菜单
Search Datadog logs via API - query syntax, storage tiers (indexes, flex, online-archives), pagination. Use when searching logs or using the dd-cli search-logs command.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | datadog-logs |
| description | Search Datadog logs via API - query syntax, storage tiers (indexes, flex, online-archives), pagination. Use when searching logs or using the dd-cli search-logs command. |
# Basic search (last 15 minutes)
dd-cli search-logs 'env:prod service:my-service error'
# Custom time range
dd-cli search-logs 'env:prod error' --from now-1h --to now
# Search Flex Logs tier (for archived/long-retention logs)
dd-cli search-logs 'env:prod' --storage-tier flex --from now-30d
# Multi-service search with OR
dd-cli search-logs 'env:prod service:(service-a OR service-b) order-12345' --storage-tier flex
# Fetch all pages
dd-cli search-logs 'env:prod' --all-pages --limit 100
The query syntax matches Datadog's Log Explorer. Pass it directly to --query:
# Attribute search
env:prod status:error
# Boolean operators
service:(api OR web) AND status:error
# Free text search
"connection timeout"
# Full-text search across all fields
*:order-12345
# Exclusions
env:prod -status:info
| Tier | Flag | Use case |
|---|---|---|
indexes | (default) | Recent, indexed logs |
flex | --storage-tier flex | Long-retention logs (30d+) |
online-archives | --storage-tier online-archives | Archived logs |
Important: If you don't see results, check if logs are in Flex tier. The Datadog UI has a toggle "Include Flex Logs" - this CLI flag is the equivalent.
| Option | Default | Description |
|---|---|---|
--from | now-15m | Start time (e.g., now-1h, now-7d) |
--to | now | End time |
--limit | 100 | Max logs per page |
--storage-tier | indexes | Storage tier to search |
--all-pages | false | Fetch up to 50 pages |
# Search for UUID across services
dd-cli search-logs 'env:prod service:(svc-a OR svc-b) aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee' \
--storage-tier flex --from now-30d
# Find errors in last hour
dd-cli search-logs 'env:prod status:error' --from now-1h
# Search specific host
dd-cli search-logs 'env:prod host:web-01 status:error'
POST /api/v2/logs/events/search--all-pages handles this)logs_read_data on the app keycurl -X POST "https://api.$DD_SITE/api/v2/logs/events/search" \
-H "DD-API-KEY: $DD_API_KEY" \
-H "DD-APPLICATION-KEY: $DD_APP_KEY" \
-H "Content-Type: application/json" \
-d '{
"filter": {
"query": "env:prod status:error",
"from": "now-1h",
"to": "now",
"storage_tier": "flex"
},
"sort": "-timestamp",
"page": {"limit": 100}
}'
Create, inspect, and update Datadog monitors via API - get monitor details by ID or URL, create or update metric/query alerts with thresholds and Slack notifications. Use when setting up alerting, tuning monitors, investigating monitor triggers, or checking monitor group states.
Troubleshoot Datadog API authentication issues (401/403 errors), understand API keys vs app keys, and configure correct regions. Use when hitting auth errors or setting up Datadog API access.
Search and manage Datadog Error Tracking issues via API - find grouped errors by service, resolve/ignore issues. Use when investigating production errors or managing error tracking issue states.
Work with Datadog Incidents API - fetch incidents with enrichment, update incident fields, understand incident data structures. Use when working with incidents or the dd-cli get-incident/update-incident commands.
Create log-based count metrics via API - works with all storage tiers including flex. Use when you need to monitor log patterns but logs are in flex tier (where log monitors don't work).
List and inspect Datadog SLOs via API - view SLI values, error budgets, thresholds, and history. Use when checking SLO compliance, reviewing error budgets, or finding SLOs by tag.