Datadog Logs Search, process, and archive logs with cost awareness. Prerequisites Datadog Pup should already be installed. See [Setup Pup](https://github.com/datadog labs/agent skills/tree/main?tab=readme ov file setup pup) if not. Command Execution Order (Token Efficient) For scoped commands, use this order: 1. Check context first (prior outputs, conversation, saved values). 2. If a required value is missing, run a discovery command first. 3. If still ambiguous, ask the user to confirm. 4. Then run the target command. 5. Avoid speculative commands likely to fail. Quick Start Search Logs Search Syntax Query Meaning error Full text search status:error Tag equals @http.status code:500 Attribute equals @http.status code: =400 Numeric range service:api AND env:prod Boolean @message: timeout Wildcard Configuration APIs Available log configuration commands in pup 0.42.0: Common Processors Exclusion Filters (Cost Control) Index only what matters: High Volume Exclusions Exclude Query Health checks @http.url:"/health" OR @http.url:"/ready" Debug logs status:debug Static assets @http.url: .css OR @http.url: .js Heartbeats @message: heartbeat Archives Store logs cheaply for compliance: Rehydrate (Restore) Log Based Metrics Create metrics from logs (cheaper than indexing): Cardinality warning: Group by bounded values only. Sensitive Data Scrubbing Rules Never Log Troubleshooting Problem Fix Logs not appearing Check agent, pipeline filters High costs Add exclusion filters Search slow Narrow time range, use indexes Missing attributes Check grok parser References/Documentation [Log Search Syntax](https://docs.datadoghq.com/logs/explorer/search syntax/) [Pipelines](https://docs.datadoghq.com/logs/log configuration/pipelines/) [Exclusion Filters](https://docs.datadoghq.com/logs/indexes/ exclusion filters) [Archives](https://docs.datadoghq.com/logs/archives/)

dd-logs