# Datadog Logs

> Search and analyze logs in Datadog Log Management.

- Skill: `gabrielmoreira/datadog-logs` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/datadog-logs`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/datadog-logs/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/gabrielmoreira/datadog-logs

---


# Datadog Logs Skill

Search and analyze logs in Datadog Log Management.

## Tools

| Tool | Description |
|------|-------------|
| `search_logs` | Search logs with query syntax, time range, and filters |
| `get_log_details` | Get detailed information about a specific log entry |
| `list_log_indexes` | List all available log indexes |
| `get_log_pipeline` | Get log pipeline configuration for processing |

## Example Queries

```
Search for error logs in the network service
→ search_logs(query="service:network status:error", time_range="1h")

Find all logs from a specific host
→ search_logs(query="host:router-core-01", time_range="15m")

Get logs with a specific trace ID
→ search_logs(query="trace_id:abc123", time_range="1d")

List all log indexes
→ list_log_indexes()
```

## Workflows

### Security Event Hunting
1. Search for authentication failures: `search_logs(query="@auth.status:failed")`
2. Correlate by source IP: `search_logs(query="@network.client.ip:10.0.0.1")`
3. Check for privilege escalation: `search_logs(query="@action:sudo OR @action:su")`
4. Review timeline and patterns

### Network Log Correlation
1. Search interface events: `search_logs(query="service:network @interface.status:down")`
2. Correlate with routing changes: `search_logs(query="@event.type:bgp_state_change")`
3. Check for cascading failures across regions
4. Build incident timeline

### Syslog Analysis
1. Search by facility: `search_logs(query="@syslog.facility:local0")`
2. Filter by severity: `search_logs(query="@syslog.severity:<4")` (warning and above)
3. Aggregate by host and time window
4. Identify anomalous patterns

## Prerequisites

- `DD_API_KEY` Datadog API key
- `DD_APP_KEY` Datadog application key
- `DD_SITE` Datadog site (optional, defaults to datadoghq.com)

## Server

This skill uses the `datadog-mcp` server via remote MCP transport.