: sap-cloud-logging-integration spec: serviceOfferingName: cloud-logging servicePlanName: standard parameters: retentionPeriod: 14 --- apiVersion: services.cloud.sap.com/v1 kind: ServiceBinding metadata: name: cls-binding namespace: sap-cloud-logging-integration spec: serviceInstanceName: cloud-logging-instance secretName: sap-cloud-logging
| Parameter | Type | Default | Description | |-----------|------|---------|-------------| | retention_period | int | 7 | Data retention in days (1-90) | | backend.max_data_nodes | int | 10 | Max OpenSearch data nodes (2-10) | | dashboards.custom_label | string | - | Dashboard identifier (max 20 chars) | | ingest.max_instances | int | 10 | Max ingest instances for autoscaling (2-10) | | ingest.min_instances | int | 2 | Min ingest instances (2-10) | | ingest_otlp.enabled | bool | false | Enable OpenTelemetry Protocol ingestion | | feature_flags | array | ] | Experimental features (e.g., upgradeToOpenSearchV2) | | rotate_root_ca | bool | false | Trigger CA certificate rotation | | saml | object | - | SAML authentication configuration |
json{ "retention_period": 14, "feature_flags": ["upgradeToOpenSearchV2"], "dashboards": { "custom_label": "PROD-CLS" }, "backend": { "max_data_nodes": 10 }, "ingest": { "max_instances": 10, "min_instances": 2 }, "ingest_otlp": { "enabled": true }, "saml": { "enabled": true, "initiated": true, "admin_group": "CLS-Admins", "roles_key": "groups", "idp": { "metadata_url": "https://<tenant>.accounts.ondemand.com/saml2/metadata", "entity_id": "https://<tenant>.accounts.ondemand.com" }, "sp": { "entity_id": "cloud-logging-<instance-id>" } } }
Bind applications directly to the Cloud Logging instance:
bashcf bind-service <app-name> <cls-instance>
Index Patterns:
logs-cfsyslog-* - Application logsmetrics-otel-v1-* - Resource metricsFor user-provided services with mTLS, see references/cf-ingestion.md.
Requires telemetry and btp-operator modules enabled:
bash# Create namespace kubectl create namespace sap-cloud-logging-integration # Deploy ServiceInstance and ServiceBinding (see templates above) kubectl apply -n sap-cloud-logging-integration -f cls-instance.yaml
Index Patterns:
logs-json-istio-envoy-kyma* - Istio access logslogs-json-kyma* - Application logsEnable with ingest_otlp.enabled: true, then configure your application:
Service Key Credentials:
ingest-otlp-endpoint - gRPC endpoint (hostname:443)ingest-otlp-cert - Client certificate (PEM)ingest-otlp-key - Private key (PKCS#8)server-ca - Server CA certificateIndex Patterns:
logs-otel-v1-* - Logsmetrics-otel-v1-* - Metricsotel-v1-apm-span-* - Tracesotel-v1-apm-service-map - Service mapNote: Only gRPC protocol supported. Use OpenTelemetry Collector to convert http/protobuf or http/json.
For Java/Node.js automation libraries, see references/opentelemetry-ingestion.md.
Send logs via HTTP with mTLS:
bashcurl -X PUT "https://<ingest-endpoint>/v1/ingest" \ --cert client.crt --key client.key \ -H "Content-Type: application/json" \ -d '[{"msg": "log message", "date": "2025-01-15T10:30:00Z"}]'
Index Pattern: logs-json-*
For Fluent Bit configuration, see references/json-api-ingestion.md.
certValidityDays in binding parametersCAUTION: Not following this process causes ingestion interruption.
"rotate_root_ca": true"rotate_root_ca": falsedashboards-url from credentials| Source | Index Pattern | |--------|---------------| | CF Logs | logs-cfsyslog-* | | CF Metrics | metrics-otel-v1-* | | OTLP Logs | logs-otel-v1-* | | OTLP Metrics | metrics-otel-v1-* | | OTLP Traces | otel-v1-apm-span-* | | JSON API | logs-json-* | | Kyma Apps | logs-json-kyma* | | Kyma Istio | logs-json-istio-envoy-kyma* |
Note: Attribute names use @ instead of . due to OpenSearch/Lucene limitations.
Note: Only BTP-CLS-0001 (critical level) is currently reported to SAP Cloud ALM. Other recommendations must be manually verified.
saml parameters in instance configurationadmin_group maps to all_access roleSee references/saml-authentication.md for detailed setup.
