AutoGineer
Generated banner for Dd Logs
Generated logo for Dd Logs

Dd Logs

DatadogOfficialCreated by datadog-labs

  • Skill
  • Tool integration
  • Cloud and DevOps
  • MIT
  • No issues found
Download ZIP

From the author

Log management - search, archives, metrics, and cost control.
— the description by datadog-labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The dd-logs skill provides a command-line interface for interacting with Datadog log management features. It enables users to search logs, aggregate data, manage archives, and configure log-based metrics. The skill also includes guidance on cost control through exclusion filters and data scrubbing techniques to ensure efficient log indexing and compliance.

What it does

  • Search and filter logs using specific queries and time ranges.
  • Aggregate log data to identify patterns or service-level trends.
  • Manage log archives for long-term storage and compliance.
  • Configure log-based metrics to reduce indexing costs.
  • Implement exclusion filters to drop unnecessary or high-volume logs.
  • Apply processors for parsing, remapping, and scrubbing sensitive data.

When to use it

  • When you need to search or debug logs directly from the terminal.
  • When optimizing Datadog log costs by identifying and excluding noisy log sources.
  • When managing log pipelines, parsing rules, or sensitive data scrubbing.
  • When creating or auditing log-based metrics and archive configurations.

Advantages

  • Enables programmatic log management and auditing.
  • Provides clear patterns for reducing log ingestion costs.
  • Supports complex log processing and remapping configurations.
  • Facilitates quick identification of high-volume log sources.

Usage examples

“Find all error logs from the last hour.”
The agent executes pup logs search --query="status:error" --from="1h" to retrieve relevant error entries.
“Show me the top 10 services generating the most logs.”
The agent runs a piped command using pup logs search and jq to group logs by service and sort them by count.
“List all configured log archives.”
The agent executes pup logs archives list to display current archive storage configurations.
“Aggregate logs by service to count errors.”
The agent runs pup logs aggregate --query="status:error" --from="1h" --compute="count" --group-by="service".

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/datadog-labs/dd-logs/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip dd-logs.zip -d .agents/skills

Documentation by datadog-labs

Datadog Logs

Search, process, and archive logs with cost awareness.

Prerequisites

Datadog Pup should already be installed. See Setup Pup if not.

Command Execution Order (Token-Efficient)

For scoped commands, use this order:

  1. Check context first (prior outputs, conversation, saved values).

  2. If a required value is missing, run a discovery command first.

  3. If still ambiguous, ask the user to confirm.

  4. Then run the target command.

  5. Avoid speculative commands likely to fail.

Quick Start

pup auth login

Search Logs

# Basic search
pup logs search --query="status:error" --from="1h"

# With filters
pup logs search --query="service:api status:error" --from="1h" --limit 100

# JSON output
pup logs search --query="@http.status_code:>=500" --from="1h"
Search Syntax
QueryMeaning
errorFull-text search
status:errorTag equals
@http.status_code:500Attribute equals
@http.status_code:>=400Numeric range
service:api AND env:prodBoolean
@message:*timeout*Wildcard

Commands

pup logs search --query="status:error" --from="1h"
pup logs list
pup logs aggregate --query="*" --from="1h" --compute="count" --group-by="service"
pup logs patterns --query="status:error" --pattern-field="message" --from="1h"
pup logs query --query="service:api" --from="1h"
pup logs saved-views list

pup logs archives list
pup logs archives get <archive-id>
pup logs custom-destinations list
pup logs metrics list
pup logs metrics get <metric-id>

# Restriction queries are a top-level command, not a logs subcommand.
pup logs-restriction list

--compute and --group-by on aggregate, and the pattern flags, follow the installed pup logs <command> --help if it disagrees with the examples above.

Common Processors
{
  "name": "API Logs",
  "filter": {"query": "service:api"},
  "processors": [
    {
      "type": "grok-parser",
      "name": "Parse nginx",
      "source": "message",
      "grok": {"match_rules": "%{IPORHOST:client_ip} %{DATA:method} %{DATA:path} %{NUMBER:status}"}
    },
    {
      "type": "status-remapper",
      "name": "Set severity",
      "sources": ["level", "severity"]
    },
    {
      "type": "attribute-remapper",
      "name": "Remap user_id",
      "sources": ["user_id"],
      "target": "usr.id"
    }
  ]
}

Exclusion Filters (Cost Control)

Index only what matters:

{
  "name": "Drop debug logs",
  "filter": {"query": "status:debug"},
  "is_enabled": true
}
High-Volume Exclusions
# Find noisiest log sources
pup logs search --query="*" --from="1h" | jq 'group_by(.service) | map({service: .[0].service, count: length}) | sort_by(-.count)[:10]'
ExcludeQuery
Health checks@http.url:"/health" OR @http.url:"/ready"
Debug logsstatus:debug
Static assets@http.url:*.css OR @http.url:*.js
Heartbeats@message:*heartbeat*

Archives

Store logs cheaply for compliance:

# List archives
pup logs archives list

# Archive config (S3 example)
{
  "name": "compliance-archive",
  "query": "*",
  "destination": {
    "type": "s3",
    "bucket": "my-logs-archive",
    "path": "/datadog"
  },
  "rehydration_tags": ["team:platform"]
}
Rehydrate (Restore)
# Pup has no logs rehydrate command.
# Rehydrate from the Datadog UI or API.

Log-Based Metrics

Create metrics from logs (cheaper than indexing):

# List log-based metrics
pup logs metrics list

# Get one metric by ID
pup logs metrics get api.errors.count

Cardinality warning: Group by bounded values only.

Sensitive Data

Scrubbing Rules
{
  "type": "hash-remapper",
  "name": "Hash emails",
  "sources": ["email", "@user.email"]
}
Never Log
# In your app - sanitize before sending
import re

def sanitize_log(message: str) -> str:
    # Remove credit cards
    message = re.sub(r'\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b', '[REDACTED]', message)
    # Remove SSNs
    message = re.sub(r'\b\d{3}-\d{2}-\d{4}\b', '[REDACTED]', message)
    return message

Troubleshooting

ProblemFix
Logs not appearingCheck agent, pipeline filters
High costsAdd exclusion filters
Search slowNarrow time range, use indexes
Missing attributesCheck grok parser

References/Documentation

Files

LICENSE

MIT License

Copyright (c) 2026, Datadog <[email protected]>

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs Python

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
datadog-labs
Publisher
Datadog (Official)
Source
datadog-labs/agent-skills · dd-logs · commit 8e1306a
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by datadog-labs or Datadog.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dd-logs.zip