Query Datadog logs via the Logs Search API v2. Use when the user asks to "check the logs", "search logs", "find errors in Datadog", "look up logs for", "show me production logs", "check for errors", "search Datadog", or any request involving log search, error investigation, or production debugging that requires Datadog log data.
Query Datadog logs using the Logs Search API v2 via curl.
Requires env vars configured in Claude settings:
DD_API_KEY — Datadog API keyDD_APP_KEY — Datadog Application keyDD_SITE — Datadog site (default: datadoghq.com)~/.claude/skills/datadog-logs/scripts/query.sh '<json_body>'
{
"filter": {
"query": "<datadog search query>",
"from": "<start time>",
"to": "<end time>"
},
"sort": "timestamp",
"page": {
"limit": 25
}
}
error, "connection timeout"service:my-api, status:error, host:ip-172-*env:production, version:abc123@http.status_code:403, @err.type:HttpErrorservice:my-api AND status:errorservice:my-*@http.status_code:[400 TO 499]-status:info, NOT service:my-workernow-15m, now-1h, now-1d, now-7d2026-03-18T00:00:00Znow: current timetimestamp (newest first, default)-timestamp (oldest first)page.limit: max results per request (max 1000, default 10)page.cursor: cursor from meta.page.after in previous response for next pagescripts/query.sh '{"filter":{"query":"service:my-api status:error","from":"now-1h","to":"now"},"page":{"limit":25}}'
scripts/query.sh '{"filter":{"query":"@http.status_code:[400 TO 499]","from":"now-1h","to":"now"},"page":{"limit":25}}'
scripts/query.sh '{"filter":{"query":"\"connection refused\" status:error","from":"now-6h","to":"now"},"page":{"limit":25}}'
The API returns JSON with:
data[] — array of log entries, each with attributes.message, attributes.status, attributes.service, attributes.timestamp, and attributes.attributes (structured fields)meta.page.after — cursor for paginationlinks.next — next page URLscripts/query.sh '...' | jq '[.data[] | {timestamp: .attributes.timestamp, service: .attributes.service, status: .attributes.status, message: .attributes.attributes.message}]'
scripts/query.sh '...' | jq '[.data[] | {timestamp: .attributes.timestamp, err_type: .attributes.attributes.err.type, err_message: .attributes.attributes.err.message}]'