A couple of things that would improve the logs being sent to Datadog:
* "syslog.appname" and "syslog.hostname" should be swapped. "syslog.appname" maps to the "service" attribute in Datadog, which shouldn't changed based on the number of instances being run. "syslog.hostname" maps to the "host" attribute in Datadog, which should change based on the number of instances being run.
* Some logs that should be "info" are showing up as "alert". For example, Sidekiq logs about a job completing include "lvl: 'INFO'" in the log, but are showing up in Datadog as "alert".