Note: This endpoint is in public beta. If you have any feedback, contact Datadog support.
A Restriction Query is a logs query that restricts which logs the logs_read_data permission grants read access to.
For users whose roles have Restriction Queries, any log query they make only returns those log events that also match
one of their Restriction Queries. This is true whether the user queries log events from any log-related feature, including
the log explorer, Live Tail, re-hydration, or a dashboard widget.
Restriction Queries currently only support use of the following components of log events:
Reserved attributes
The log message
Tags
To restrict read access on log data, add a team tag to log events to indicate which teams own them, and then scope Restriction Queries to the relevant values of the team tag. Tags can be applied to log events in many ways, and a log event can have multiple tags with the same key (like team) and different values. This means the same log event can be visible to roles whose restriction queries are scoped to different team values.
You need an API and non-scoped application key with Admin rights to interact with these endpoints.