datadog-logs

name	datadog-logs
description	Search and export Datadog logs and RUM errors from the command line. Use when the user wants to query logs, query RUM (Real User Monitoring) errors, export data, or search Datadog from the terminal.

Datadog Logs CLI

The datadog logs subcommand searches Datadog logs and outputs each row as a JSON object. It paginates automatically and handles rate limits with retries. It uses the flex storage tier by default, which covers both recent and older logs (beyond the ~3 day online/standard tier window).

CLI availability

Run command -v datadog before use. If it is unavailable, install the local source with cargo install --path ~/code/datadog-cli/datadog.

Authentication

Set these environment variables (or pass as flags):

export DD_API_KEY="your-api-key"
export DD_APPLICATION_KEY="your-app-key"

Keys can be managed at:

• API keys: https://app.datadoghq.com/organization-settings/api-keys
• App keys: https://app.datadoghq.com/organization-settings/application-keys

Usage

Query with time range and query string

datadog logs --time-range "last 1 hour" --query "service:web env:production"

Query from a Datadog URL

Copy a log search URL from the Datadog UI and pass it directly — the CLI extracts the query and time range automatically:

datadog logs --datadog-url "https://app.datadoghq.com/logs?query=service%3Aweb&from_ts=1605055459837&to_ts=1605228259837"

If the URL has no time range, it defaults to the last 15 minutes.

Generate a Logs Explorer link

Use --generate-link to query normally and also print a Logs Explorer link. Use --only-link to print the link without calling the API or requiring --limit:

datadog logs --time-range "last 1 hour" --query "service:web env:production" \
  --limit 20 --generate-link

datadog logs --time-range "last 1 hour" --query "service:web env:production" \
  --only-link

When returning a Logs Explorer link to the user, always rerun the exact query arguments with --only-link (omitting --generate-link) and use the emitted URL verbatim. Never manually construct, retype, or edit the URL.

Limit output rows

datadog logs --time-range "last 4 hours" --query "status:error" --limit 100

Choose columns

By default, output includes timestamp, service, and message. Override with --columns:

datadog logs --time-range "last 1 hour" --query "env:production" \
  --columns "timestamp,service,@version,@file.key"

Or append extra columns to the defaults with --add-columns:

datadog logs --time-range "last 1 hour" --query "env:production" \
  --add-columns "@version,@file.key"

Deep-link to a specific log

Use --deep-links to get a clickable Datadog URL per row that opens with that exact log highlighted (the UI's event=<id> deep-link). Each row also gets a short id handle so you can pick one log to share without quoting the long opaque Datadog event id:

datadog logs --time-range "last 30 minutes" --query "service:ugit @repo:*sessions*" \
  --limit 5 --deep-links --columns "timestamp,service,@repo"

Each output row gains two fields:

• id — a short, unique handle (default 6 hex chars; grows only if two rows would otherwise collide). Use it to refer to a log, e.g. "share 2c327b".
• url — the full deep-link that opens that specific log, highlighted, in a flex-tier stream view bounded to the query's time window.

Notes:

• There is no shorter canonical Datadog log id — the only identifier is the long opaque event= string. The id handle is synthesized (a stable hash prefix); the full id stays embedded in url.
• The url's cols reflect --columns (minus timestamp/message), falling back to host,service.
• Tune the handle length with --id-min-len <N> (default 6).

Resume pagination

If a search is cut off by rate limiting, the CLI prints the last cursor. Resume with --cursor:

datadog logs --time-range "last 1 day" --query "service:web" \
  --cursor "eyJhZnRlciI6..."

Flags reference

Flag	Required	Description
--dd-api-key	Yes (or DD_API_KEY env)	Datadog API key
--dd-application-key	Yes (or DD_APPLICATION_KEY env)	Datadog application key
--datadog-url	No*	Datadog log search URL (extracts query and time range)
--time-range	No*	Time range string, e.g. "last 5 days", "last 30 minutes"
--query	No*	Datadog log query string
--cursor	No	Pagination cursor to resume a previous search
--limit	Yes*	Maximum number of log rows to output (must be <= 100, or use --force)
--force	No	Bypass the --limit <= 100 guard
--generate-link	No	Query normally and also print a Logs Explorer link to stderr
--only-link	No	Print only the Logs Explorer link, skip the API request, and do not require --limit
--columns	No	Comma-separated columns to include (default: timestamp,service,message)
--add-columns	No	Comma-separated columns to append to --columns
--all-columns	No	Output all attributes for each log entry instead of selected columns
--sort-by	No	Sort order: newest (default) or oldest
--deep-links	No	Add a short unique id handle and a url that deep-links to each log (highlighted)

*Either --datadog-url or both --time-range and --query must be provided. --limit must be <= 100 unless --force is used.

Column syntax

• Plain names resolve under attributes: service -> attributes.service
• @ prefix is shorthand for attributes.: @version -> attributes.version
• Nested paths work: @file.key -> attributes.file.key
• Tag fallback: if a column isn't found in attributes, it's looked up in the tags array (e.g. pod_name, kube_namespace, env)

Output format

Each log row is printed as a single-line JSON object with only the selected columns:

{"timestamp":"2026-02-24T12:00:00Z","service":"web","message":"request completed"}
{"timestamp":"2026-02-24T12:00:01Z","service":"web","message":"timeout error"}

Pipe to jq for further processing:

datadog logs --time-range "last 1 hour" --query "status:error" | jq '.message'

Time range formats

• "last 15 minutes", "last 30 mins", "last 30m"
• "last 1 hour", "last 4 hours", "last 1h"
• "last 1 day", "last 7 days", "last 1d"
• "last 1 week", "last 2 weeks", "last 1w"
• "last 1 month", "last 6 months"
• "last 1 year", "last 1y"
• Absolute ISO 8601 range: "2026-02-19T17:35:00Z to 2026-02-19T23:00:00Z"
• Datadog URLs with from_ts / to_ts query params (epoch milliseconds)

Query syntax tips

The CLI validates query syntax before calling the API. Common pitfall:

• Facet values containing colons must be quoted. For example, @job_name:figma::highprifilethumbnailjob will be rejected — use @job_name:"figma::highprifilethumbnailjob" instead.

