aggregate_logs_by_field
Aggregate Datadog logs by field to compute counts, averages, percentiles, or time-series per group for analytics and dashboards.
Instructions
Aggregate and group logs by a field with statistics (fast, no raw data transfer).
PERFECT for analytics, charts, and dashboards. Set interval to get a
timeseries per group instead of a single scalar per group - this
covers timeseries use cases without needing a separate tool.
Use this when:
"Group errors by service"
"Top 10 services by request count"
"Average duration per endpoint, per hour" (set interval="1h")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of groups to return (default: 10) | |
| query | Yes | Search query using Datadog log search syntax | |
| metric | No | Metric field for aggregations other than count (e.g. "@duration" for avg) | |
| indexes | No | Optional list of index names to search | |
| to_time | Yes | End time - same accepted formats as from_time | |
| group_by | Yes | Field to group by (e.g. "@airline_name", "service", "status") | |
| interval | No | If set (e.g. "5m", "1h", "1d"), returns a timeseries per group instead of a single scalar per group | |
| from_time | Yes | Start time - ISO 8601, relative date math (e.g. "now-1h"), or a millisecond timestamp | |
| aggregation | No | Aggregation function to apply within each group | count |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||