Opsphere — DevOps & SRE Intelligence

Datadog Logs Search

dd_logs_search

Read-only

Search logs in Datadog (Logs v2). Returns at most limit events per call (default 50, max 100); pageTotal is the matched volume in the window — not every row is returned. Use nextCursor for the next page. For error counts by service use dd_errors_by_service or env_errors_overview.

Input Schema

Name	Required	Description
`q`	No	Log query, e.g. status:error service:edge
`to`	No	End window: now, ISO-8601, or epoch
`from`	No	Start window: now-1h, now-14h30m, ISO-8601, or epoch
`limit`	No	Max log events to return (may fetch multiple pages up to policy max)
`query`	No	Alias for q (same log query string)
`cursor`	No	Pagination cursor from a prior response nextCursor field
`context_id`	No	Optional explicit Connection Hub work context (ctx_*). Omit to use the conversation's active workspace; global Hub tools ignore it.

Output Schema

Name	Required	Description	Default
`ok`	Yes
`data`	Yes
`contractVersion`	Yes
`dataSchemaVersion`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedOct 26, 2026

addedInput schema / properties / query

Added value: +{
+  "description": "Alias for q (same log query string)",
+  "type": "string"
+}

removedInput schema / required
```
Removed value: -[
-  "q"
-]
```

Changed5 schema fields changedOct 26, 2026

changedInput schema / properties / from / description

Previous value: -"Start window, e.g. now-1h"New value: +"Start window: now-1h, now-14h30m, ISO-8601, or epoch"

changedInput schema / properties / to / description

Previous value: -"End window, e.g. now"New value: +"End window: now, ISO-8601, or epoch"

changedOutput schema / properties / data / properties / events / items / additionalProperties
```
Previous value: -falseNew value: +true
```

addedOutput schema / properties / data / properties / events / items / properties / attributes / additionalProperties / anyOf

Added value: +[
+  {
+    "type": "string"
+  },
+  {
+    "type": "number"
+  },
+  {
+    "type": "boolean"
+  },
+  {
+    "type": "null"
+  },
+  {
+    "items": {
+      "$ref": "#/properties/data/properties/events/items/properties/attributes/additionalProperties"
+    },
+    "type": "array"
+  },
+  {
+    "additionalProperties": {
+      "$ref": "#/properties/data/properties/events/items/properties/attributes/additionalProperties"
+    },
+    "type": "object"
+  }
+]

removedOutput schema / properties / data / properties / events / items / properties / attributes / additionalProperties / type
```
Removed value: -[
-  "string",
-  "number",
-  "boolean",
-  "null"
-]
```

Changed7 schema fields changedOct 26, 2026
- changedOutput schema / properties / data / additionalProperties
```
Previous value: -trueNew value: +false
```
- changedOutput schema / properties / data / properties / events / items / additionalProperties
```
Previous value: -trueNew value: +false
```
- addedOutput schema / properties / data / properties / events / items / properties / attributes
```
Added value: +{
+  "additionalProperties": {
+    "type": [
+      "string",
+      "number",
+      "boolean",
+      "null"
+    ]
+  },
+  "type": "object"
+}
```
- addedOutput schema / properties / data / properties / events / items / properties / id
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / data / properties / events / items / properties / message
```
Added value: +{
+  "type": "string"
+}
```
- addedOutput schema / properties / dataSchemaVersion
```
Added value: +{
+  "const": 2,
+  "type": "number"
+}
```
- changedOutput schema / required
```
Previous value: -[
-  "contractVersion",
-  "ok",
-  "data"
-]New value: +[
+  "contractVersion",
+  "dataSchemaVersion",
+  "ok",
+  "data"
+]
```
First observedOct 15, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/destructiveHint, so the safety bar is low, and the description adds genuinely useful behavior: limit defaults/cap and the warning that pageTotal is matched volume, not returned rows. It also explains the cursor flow for paging. It doesn't mention rate limits or result ordering, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Twenty-eight words across three sentences, front-loaded with what it does, then the pagination gotcha, then the alternative routing. Zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be spelled out, and the description still flags the key misinterpretation risk (pageTotal != rows returned). Query syntax, time-window formats, and context_id are left entirely to the schema, which is acceptable at 100% coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description's statement about limit default/max and the nextCursor-to-cursor handoff largely restates what the schema already documents, adding little semantic meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource ('Search logs in Datadog (Logs v2)') and immediately scopes it against siblings by directing error-count use cases to dd_errors_by_service or env_errors_overview. An agent can tell it apart from the aggregate/error siblings without reading any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes error-count-by-service needs to dd_errors_by_service or env_errors_overview, which is a clear when-not condition. It does not differentiate against the other log-shaped siblings (dd_logs_aggregate, dd_log_get, dd_events_search), so it stops short of full alternative coverage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Opsphere — DevOps & SRE Intelligence tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?