gabrielmoreira Datadog Logs Skill
Search and analyze logs in Datadog Log Management.
Tools
| Tool | Description |
|---|---|
search_logs |
Search logs with query syntax, time range, and filters |
get_log_details |
Get detailed information about a specific log entry |
list_log_indexes |
List all available log indexes |
get_log_pipeline |
Get log pipeline configuration for processing |
Example Queries
Search for error logs in the network service
→ search_logs(query="service:network status:error", time_range="1h")
Find all logs from a specific host
→ search_logs(query="host:router-core-01", time_range="15m")
Get logs with a specific trace ID
→ search_logs(query="trace_id:abc123", time_range="1d")
List all log indexes
→ list_log_indexes()
Workflows
Security Event Hunting
- Search for authentication failures:
search_logs(query="@auth.status:failed") - Correlate by source IP:
search_logs(query="@network.client.ip:10.0.0.1") - Check for privilege escalation:
search_logs(query="@action:sudo OR @action:su") - Review timeline and patterns
Network Log Correlation
- Search interface events:
search_logs(query="service:network @interface.status:down") - Correlate with routing changes:
search_logs(query="@event.type:bgp_state_change") - Check for cascading failures across regions
- Build incident timeline
Syslog Analysis
- Search by facility:
search_logs(query="@syslog.facility:local0") - Filter by severity:
search_logs(query="@syslog.severity:<4")(warning and above) - Aggregate by host and time window
- Identify anomalous patterns
Prerequisites
DD_API_KEYDatadog API keyDD_APP_KEYDatadog application keyDD_SITEDatadog site (optional, defaults to datadoghq.com)
Server
This skill uses the datadog-mcp server via remote MCP transport.