Opsphere — DevOps & SRE Intelligence

Datadog logs aggregate

dd_logs_aggregate

Read-only

Exact log counts (and optional top-N group_by) via Logs Analytics aggregate — no log sampling. Use before dd_logs_search when you need window volume or breakdown by service/facet. Optional timeseries buckets.

Input Schema

Name	Required	Description
`to`	No	End window (default now); same formats as from
`from`	No	Start window: now-1h, now-14h30m, ISO-8601, or epoch (normalized to ISO before Datadog)
`hours`	No	Alternative to from/to
`query`	Yes	Datadog log query, e.g. status:error service:storefront
`groupBy`	No	Indexed facet to group by (e.g. service, status, @http.status_code). Must exist in the log index.
`interval`	No	Timeseries bucket, e.g. 1h (when includeTimeseries)
`context_id`	No	Optional explicit Connection Hub work context (ctx_*). Omit to use the conversation's active workspace; global Hub tools ignore it.
`groupByLimit`	No
`includeTimeseries`	No

Output Schema

Name	Required	Description	Default
`ok`	Yes
`data`	Yes
`contractVersion`	Yes
`dataSchemaVersion`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedOct 26, 2026

changedInput schema / properties / from / description

Previous value: -"Start window, e.g. now-1h"New value: +"Start window: now-1h, now-14h30m, ISO-8601, or epoch (normalized to ISO before Datadog)"

changedInput schema / properties / groupBy / description

Previous value: -"Facet to group by, e.g. service"New value: +"Indexed facet to group by (e.g. service, status, @http.status_code). Must exist in the log index."

changedInput schema / properties / to / description

Previous value: -"End window (default now)"New value: +"End window (default now); same formats as from"

Changed3 schema fields changedOct 26, 2026

changedOutput schema / properties / data / additionalProperties
```
Previous value: -trueNew value: +false
```

addedOutput schema / properties / dataSchemaVersion

Added value: +{
+  "const": 2,
+  "type": "number"
+}

changedOutput schema / required

Previous value: -[
-  "contractVersion",
-  "ok",
-  "data"
-]New value: +[
+  "contractVersion",
+  "dataSchemaVersion",
+  "ok",
+  "data"
+]

First observedOct 15, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnly/destructive/openWorld, so the description's job is to add context — and it does, by disclosing that the counts are exact rather than sampled (a meaningful accuracy claim) and that timeseries bucketing is opt-in. It does not mention rate limits or query-cost implications, keeping it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the core capability and followed by the routing rule and the optional features. Every clause carries information; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value detail is not required. For a read-only aggregate tool with a well-described schema, the definition covers purpose, sibling routing, and key options. Minor gaps like cost/cardinality limits on groupBy are tolerable at this richness level.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 78%, so the schema already documents most parameters (from/to/hours/query/groupBy/interval). The description reinforces the groupBy and interval semantics ('top-N group_by', 'timeseries buckets') but adds no format or constraint details beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (log aggregate counts) plus scope qualifiers: exact counts, no sampling, optional top-N group_by and timeseries. This clearly distinguishes it from dd_logs_search, which returns log lines rather than counts.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the alternative sibling and the condition that selects it: use this before dd_logs_search when you need window volume or a service/facet breakdown. It stops short of stating when not to use it (e.g., when you need individual log samples), but the routing guidance is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Opsphere — DevOps & SRE Intelligence tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?