If you are considering archiving logs for your organization,
consider use of the Datadog archive capabilities instead of the log list API.
See Datadog Logs Archive documentation.
Note: This endpoint is enabled by default for logs customers. To disable it, contact Datadog support.
This endpoint requires the logs_read_data permission.
The log index on which the request is performed. For multi-index organizations,
the default is all live indexes. Historical indexes of rehydrated logs must be specified.
limit
int32
Number of logs return in the response.
query
string
The search query - following the log search syntax.
sort
enum
Time-ascending asc or time-descending desc results.
Allowed enum values: asc,desc
startAt
string
Hash identifier of the first log to return in the list, available in a log id attribute.
This parameter is used for the pagination feature.
Note: This parameter is ignored if the corresponding log
is out of the scope of the specified time window.
time [required]
object
Timeframe to retrieve the log from.
from [required]
date-time
Minimum timestamp for requested logs.
timezone
string
Timezone can be specified both as an offset (for example "UTC+03:00")
or a regional zone (for example "Europe/Paris").
Response object with all logs matching the request and pagination information.
Expand All
Field
Type
Description
logs
[object]
Array of logs matching the request and the nextLogId if sent.
content
object
JSON object containing all log attributes and their associated values.
attributes
object
JSON object of attributes from your log.
host
string
Name of the machine from where the logs are being sent.
message
string
The message reserved attribute
of your log. By default, Datadog ingests the value of the message attribute as the body of the log entry.
That value is then highlighted and displayed in the Logstream, where it is indexed for full text search.
service
string
The name of the application or service generating the log events.
It is used to switch from Logs to APM, so make sure you define the same
value when you use both products.
tags
[string]
Array of tags associated with your log.
timestamp
date-time
Timestamp of your log.
id
string
ID of the Log.
nextLogId
string
Hash identifier of the next log to return in the list.
This parameter is used for the pagination feature.
status
string
Status of the response.
{"logs":[{"content":{"attributes":{"customAttribute":123,"duration":2345},"host":"i-0123","message":"Host connected to remote","service":"agent","tags":["team:A"],"timestamp":"2020-05-26T13:36:14Z"},"id":"AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA"}],"nextLogId":"string","status":"string"}
// Search test logs returns "OK" response
usechrono::{DateTime,Utc};usedatadog_api_client::datadog;usedatadog_api_client::datadogV1::api_logs::LogsAPI;usedatadog_api_client::datadogV1::model::LogsListRequest;usedatadog_api_client::datadogV1::model::LogsListRequestTime;usedatadog_api_client::datadogV1::model::LogsSort;#[tokio::main]asyncfnmain(){letbody=LogsListRequest::new(LogsListRequestTime::new(DateTime::parse_from_rfc3339("2021-11-11T10:11:11+00:00").expect("Failed to parse datetime").with_timezone(&Utc),DateTime::parse_from_rfc3339("2021-11-11T11:11:11+00:00").expect("Failed to parse datetime").with_timezone(&Utc),).timezone("Europe/Paris".to_string()),).index("main".to_string()).query("host:Test*".to_string()).sort(LogsSort::TIME_ASCENDING);letconfiguration=datadog::Configuration::new();letapi=LogsAPI::with_config(configuration);letresp=api.list_logs(body).await;ifletOk(value)=resp{println!("{:#?}",value);}else{println!("{:#?}",resp.unwrap_err());}}
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com"DD_API_KEY="<DD_API_KEY>"DD_APP_KEY="<DD_APP_KEY>"cargo run
/**
* Search test logs returns "OK" response
*/import{client,v1}from"@datadog/datadog-api-client";constconfiguration=client.createConfiguration();constapiInstance=newv1.LogsApi(configuration);constparams: v1.LogsApiListLogsRequest={body:{index:"main",query:"host:Test*",sort:"asc",time:{from:newDate(newDate().getTime()+-1*3600*1000),timezone:"Europe/Paris",to: newDate(),},},};apiInstance.listLogs(params).then((data: v1.LogsListResponse)=>{console.log("API called successfully. Returned data: "+JSON.stringify(data));}).catch((error: any)=>console.error(error));