Menu
Log queries, filtering, pattern analysis, and log correlation. Search and analyze application and infrastructure logs.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
| name | dt-obs-logs |
| description | Log queries, filtering, pattern analysis, and log correlation. Search and analyze application and infrastructure logs. |
| license | Apache-2.0 |
Query, filter, and analyze Dynatrace log data using DQL for troubleshooting and monitoring.
Use this skill when users want to:
from:now() - <duration> for time windowsmatchesPhrase() and contains() for content searchFind specific log entries by time, severity, and content.
Typical steps:
Example:
fetch logs, from:now() - 1h
| filter status == "ERROR"
| fields timestamp, content, process_group = dt.process_group.detected_name
| sort timestamp desc
| limit 100
Narrow down logs using multiple criteria (severity, entity, content).
Typical steps:
Example:
fetch logs, from:now() - 2h
| filter in(status, {"ERROR", "FATAL", "WARN"})
| summarize count(), by: {dt.process_group.id, dt.process_group.detected_name}
| fieldsAdd process_group = dt.process_group.detected_name
| sort `count()` desc
Identify patterns, trends, and anomalies in log data.
Typical steps:
Example:
fetch logs, from:now() - 2h
| filter status == "ERROR"
| fieldsAdd
has_exception = if(matchesPhrase(content, "exception"), true, else: false),
has_timeout = if(matchesPhrase(content, "timeout"), true, else: false)
| summarize
count(),
exception_count = countIf(has_exception == true),
timeout_count = countIf(has_timeout == true),
by: {process_group = dt.process_group.detected_name}
filter status == "ERROR" - Filter by status levelin(status, "ERROR", "FATAL", "WARN") - Multi-status filtercontains(content, "keyword") - Simple substring searchmatchesPhrase(content, "exact phrase") - Full-text phrase searchdt.process_group.detected_name - Get human-readable process group namefilter process_group == "service-name" - Filter by specific entitycount() - Count all log entriescountIf(condition) - Conditional countby: {dimension} - Group by entity or time bucketbin(timestamp, 5m) - Time bucketing for trendsfields timestamp, content, status - Select specific fieldsfieldsAdd name = expression - Add computed fieldsif(condition, true_value, else: false_value) - Conditional logicSimple substring search:
fetch logs, from:now() - 1h
| filter contains(content, "database")
| fields timestamp, content, status
Full-text phrase search:
fetch logs, from:now() - 1h
| filter matchesPhrase(content, "connection timeout")
| fields timestamp, content, process_group = dt.process_group.detected_name
Calculate error rates over time:
fetch logs, from:now() - 2h
| summarize
total_logs = count(),
error_logs = countIf(status == "ERROR"),
by: {time_bucket = bin(timestamp, 5m)}
| fieldsAdd error_rate = (error_logs * 100.0) / total_logs
| sort time_bucket asc
Find most common errors:
fetch logs, from:now() - 24h
| filter status == "ERROR"
| summarize error_count = count(), by: {content}
| sort error_count desc
| limit 20
Filter logs by process group:
fetch logs, from:now() - 1h
| fieldsAdd process_group = dt.process_group.detected_name
| filter process_group == "payment-service"
| filter status == "ERROR"
| fields timestamp, content, status
| sort timestamp desc
Many applications emit JSON-formatted log lines. Use parse to extract fields instead of dumping raw content:
fetch logs, from:now() - 1h
| filter status == "ERROR"
| parse content, "JSON:log"
| fieldsAdd level = log[level], message = log[msg], error = log[error]
| fields timestamp, level, message, error
| sort timestamp desc
| limit 50
Aggregate by a parsed field:
fetch logs, from:now() - 4h
| filter status == "ERROR"
| parse content, "JSON:log"
| fieldsAdd message = log[msg]
| summarize error_count = count(), by: {message}
| sort error_count desc
| limit 20
Notes:
parse content, "JSON:log" creates a record field log — access nested values with log[key]contains() before parse to reduce parsing overheadcontentfrom:now() - <duration> to limit datacontains() for simple, matchesPhrase() for exact| limit 100 to prevent overwhelming outputdt.process_group.detected_name or getNodeName() for human-readable outputbin(timestamp, 5m) for time-series analysisdt.process_group.id for service correlationbin() and time rangesmatchesPhrase()summarize and conditional functionsmatchesPhrase) may have performance implications on large datasetsWork with Dynatrace dashboards - create, modify, query, and analyze dashboard JSON including tiles, layouts, DQL queries, variables, and visualizations. Supports dashboard creation, updates, data extraction, structure analysis, and best practices.
Work with Dynatrace notebooks - create, modify, query, and analyze notebook JSON including sections, DQL queries, visualizations, markdown documentation, and analytics workflows. Supports notebook creation from scratch, section-based updates, data extraction from Document Store, structure analysis, investigation workflows, and collaborative documentation.
REQUIRED before generating any DQL queries. Provides critical syntax rules, common pitfalls, and patterns. Load this skill BEFORE writing DQL to avoid syntax errors.
Migrate Dynatrace classic and Gen2 entity-based DQL, topology navigation, and classic entity selectors to Smartscape equivalents. Use this skill when users want to convert classic entities to Smartscape nodes, rewrite entityName, entityAttr, or classicEntitySelector patterns, or map old relationships to Smartscape traversal.
AWS cloud resources including EC2, RDS, Lambda, ECS/EKS, VPC networking, load balancers, databases, serverless, messaging, and cost optimization. Monitor AWS infrastructure, analyze resource usage, optimize costs, and ensure security compliance.
Real User Monitoring (RUM), Web Vitals, user sessions, mobile crashes, page performance, user interactions, and frontend errors. Query web and mobile frontend telemetry.