Logs

This dataset represents log events collected by Datadog Log Management. It provides access to application logs, infrastructure logs, and any other log data ingested into Datadog. Logs can be filtered by service, host, status, and any custom attributes, enabling troubleshooting, debugging, and operational analysis across your entire stack.

dd.logs

Log Management Public Documentation

Logs Standard Attributes Documentation

Fields

TitleIDTypeData TypeDescription
TimestamptimestampcoretimestampTime the log event was recorded (e.g., 2025-10-02T09:36:04Z). Applies to: all.
HosthostcorestringThe name of the originating host as defined in metrics (e.g., i-0123456789abcdef0). Applies to: all.
SourcesourcecorestringIntegration name, the technology from which data originated (e.g., nginx, postgresql). Applies to: all.
ServiceservicecorestringThe unified service name for the application or service generating data (e.g., web-api). Applies to: all.
StatusstatuscorestringLevel or severity of the log (e.g., info, warn, error). Applies to: all.
MessagemessagecorestringBody of the log entry; indexed for full-text search by default. Applies to: all.
Trace IDtrace_idcorestringUsed for traces and correlate with other data, including APM traces. Applies to: all.
Client IP@network.client.ipevent_attributestringIP address of the client that initiated the connection (e.g., 192.168.1.100). Applies to: network logs.
Client Port@network.client.portevent_attributeint64Port used by the client connection (e.g., 51402). Applies to: network logs.
Destination IP@network.destination.ipevent_attributestringIP address of the destination (e.g., 10.0.0.1). Applies to: network logs.
Destination Port@network.destination.portevent_attributeint64Port of the destination (e.g., 443). Applies to: network logs.
Client Country@network.client.geoip.country.nameevent_attributestringCountry name derived from client IP geolocation (e.g., United States). Applies to: network logs.
Client Country Code@network.client.geoip.country.iso_codeevent_attributestringISO country code derived from client IP (e.g., US). Applies to: network logs.
Client City@network.client.geoip.city.nameevent_attributestringCity name derived from client IP geolocation (e.g., San Francisco). Applies to: network logs.
HTTP Method@http.methodevent_attributestringHTTP method used in the request (e.g., GET, POST, PUT). Applies to: HTTP logs.
HTTP Status Code@http.status_codeevent_attributeint64HTTP response status code (e.g., 200, 404, 500). Applies to: HTTP logs.
HTTP URL@http.urlevent_attributestringFull URL of the HTTP request (e.g., https://example.com/api/v1/users). Applies to: HTTP logs.
HTTP User Agent@http.useragentevent_attributestringUser agent string from the HTTP request (e.g., Mozilla/5.0...). Applies to: HTTP logs.
URL Host@http.url_details.hostevent_attributestringParsed host from the URL (e.g., example.com). Applies to: HTTP logs.
URL Path@http.url_details.pathevent_attributestringParsed path from the URL (e.g., /api/v1/users). Applies to: HTTP logs.
Error Kind@error.kindevent_attributestringThe type or class of the error (e.g., RuntimeError, NullPointerException). Applies to: error logs.
Error Message@error.messageevent_attributestringConcise, human-readable description of the error (e.g., Connection refused). Applies to: error logs.
Error Stack Trace@error.stackevent_attributestringStack trace or traceback for the error. Applies to: error logs.
Logger Name@logger.nameevent_attributestringName of the logger (e.g., com.example.MyClass). Applies to: all.
Thread Name@logger.thread_nameevent_attributestringName of the current thread when logging (e.g., main, worker-1). Applies to: all.
Method Name@logger.method_nameevent_attributestringName of the method where the log was generated. Applies to: all.
Database Instance@db.instanceevent_attributestringDatabase instance identifier (e.g., orders-db). Applies to: database logs.
Database Operation@db.operationevent_attributestringType of database operation performed (e.g., SELECT, INSERT). Applies to: database logs.
Database User@db.userevent_attributestringDatabase user executing the operation. Applies to: database logs.
User ID@usr.idevent_attributestringUnique identifier of the user (e.g., 12345). Applies to: all.
User Email@usr.emailevent_attributestringEmail address of the user (e.g., user@example.com). Applies to: all.
User Name@usr.nameevent_attributestringFull name or display name of the user. Applies to: all.
Duration@durationevent_attributeint64Duration of the operation in nanoseconds (e.g., 1500000). Applies to: all.
Syslog Hostname@syslog.hostnameevent_attributestringHostname from syslog message. Applies to: syslog.
Syslog Severity@syslog.severityevent_attributeint64Syslog severity level (0-7). Applies to: syslog.
Syslog Facility@syslog.facilityevent_attributeint64Syslog facility code. Applies to: syslog.