search_logs
Search and view paginated log entries to debug issues, inspect error details, and examine actual log messages.
Instructions
Search and VIEW log entries. Returns paginated results.
IMPORTANT: Use this ONLY when you need to VIEW log content for debugging. For COUNTING logs or unique values, use count_logs or count_unique_values instead - they are much faster and lighter since they never fetch raw log content.
Use this when:
Need to view actual log messages and details
Debugging specific issues
Investigating error details
DO NOT use for:
Counting logs (use count_logs)
Counting unique sessions/users (use count_unique_values)
Statistical analysis (use aggregate_logs_by_field)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Sort order, "timestamp" or "-timestamp" for descending | timestamp |
| query | Yes | Search query using Datadog log search syntax (e.g. "status:error service:api") | |
| cursor | No | Pagination cursor from a previous response's next_cursor field | |
| indexes | No | Optional list of index names to search (e.g. ["main", "retention"]) | |
| to_time | Yes | End time - same accepted formats as from_time | |
| from_time | Yes | Start time - ISO 8601 (e.g. "2024-01-28T10:00:00Z"), relative date math (e.g. "now-1h", "now"), or a millisecond timestamp | |
| page_size | No | Logs per page (default: 25, max: 50) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||