aggregate-logs
Analyze log data by performing aggregations, calculating metrics (count, avg, sum), and grouping by fields. Extract insights and statistical summaries to understand patterns in log data efficiently.
Instructions
Perform analytical queries and aggregations on log data. Essential for calculating metrics (count, avg, sum, etc.), grouping data by fields, and creating statistical summaries from logs. Use this when you need to analyze patterns or extract metrics from log data.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| compute | No | ||
| filter | No | ||
| groupBy | No | ||
| options | No |
Implementation Reference
- src/tools/aggregateLogs.ts:51-101 (handler)The main handler function for the 'aggregate-logs' tool. It constructs a POST request to Datadog's /api/v2/logs/analytics/aggregate endpoint using fetch, with parameters for filter, compute, groupBy, and options. Handles errors, especially 403 authorization.execute: async (params: AggregateLogsParams) => { try { const { filter, compute, groupBy, options } = params; // Directly call with fetch to use the documented aggregation endpoint const apiUrl = `https://${ process.env.DD_LOGS_SITE || "datadoghq.com" }/api/v2/logs/analytics/aggregate`; const headers = { "Content-Type": "application/json", "DD-API-KEY": process.env.DD_API_KEY || "", "DD-APPLICATION-KEY": process.env.DD_APP_KEY || "" }; const body = { filter: filter, compute: compute, group_by: groupBy, options: options }; const response = await fetch(apiUrl, { method: "POST", headers: headers, body: JSON.stringify(body) }); if (!response.ok) { throw { status: response.status, message: await response.text() }; } const data = await response.json(); return data; } catch (error: any) { if (error.status === 403) { console.error( "Authorization failed (403 Forbidden): Check that your API key and Application key are valid and have sufficient permissions to access log analytics." ); throw new Error( "Datadog API authorization failed. Please verify your API and Application keys have the correct permissions." ); } else { console.error("Error aggregating logs:", error); throw error; } } }
- src/index.ts:244-290 (registration)Registers the 'aggregate-logs' tool on the MCP server, providing name, description, Zod input schema validation, and the async handler that calls aggregateLogs.execute.server.tool( "aggregate-logs", "Perform analytical queries and aggregations on log data. Essential for calculating metrics (count, avg, sum, etc.), grouping data by fields, and creating statistical summaries from logs. Use this when you need to analyze patterns or extract metrics from log data.", { filter: z .object({ query: z.string().optional(), from: z.string().optional(), to: z.string().optional(), indexes: z.array(z.string()).optional() }) .optional(), compute: z .array( z.object({ aggregation: z.string(), metric: z.string().optional(), type: z.string().optional() }) ) .optional(), groupBy: z .array( z.object({ facet: z.string(), limit: z.number().optional(), sort: z .object({ aggregation: z.string(), order: z.string() }) .optional() }) ) .optional(), options: z .object({ timezone: z.string().optional() }) .optional() }, async (args) => { const result = await aggregateLogs.execute(args); return { content: [{ type: "text", text: JSON.stringify(result) }] }; }
- src/index.ts:248-284 (schema)Zod schema for input validation of the 'aggregate-logs' tool parameters: filter, compute, groupBy, and options.filter: z .object({ query: z.string().optional(), from: z.string().optional(), to: z.string().optional(), indexes: z.array(z.string()).optional() }) .optional(), compute: z .array( z.object({ aggregation: z.string(), metric: z.string().optional(), type: z.string().optional() }) ) .optional(), groupBy: z .array( z.object({ facet: z.string(), limit: z.number().optional(), sort: z .object({ aggregation: z.string(), order: z.string() }) .optional() }) ) .optional(), options: z .object({ timezone: z.string().optional() }) .optional() },
- src/tools/aggregateLogs.ts:31-49 (helper)Initialization function that sets up the Datadog client configuration with API keys and site, enabling unstable operations (though execute uses direct fetch).initialize: () => { const configOpts = { authMethods: { apiKeyAuth: process.env.DD_API_KEY, appKeyAuth: process.env.DD_APP_KEY } }; configuration = client.createConfiguration(configOpts); if (process.env.DD_LOGS_SITE) { configuration.setServerVariables({ site: process.env.DD_LOGS_SITE }); } // Enable any unstable operations configuration.unstableOperations["v2.aggregateLogs"] = true; },
- src/tools/aggregateLogs.ts:3-26 (schema)TypeScript type definition for AggregateLogsParams, matching the Zod schema used for input parameters.type AggregateLogsParams = { filter?: { query?: string; from?: string; to?: string; indexes?: string[]; }; compute?: Array<{ aggregation: string; metric?: string; type?: string; }>; groupBy?: Array<{ facet: string; limit?: number; sort?: { aggregation: string; order: string; }; }>; options?: { timezone?: string; }; };