---
title: Query CloudPrem Logs with Datadog MCP Server
description: >-
  Learn how to query logs stored in CloudPrem indexes using the Datadog MCP
  server
breadcrumbs: >-
  Docs > CloudPrem > CloudPrem Guides > Query CloudPrem Logs with Datadog MCP
  Server
---

# Query CloudPrem Logs with Datadog MCP Server

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site). ().
{% /alert %}

{% /callout %}

{% callout %}
##### CloudPrem is in Preview

Join the CloudPrem Preview to access new self-hosted log management features.

[Request Access](https://www.datadoghq.com/product-preview/cloudprem/)
{% /callout %}

## Overview{% #overview %}

The [Datadog MCP (Model Context Protocol) server](https://docs.datadoghq.com/bits_ai/mcp_server/) allows you to query your Datadog logs, including logs stored in CloudPrem indexes, directly through AI-powered tools and integrations. Querying CloudPrem logs with the Datadog MCP server unlocks several valuable capabilities, including:

- **Unified, Context-Aware Troubleshooting**: Query and correlate logs, metrics, and traces from any environment in one place, and pivot across telemetry types to identify root causes faster.
- **Natural Language Interaction**: Ask plain-language questions, and let AI generate the appropriate log queries without needing to remember syntax.

## Prerequisites{% #prerequisites %}

- A running CloudPrem deployment with logs ingested.
- Access to the [Datadog MCP server](https://docs.datadoghq.com/bits_ai/mcp_server/).
- Your CloudPrem index name (visible in the [Datadog Log Explorer](https://app.datadoghq.com/logs) under **CLOUDPREM INDEXES**).

## Querying CloudPrem logs{% #querying-cloudprem-logs %}

To query logs stored in CloudPrem indexes, you **must** specify two critical parameters in addition to your standard log query:

- (Required) **`indexes`**: The name(s) of your CloudPrem index(es).
- (Required) **`storage_tier`**: Must be set to `"cloudprem"`.

Without both parameters, queries will default to searching standard Datadog log indexes instead of CloudPrem.

For best results, your prompt **should also include**:

- (Recommended) Time range (for example, "in the last hour", "from the last 24 hours").
- (Recommended) Query filters (service, status, log content).

### Query parameters{% #query-parameters %}

The following table describes the key parameters used when querying logs with the MCP server:

| Parameter      | Description                                                      | Example                                                |
| -------------- | ---------------------------------------------------------------- | ------------------------------------------------------ |
| `query`        | Log search query using Datadog query syntax                      | `"*"` (all logs), `"service:web"`, `"status:error"`    |
| `indexes`      | Array of CloudPrem index names to search                         | `["cloudprem--dev--main"]`                             |
| `storage_tier` | Storage tier to query (must be `"cloudprem"` for CloudPrem logs) | `"cloudprem"`                                          |
| `from`         | Start time for the query                                         | `"now-1h"`, `"now-24h"`, `"2024-01-15T00:00:00Z"`      |
| `to`           | End time for the query                                           | `"now"`, `"2024-01-15T23:59:59Z"`                      |
| `sort`         | Sort order for results                                           | `"-timestamp"` (descending), `"timestamp"` (ascending) |

For examples of parameter and natural language queries, see Advanced query examples.

### Finding your CloudPrem index name{% #finding-your-cloudprem-index-name %}

To find your CloudPrem index name:

1. Navigate to the [Datadog Log Explorer](https://app.datadoghq.com/logs).
1. Look for the **CLOUDPREM INDEXES** section in the left facet panel.
1. Your CloudPrem indexes are listed there, in the format `cloudprem--<cluster_name>--<index_name>`.

You can also find your index names in the [CloudPrem console](https://app.datadoghq.com/cloudprem) by selecting a cluster and clicking **View Indexes**.

## Advanced query examples{% #advanced-query-examples %}

When using AI-powered tools with the Datadog MCP server, you can ask questions in natural language. The MCP server will automatically translate these into properly formatted CloudPrem queries.

### Error logs from a specific service{% #error-logs-from-a-specific-service %}

**Prompt**: "Show me error logs from the nginx service in the cloudprem–dev–main index in the last hour."

**Translates to**:

```json
{
  "query": "service:nginx status:error",
  "indexes": ["cloudprem--dev--main"],
  "storage_tier": "cloudprem",
  "from": "now-1h",
  "to": "now"
}
```

### Search for specific log content{% #search-for-specific-log-content %}

**Prompt**: "Find logs containing 'connection timeout' from the API service in cloudprem–prod–main from the last 24 hours."

**Translates to**:

```json
{
  "query": "service:api \"connection timeout\"",
  "indexes": ["cloudprem--prod--main"],
  "storage_tier": "cloudprem",
  "from": "now-24h",
  "to": "now"
}
```

### Filter by HTTP status code{% #filter-by-http-status-code %}

**Prompt**: "Get all 500 status code logs from the cloudprem–prod–main index in the last day."

**Translates to**:

```json
{
  "query": "status:500",
  "indexes": ["cloudprem--prod--main"],
  "storage_tier": "cloudprem",
  "from": "now-1d",
  "to": "now"
}
```

## Important notes{% #important-notes %}

- **Both `storage_tier` and `indexes` are required** when querying CloudPrem logs. Without these parameters, queries will search standard Datadog indexes instead.
- `storage_tier` must always be set to `"cloudprem"`.
- The `indexes` parameter must contain valid CloudPrem index names (in the format `cloudprem--<cluster_name>--<index_name>`).
- When using natural language queries, explicitly mention your CloudPrem index name in your prompt.
- CloudPrem logs are queryable in real-time as soon as they are indexed.
- Query syntax follows standard [Datadog log search syntax](https://docs.datadoghq.com/logs/explorer/search_syntax/).

## Further reading{% #further-reading %}

- [Introducing the Datadog MCP server](https://www.datadoghq.com/blog/datadog-remote-mcp-server/)
- [Datadog Extension for VS Code & Cursor](https://docs.datadoghq.com/ide_plugins/vscode/?tab=cursor#installation)
- [Search Logs in CloudPrem](https://docs.datadoghq.com/cloudprem/operate/search_logs/)