If validation fails, the CLI prints actionable tips and exits without making an API call.

Sort order

The CLI defaults to --sort-by newest (descending). Use --sort-by oldest when you need to find when something first appeared:

datadog logs --query 'service:multiplayer "skipping checkpoint request"' \
  --time-range "last 7 days" --sort-by oldest --limit 5

Wildcard attribute search

Use *:VALUE to search across all attributes for a value. Useful for finding logs where @file.key isn't set but the file key appears in other fields:

datadog logs --query 'service:multiplayer *:s8ue67bYv1SwA7BBEZQ5XP' --time-range "last 1 hour"

Examples

# Search for errors in the last hour
datadog logs --time-range "last 1 hour" --query "status:error"

# Export production logs with custom columns
datadog logs --time-range "last 30 minutes" \
  --query "env:production service:auth" \
  --columns "timestamp,service,message,@duration,@status_code"

# Get first 50 logs from a Datadog URL
datadog logs --datadog-url "https://app.datadoghq.com/logs?..." --limit 50

# Pipe to jq for analysis
datadog logs --time-range "last 4 hours" --query "service:api" \
  --add-columns "@endpoint,@duration" \
  | jq 'select(.["@duration"] > 1000)'

---

Datadog RUM errors (datadog rum)

The datadog rum subcommand queries browser/mobile RUM (Real User Monitoring) error events. It mirrors the Datadog RUM explorer's output toggle via --output:

• --output timeseries (default) — aggregate errors into count-over-time buckets and draw a chart plus a summary line. No --limit (the buckets bound the output).
• --output list — emit individual error events as JSON rows, capped by --limit (<= 100 unless --force).

Every query is automatically scoped to @type:error (override with --all-types).

Authentication is the same DD_API_KEY / DD_APPLICATION_KEY as logs.

Discover applications first

Every query is scoped to a single RUM application via --application-id, which is required. List the org's applications to find the id:

datadog rum --list-apps

Each row is a JSON object, active apps first:

{"application_id":"91eb025c-e89b-4645-bda6-ca0e442e0b64","name":"Web","type":"browser","is_active":true}

You do not need to embed @application.id:... in --query — pass --application-id <id> and it's added for you.

Occurrences over time (default)

datadog rum --application-id 91eb025c-e89b-4645-bda6-ca0e442e0b64 --time-range "last 1 hour"

Prints a summary (Occurrences, Peak) and a terminal chart of error count over time, using a bucket interval chosen to fit the range (override with --interval "5m").

Break down by error (top errors)

Use --group-by to split the count by a facet and draw one series per group, highest occurrence count first:

datadog rum --application-id 91eb025c-e89b-4645-bda6-ca0e442e0b64 \
  --time-range "last 1 hour" --group-by "@error.message" --top 10

Common facets: @error.message, @error.source, service, @view.url. --top N limits the number of groups (default 10).

Add query filters

--query ANDs extra terms onto the application + error scope:

datadog rum --application-id 91eb025c-e89b-4645-bda6-ca0e442e0b64 \
  --time-range "last 1 hour" --query "@error.source:source service:figma-web"

List individual errors (rows)

Use --output list to get one JSON row per error event — for pulling specific view.urls, timestamps, or attributes. This mode behaves like logs (columns, --limit <= 100 guard, --cursor pagination, --sort-by):

datadog rum --application-id 91eb025c-e89b-4645-bda6-ca0e442e0b64 \
  --time-range "last 15 minutes" --output list --limit 20 \
  --columns "timestamp,error.source,error.message,view.url"

Column syntax matches logs: dot-paths index the event attributes (error.message, view.url), @ is an accepted shorthand prefix, and unmatched columns fall back to the tags array (e.g. env).

Flags reference (rum)

Flag	Required	Description
--list-apps	No	List the org's RUM applications (id, name, type, active) and exit
--application-id	Yes (for queries)	RUM application to scope the query to (discover via --list-apps)
--time-range	Yes (for queries)	Time range string, e.g. "last 1 hour", or ISO 8601 range
--query	No	Extra query terms ANDed onto the application + error scope
--all-types	No	Search all RUM event types instead of only @type:error
--group-by	No	Facet to split the occurrence count by (e.g. @error.message)
--top	No	Number of groups to show with --group-by (default 10)
--interval	No	Timeseries bucket size (e.g. "5m"); defaults to fit the range
--output	No	timeseries (default, chart) or list (individual rows)
--limit	Yes (with --output list)	Max rows in list mode (must be <= 100, or use --force)
--columns / --add-columns / --all-columns	No	Column selection in list mode (same semantics as logs)
--cursor	No	Pagination cursor to resume a list-mode search
--sort-by	No	List-mode sort order: newest (default) or oldest
--force	No	Bypass the list-mode --limit <= 100 guard