Overview
The Log Explorer lets you search and view individual logs as a list. However, the most valuable insights often come from aggregating logs at scale. Using the search feature, you can filter logs and visualize them as timeseries charts, top lists, tree maps, pie charts, or tables to better understand trends, patterns, and outliers across your log data.
Natural language queries
Natural Language Queries is not available in the
Datadog site (
).
Natural Language Queries (NLQ) for Logs is built with Llama.
Use Natural Language Queries (NLQ) to describe what you’re looking for in plain English. Datadog automatically translates your request into a structured log query, making it easier to explore logs without needing to write complex syntax. To access this feature, click Ask in the search field.
The system translates natural language input into Datadog queries and understands context such as services, attributes, tags, and time ranges. It also detects relevant fields automatically and enables users to create visualizations using simple descriptions—for example, “Top 20 services by errors” or “Show errors from service X in the past 24 hours.”
To disable NLQ, you must have org_management permissions. Navigate to Organization Settings > Preferences and toggle off the Natural Language Queries feature.
Search query
A Log Explorer search consists of a time range and a search query, combining key:value and full-text search. You can choose a time window for your search using the time range selector at the top right of the Log Explorer. For details on setting a custom time range, see the Custom Time Frames documentation.
To filter on logs produced by a web store service, with an error status, over the past fifteen minutes, create a custom query like service:payment status:error rejected and set the time range to the Past 15 minutes:
Indexed Logs support both full-text search and key:value search queries.
Note: key:value queries do not require that you declare a facet beforehand.
For complete query syntax reference, see the Search Syntax documentation.
Search bar features
The Log Explorer search bar includes several features to help you write queries more efficiently and accurately.
Syntax highlighting and error validation
Syntax highlighting clearly differentiates input types: keys, values, free text, and control characters. For example, service and status are keys, auth-dotnet and error are values, 500 and check-token are free text, and parentheses are control characters. Status attributes are color-coded by status (red for error, blue for info).
Error validation identifies syntax errors and suggests fixes, such as missing values in key:value pairs, incomplete range queries, or unclosed parentheses.
Autocomplete
The search bar’s autocomplete feature helps you complete queries using existing keys and values in your logs, recent searches, and saved views.
Autocomplete suggests facets and values based on your input, displayed in the order they appear in the facet panel. After selecting a facet and entering :, values appear in descending order by log count from the past 15 minutes.
Your 100 most recent searches are retained and suggested as you type. Saved Views that match your query are also suggested, displayed in the same order as the Saved Views panel.
Disable styling and autocomplete for search bar
Toggle the button to the right of the search bar to search in raw mode, where syntax highlighting, search pills styling, and autocomplete are removed:
You can interact with the search bar with your mouse, as well as by using keyboard commands. For example, use CMD-A for selecting text, CMD-C for copying text, CMD-X for cutting text, and CMD-V for pasting text.
Further Reading
Additional helpful documentation, links, and articles:
