Labsco
DataDog logo

dd-logs

★ 940

by datadog-labs · part of DataDog/pup

Log management - search, pipelines, archives, and cost control.

🔥🔥🔥✓ VerifiedFreeQuick setup
#email#git#monitoring
🧰 Not standalone. This skill ships with DataDog/pup and only works together with that tool — install the tool first, then add this skill.

Log management - search, pipelines, archives, and cost control.

Inspect the full instructions your agent will receiveExpand

This is the exact playbook injected into your agent when the skill activates — shown here so you can audit it before installing. You don't need to read it to use the skill.

by datadog-labs

Log management - search, pipelines, archives, and cost control. npx skills add https://github.com/datadog-labs/pup --skill dd-logs Download ZIPGitHub940

Datadog Logs

Search, process, and archive logs with cost awareness.

Search Logs

Copy & paste — that's it
# Basic search
pup logs search --query="status:error" --from="1h"

# With filters
pup logs search --query="service:api status:error" --from="1h" --limit 100

# JSON output is the default
pup logs search --query="@http.status_code:>=500" --from="1h"

Search Syntax

Query Meaning error Full-text search status:error Tag equals @http.status_code:500 Attribute equals @http.status_code:>=400 Numeric range service:api AND env:prod Boolean @message:*timeout* Wildcard

Pipelines

Process logs before indexing:

Copy & paste — that's it
# List pipelines
pup obs-pipelines list

# Create pipeline (JSON)
pup obs-pipelines create --file pipeline.json

Common Processors

Copy & paste — that's it
{
 "name": "API Logs",
 "filter": {"query": "service:api"},
 "processors": [
 {
 "type": "grok-parser",
 "name": "Parse nginx",
 "source": "message",
 "grok": {"match_rules": "%{IPORHOST:client_ip} %{DATA:method} %{DATA:path} %{NUMBER:status}"}
 },
 {
 "type": "status-remapper",
 "name": "Set severity",
 "sources": ["level", "severity"]
 },
 {
 "type": "attribute-remapper",
 "name": "Remap user_id",
 "sources": ["user_id"],
 "target": "usr.id"
 }
 ]
}

⚠️ Exclusion Filters (Cost Control)

Index only what matters:

Copy & paste — that's it
{
 "name": "Drop debug logs",
 "filter": {"query": "status:debug"},
 "is_enabled": true
}

High-Volume Exclusions

Copy & paste — that's it
# Find noisiest log sources
pup logs search --query="*" --from="1h" | jq 'group_by(.service) | map({service: .[0].service, count: length}) | sort_by(-.count)[:10]'

Exclude Query Health checks @http.url:"/health" OR @http.url:"/ready" Debug logs status:debug Static assets @http.url:*.css OR @http.url:*.js Heartbeats @message:*heartbeat*

Archives

Store logs cheaply for compliance:

Copy & paste — that's it
# List archives
pup logs archives list

# Archive config (S3 example)
{
 "name": "compliance-archive",
 "query": "*",
 "destination": {
 "type": "s3",
 "bucket": "my-logs-archive",
 "path": "/datadog"
 },
 "rehydration_tags": ["team:platform"]
}

Log-Based Metrics

Inspect log-based metrics:

Copy & paste — that's it
# List existing log-based metrics
pup logs metrics list

⚠️ Cardinality warning: Group by bounded values only.

Sensitive Data

Scrubbing Rules

Copy & paste — that's it
{
 "type": "hash-remapper",
 "name": "Hash emails",
 "sources": ["email", "@user.email"]
}

Never Log

Copy & paste — that's it
# In your app - sanitize before sending
import re

def sanitize_log(message: str) -> str:
 # Remove credit cards
 message = re.sub(r'\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b', '[REDACTED]', message)
 # Remove SSNs
 message = re.sub(r'\b\d{3}-\d{2}-\d{4}\b', '[REDACTED]', message)
 return message

References/Documentation