logs
Search and aggregate Datadog logs using text and regex filters, time ranges, and sampling modes for error investigation and time distribution analysis.
Instructions
Search Datadog logs with grep-like text filtering. Actions: search (find logs), aggregate (count/group). Key filters: keyword (text grep), pattern (regex), service, host, status (error/warn/info). Time ranges: "1h", "3d@11:45:23". CORRELATION: Logs contain dd.trace_id in attributes for linking to traces and APM metrics. SAMPLING: Use sample:"diverse" for error investigation (dedupes by message pattern), sample:"spread" for time distribution. TOKEN TIP: Use compact:true to reduce payload size (strips heavy fields) when querying large volumes.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| query | No | Log search query (Datadog syntax). Examples: "error", "service:my-service status:error", "error AND timeout" | |
| keyword | No | Simple text search - finds logs containing this text (grep-like). Merged with query using AND | |
| pattern | No | Regex pattern to match in log message (grep -E style). Example: "ERROR.*timeout|connection refused" | |
| from | No | Start time. Formats: ISO 8601, relative (30s, 15m, 2h, 7d), precise (3d@11:45:23, yesterday@14:00) | |
| to | No | End time. Same formats as "from". Example: from="3d@11:45:23" to="3d@12:55:34" | |
| service | No | Filter by service name | |
| host | No | Filter by host | |
| status | No | Filter by log status/level | |
| indexes | No | Log indexes to search | |
| limit | No | Maximum number of logs to return (default: 200) | |
| sort | No | Sort order | |
| sample | No | Sampling mode: first (chronological, default), spread (evenly across time range), diverse (distinct message patterns) | |
| compact | No | Strip custom attributes for token efficiency. Keeps: id, timestamp, service, host, status, message (truncated), dd.trace_id, dd.span_id, pod_name, kube_namespace, kube_container_name, error info | |
| groupBy | No | Fields to group by (for aggregate) | |
| compute | No | Compute operations (for aggregate) |