datadog-logs

johnnymo87's avatarfrom johnnymo87

Search Datadog logs via API - query syntax, storage tiers (indexes, flex, online-archives), pagination. Use when searching logs or using the dd search-logs command.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 2, 2026
[Monitoring]

When & Why to Use This Skill

This Claude skill enables seamless interaction with the Datadog Logs API, allowing users to search, filter, and analyze log data across various storage tiers including Indexes, Flex, and Online Archives. It streamlines the debugging process by providing direct access to real-time and historical telemetry data, supporting complex query syntax and automated pagination for comprehensive log investigation.

Use Cases

  • Incident Response: Rapidly isolate production errors by querying specific service logs with 'status:error' filters to identify root causes during outages.
  • Historical Troubleshooting: Access long-retention data in the Flex tier to investigate intermittent issues or security events that occurred weeks or months ago.
  • Distributed Tracing: Search for specific UUIDs or Request IDs across multiple microservices to map out transaction flows and identify where failures occur.
  • Log Auditing and Compliance: Programmatically fetch logs related to specific user actions or system changes for security audits and compliance reporting.
  • Performance Monitoring: Analyze log patterns and frequency of specific events to identify system bottlenecks or abnormal behavior in high-traffic environments.
namedatadog-logs
descriptionSearch Datadog logs via API - query syntax, storage tiers (indexes, flex, online-archives), pagination. Use when searching logs or using the dd search-logs command.

Datadog Logs API

CLI Command

# Basic search (last 15 minutes)
dd search-logs 'env:prod service:my-service error'

# Custom time range
dd search-logs 'env:prod error' --from now-1h --to now

# Search Flex Logs tier (for archived/long-retention logs)
dd search-logs 'env:prod' --storage-tier flex --from now-30d

# Multi-service search with OR
dd search-logs 'env:prod service:(service-a OR service-b) order-12345' --storage-tier flex

# Fetch all pages
dd search-logs 'env:prod' --all-pages --limit 100

Query Syntax

The query syntax matches Datadog's Log Explorer. Pass it directly to --query:

# Attribute search
env:prod status:error

# Boolean operators
service:(api OR web) AND status:error

# Free text search
"connection timeout"

# Full-text search across all fields
*:order-12345

# Exclusions
env:prod -status:info

Storage Tiers

Tier Flag Use case
indexes (default) Recent, indexed logs
flex --storage-tier flex Long-retention logs (30d+)
online-archives --storage-tier online-archives Archived logs

Important: If you don't see results, check if logs are in Flex tier. The Datadog UI has a toggle "Include Flex Logs" - this CLI flag is the equivalent.

Options

Option Default Description
--from now-15m Start time (e.g., now-1h, now-7d)
--to now End time
--limit 100 Max logs per page
--storage-tier indexes Storage tier to search
--all-pages false Fetch up to 50 pages

Common Patterns

# Search for UUID across services
dd search-logs 'env:prod service:(svc-a OR svc-b) fb13dc8c-8552-429b-b2d9-8897bfdcfb0e' \
  --storage-tier flex --from now-30d

# Find errors in last hour
dd search-logs 'env:prod status:error' --from now-1h

# Search specific host
dd search-logs 'env:prod host:web-01 status:error'

API Details

  • Endpoint: POST /api/v2/logs/events/search
  • Pagination: Cursor-based (--all-pages handles this)
  • Permission: Requires logs_read_data on the app key

curl Example

curl -X POST "https://api.$DD_SITE/api/v2/logs/events/search" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": {
      "query": "env:prod status:error",
      "from": "now-1h",
      "to": "now",
      "storage_tier": "flex"
    },
    "sort": "-timestamp",
    "page": {"limit": 100}
  }'