`service` tag isn't lowercased in logs

[bhrutledge]

In the process of updating our version of this layer from v84, we noticed that service names in Logs were no longer lowercased. So, instead of service:foobar-app-api, we now have service:foobar-App-API. The APM traces are still using the lowercase variant, and the Software Catalog only shows the lowercase variant.

I confirmed that we've always been setting DD_SERVICE=foobar-App-API; it seems we've been relying on that Datadog's documented behavior of converting tags to lowercase for APM and Logs.

By trying different layer versions, I narrowed this down to v84...v85. Claude Code suggested that this is a result of feat: port of Serverless AAP from Go to Rust · Pull Request #755. Because we have DD_SERVERLESS_APPSEC_ENABLED, we were falling back to the Go agent. However, as of v85, we're now using the Rust extension. I haven't verified this, but it sounds plausible.

This means that our monitors and dashboards that query logs using the lowercase variant aren't working, and our service pages don't show logs. However, traces and logs are still correlated.

Is this the intended behavior? Any thoughts/suggestions?

[duncanista]

Seems like this is a bug on our side, the previous Agent lowercased it specifically for Serverless environments, I will raise a PR to fix this.

[bhrutledge]

@duncanista Can this be closed now, thanks to #1013? Was that fix released?

[duncanista]

@bhrutledge should be available in v93 – closing this down!