logs

Search and analyze Datadog logs with flexible queries and time ranges.

5|2|Updated Mar 9, 2026
One-click install
npx skills add https://github.com/lauhon/pi --skill logs-lauhon
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: logs
Source: https://github.com/lauhon/pi/tree/main/skills/logs
Command: npx skills add https://github.com/lauhon/pi --skill logs-lauhon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Investigating production issues often requires digging through massive volumes of log data, and writing correct Datadog log queries with proper time ranges and filters is error-prone. This Skill lets you search and analyze Datadog logs directly through natural language requests, handling query syntax, time formatting, and result presentation for you. ## Core Features & Use Cases - Flexible Log Search: Query Datadog logs using the full search syntax including field filters, tag filters, attribute search, boolean operators, wildcards, and range queries. - Time Range Control: Search across any period using relative times (1h, 30m, 2d), Unix timestamps, ISO dates, or "now". - Structured Results: Receive log data formatted as readable tables with timestamp, service, status, and message, plus actionable error guidance. - Use Case: When users report errors in production, ask for recent error logs and get a summarized breakdown by service with suggested next investigation steps. ## Quick Start Show me all error logs from the production API service in the last hour.

Frequently Asked Questions about logs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search Datadog logs from the command line?

Use the pup CLI with a query like pup logs search --query="service:web-app status:error" --from="1h" --to="now". You can filter by service, environment, status, tags, and custom attributes, and control result volume with the --limit flag.

What query syntax does Datadog log search support?

Datadog log search supports free text, field search like service:web-app, tag search like env:prod, attribute search like @http.status_code:500, boolean operators AND/OR/NOT, wildcards such as service:web-*, and range queries like @http.status_code:[400 TO 599].

What credentials are required to query Datadog logs?

You need three environment variables: DD_API_KEY for your Datadog API key, DD_APP_KEY for your application key, and DD_SITE for your Datadog site, which defaults to datadoghq.com. Missing credentials produce a clear error prompting you to export them.

Why do Datadog log results show no trace ID even though a trace is linked in the UI?

When a trace ID attribute is remapped for trace correlation, Datadog removes the source attribute and stores it internally, so the Logs Search API never returns it. This is expected Datadog behavior; query a custom non-remapped attribute or pivot to pup traces search instead.

What time formats can I use when searching Datadog logs?

The --from and --to parameters accept relative times like 1h, 30m, 2d, or 3600s, Unix timestamps such as 1704067200, the keyword now, and ISO dates like 2024-01-01T00:00:00Z. Invalid formats return an error listing the accepted options.

Can this tool aggregate or build alerts from Datadog logs?

Log aggregation is not yet supported and is planned for a future update. For complex analytics use the Datadog UI or dashboards, and for log-based alerting use the monitors agent to create log monitors.