Backed up: OpenSearch settings, roles, role mappings, tenants, groups, security configs, saved objects, ISM policies Not backed up: Alerts
Create SAP support ticket with component BC-CP-CLS including:
ingest_otlp.enabled: trueFor detailed information, see bundled reference files:
references/service-plans.md (183 lines) - Service plans comparison and capacity planningreferences/configuration-parameters.md (270 lines) - Complete parameter reference with examplesreferences/cf-ingestion.md (211 lines) - Cloud Foundry ingestion detailsreferences/kyma-ingestion.md (293 lines) - Kyma runtime integrationreferences/opentelemetry-ingestion.md (363 lines) - OTLP setup with Java/Node.js automationreferences/json-api-ingestion.md (435 lines) - JSON API and Fluent Bit configurationreferences/saml-authentication.md (329 lines) - SAML setup with Identity Authentication Servicereferences/cf-ingestion.md - Cloud Foundry runtime ingestion guidereferences/kyma-ingestion.md - Kyma/Cloud Foundry Kyma runtime ingestionreferences/opentelemetry-ingestion.md - OpenTelemetry data ingestionreferences/json-api-ingestion.md - JSON API ingestion methodsreferences/saml-authentication.md - SAML authentication configurationreferences/service-plans.md - Service plans comparison and selectionSAP Cloud Logging is not designed for personal or business-critical data. Take measures to prevent transmission of such data. Data is stored regionally but physical data center locations may differ from consumption locations within the same region.
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→pass | 19,565 | 12,289 | -37% | 1 | 1 | 0% | 3,255 | 6,256 | +92% | 0 | 0 | — |
case-02 | fail→pass | 26,746 | 9,467 | -65% | 1 | 1 | 0% | 1,351 | 6,110 | +352% | 0 | 0 | — |
case-03 | fail→pass | 14,211 | 7,003 | -51% | 1 | 1 | 0% | 2,112 | 5,324 | +152% | 0 | 0 | — |
case-04 | fail→pass | 14,051 | 8,302 | -41% | 1 | 1 | 0% | 2,087 | 5,751 | +176% | 0 | 0 | — |
case-05 | fail→pass | 15,710 | 7,871 | -50% | 1 | 1 | 0% | 2,351 | 5,550 | +136% | 0 | 0 | — |
case-06 | fail→pass | 23,665 | 10,223 | -57% | 1 | 1 | 0% | 2,568 | 6,025 | +135% | 0 | 0 | — |
case-07 | fail→pass | 15,429 | 7,307 | -53% | 1 | 1 | 0% | 2,461 | 5,173 | +110% | 0 | 0 | — |
case-08 | pass→pass | 11,542 | 6,700 | -42% | 1 | 1 | 0% | 1,827 | 5,222 | +186% | 0 | 0 | — |
case-09 | fail→pass | 8,390 | 4,331 | -48% | 1 | 1 | 0% | 1,299 | 4,814 | +271% | 0 | 0 | — |
case-10 | fail→pass | 13,731 | 5,029 | -63% | 1 | 1 | 0% | 1,838 | 4,917 | +168% | 0 | 0 | — |
case-11 | fail→pass | 25,164 | 5,347 | -79% | 1 | 1 | 0% | 1,362 | 5,109 | +275% | 0 | 0 | — |
case-12 | fail→pass | 10,732 | 3,325 | -69% | 1 | 1 | 0% | 1,586 | 4,637 | +192% | 0 | 0 | — |
case-13 | fail→pass | 15,413 | 6,104 | -60% | 1 | 1 | 0% | 2,502 | 4,687 | +87% | 0 | 0 | — |
case-14 | fail→pass | 6,143 | 4,417 | -28% | 1 | 1 | 0% | 947 | 4,829 | +410% | 0 | 0 | — |
case-15 | fail→pass | 26,141 | 3,557 | -86% | 1 | 1 | 0% | 1,305 | 4,711 | +261% | 0 | 0 | — |
case-16 | fail→pass | 9,643 | 3,717 | -61% | 1 | 1 | 0% | 1,641 | 4,820 | +194% | 0 | 0 | — |
case-17 | fail→pass | 13,816 | 5,295 | -62% | 1 | 1 | 0% | 2,411 | 5,150 | +114% | 0 | 0 | — |
case-18 | pass→pass | 15,983 | 7,922 | -50% | 1 | 1 | 0% | 2,480 | 5,514 | +122% | 0 | 0 | — |
case-19 | pass→pass | 5,331 | 4,140 | -22% | 1 | 1 | 0% | 825 | 4,718 | +472% | 0 | 0 | — |
case-20 | pass→fail | 10,024 | 8,613 | -14% | 1 | 1 | 0% | 1,781 | 5,827 | +227% | 0 | 0 | — |
case-21 | pass→pass | 13,950 | 13,273 | -5% | 1 | 1 | 0% | 2,378 | 6,368 | +168% | 0 | 0 | — |
case-22 | pass→pass | 14,757 | 13,651 | -7% | 1 | 1 | 0% | 2,461 | 6,713 | +173% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 19 counted toward the lift figure. The other 3 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +68 percentage points is the difference between those two pass rates over the 19 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.