search_logs
Search Datadog logs using query filters, time ranges, and pagination to retrieve monitoring data for analysis.
Instructions
Tool for searching Datadog logs
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filterQuery | No | Query string to search logs (optional, default is '*') | * |
| filterFrom | No | Search start time (UNIX timestamp in seconds, optional, default is 15 minutes ago) | |
| filterTo | No | Search end time (UNIX timestamp in seconds, optional, default is current time) | |
| pageLimit | No | Maximum number of logs to retrieve (optional, default is 25) | |
| pageCursor | No | Cursor to retrieve the next page (optional) |
Implementation Reference
- src/tools/logs/search.ts:107-136 (handler)MCP tool handler for 'search_logs': validates parameters using Zod schema, calls the core searchLogs function with converted dates, generates a markdown summary of results and a Datadog link, returns success/error response.export const searchLogsHandler = async ( parameters: z.infer<typeof searchLogsZodSchema> ): Promise<ToolResponse> => { const validation = searchLogsZodSchema.safeParse(parameters); if (!validation.success) { return createErrorResponse( `Parameter validation error: ${validation.error.message}` ); } try { // Convert to Date objects after validation const validatedParams = { ...validation.data, filterFrom: new Date(validation.data.filterFrom * 1000), filterTo: new Date(validation.data.filterTo * 1000), }; const result = await searchLogs(validatedParams); const summaryText = generateSummaryText(validation.data, result); const urlText = `[View in Datadog](https://app.datadoghq.com/logs?query=${encodeURIComponent( validation.data.filterQuery )}&start=${validation.data.filterFrom}&end=${validation.data.filterTo})`; return createSuccessResponse([summaryText, urlText]); } catch (error: unknown) { const errorMessage = error instanceof Error ? error.message : String(error); return createErrorResponse(`Log search error: ${errorMessage}`); } };
- src/tools/logs/search.ts:6-37 (schema)Zod schema defining input parameters for the search_logs tool: filterQuery, filterFrom, filterTo, pageLimit, pageCursor with defaults and descriptions.export const searchLogsZodSchema = z.object({ filterQuery: z .string() .optional() .default("*") .describe("Query string to search logs (optional, default is '*')"), filterFrom: z .number() .optional() .default(Date.now() / 1000 - 15 * 60) .describe( "Search start time (UNIX timestamp in seconds, optional, default is 15 minutes ago)" ), filterTo: z .number() .optional() .default(Date.now() / 1000) .describe( "Search end time (UNIX timestamp in seconds, optional, default is current time)" ), pageLimit: z .number() .min(1) .max(1000) .optional() .default(25) .describe("Maximum number of logs to retrieve (optional, default is 25)"), pageCursor: z .string() .optional() .describe("Cursor to retrieve the next page (optional)"), });
- src/index.ts:18-23 (registration)Registration of the 'search_logs' tool on the MCP server using the schema and handler.server.tool( "search_logs", "Tool for searching Datadog logs", searchLogsZodSchema.shape, searchLogsHandler );
- src/datadog/logs/search.ts:5-41 (helper)Core helper function that performs the actual Datadog logs API search using listLogsGet, maps response to Log objects, handles pagination cursor and errors.export const searchLogs = async ( params: LogSearchParams ): Promise<LogSearchResult> => { try { const configuration = createConfiguration(); const logsApi = new v2.LogsApi(configuration); const response = await logsApi.listLogsGet(params); if (!response.data || response.data.length === 0) { return { logs: [] }; } const logs = response.data.map((logData) => ({ id: logData.id || "", host: logData.attributes?.host, service: logData.attributes?.service, status: logData.attributes?.status, timestamp: logData.attributes?.timestamp ? new Date(logData.attributes.timestamp).toISOString() : undefined, tags: logData.attributes?.tags || [], attributes: logData.attributes || {}, message: logData.attributes?.message, })); const nextCursor = response.meta?.page?.after; return { logs, nextCursor, }; } catch (error: unknown) { const errorMessage = error instanceof Error ? error.message : String(error); console.error(`Error searching logs: ${errorMessage}`); throw new Error(`Datadog API error: ${errorMessage}`); } };