Overview

Use the search_datadog_logs tool on the Datadog MCP (Model Context Protocol) server to query logs stored in BYOC (Bring Your Own Cloud) Logs indexes. You can access the tool through AI-powered tools and integrations.

Note: BYOC Logs indexes are supported only by search_datadog_logs. The analyze_datadog_logs tool and the datadog/querying-patterns skill do not support BYOC Logs indexes.

Prerequisites

• A running BYOC Logs deployment with logs ingested.
• Access to the Datadog MCP server.
• Your BYOC Logs index name (visible in the Datadog Log Explorer under BYOC INDEXES).

Querying BYOC Logs

To query logs stored in BYOC Logs indexes, use search_datadog_logs and specify your BYOC Logs index name in addition to your standard log query.

For best results, your prompt should also include:

• (Recommended) Time range (for example, “in the last hour”, “from the last 24 hours”).
• (Recommended) Query filters (service, status, log content).

Query parameters

The following table describes the key parameters used with search_datadog_logs:

For examples of parameter and natural language queries, see Advanced query examples.

Finding your BYOC Logs index name

To find your BYOC Logs index name:

1. Navigate to the Datadog Log Explorer.
2. Look for the BYOC INDEXES section in the left facet panel.
3. Your BYOC Logs indexes are listed there, in the format byoc--<cluster_name>--<index_name>.

You can also find your index names in the BYOC Logs console by selecting a cluster and clicking View Indexes.

Advanced query examples

When using AI-powered tools with search_datadog_logs, you can ask questions in natural language. The tool translates these into properly formatted BYOC Logs queries.

Error logs from a specific service

Prompt: “Show me error logs from the nginx service in the byoc–dev–main index in the last hour.”

Translates to:

{
  "query": "service:nginx status:error",
  "indexes": ["byoc--dev--main"],
  "from": "now-1h",
  "to": "now"
}

Search for specific log content

Prompt: “Find logs containing ‘connection timeout’ from the API service in byoc–prod–main from the last 24 hours.”

Translates to:

{
  "query": "service:api \"connection timeout\"",
  "indexes": ["byoc--prod--main"],
  "from": "now-24h",
  "to": "now"
}

Filter by HTTP status code

Prompt: “Get all 500 status code logs from the byoc–prod–main index in the last day.”

Translates to:

{
  "query": "status:500",
  "indexes": ["byoc--prod--main"],
  "from": "now-1d",
  "to": "now"
}

Important notes

• The indexes parameter must contain valid BYOC Logs index names (in the format byoc--<cluster_name>--<index_name>).
• When using natural language queries, explicitly mention your BYOC Logs index name in your prompt.
• BYOC Logs data is queryable in real-time as soon as it is indexed.
• Query syntax follows standard Datadog log search syntax.

Further reading

Additional helpful documentation, links, and articles:

Introducing the Datadog MCP serverBLOG Datadog Extension for VS Code & CursorDOCUMENTATION Search Logs in BYOC LogsDOCUMENTATION