https://github.com/faiscadev/ddlogs
A CLI tool for tailing and querying Datadog logs
https://github.com/faiscadev/ddlogs
Last synced: 3 months ago
JSON representation
A CLI tool for tailing and querying Datadog logs
- Host: GitHub
- URL: https://github.com/faiscadev/ddlogs
- Owner: faiscadev
- License: apache-2.0
- Created: 2025-12-26T12:57:18.000Z (6 months ago)
- Default Branch: main
- Last Pushed: 2026-01-21T12:09:56.000Z (5 months ago)
- Last Synced: 2026-02-05T14:42:56.667Z (5 months ago)
- Language: Rust
- Homepage:
- Size: 96.7 KB
- Stars: 3
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# ddlogs
A CLI tool for tailing and querying Datadog logs, similar to `tail -f` for your Datadog logs.
## Features
- 🔍 Query logs with filters (service, source, host)
- 👀 Follow mode for real-time log tailing
- ⚙️ Config file support for storing credentials
- 🌍 Multi-region Datadog support
- 📊 Single-line JSON output per log
- ⏱️ Respects Datadog API rate limits
## Installation
### Using Cargo
```bash
cargo install ddlogs
```
### Using install script
```bash
curl -fsSL https://raw.githubusercontent.com/faiscadev/ddlogs/main/install.sh | sh
```
### Download pre-built binaries
Download the latest release from [GitHub Releases](https://github.com/faiscadev/ddlogs/releases).
## Configuration
First, configure your Datadog credentials:
```bash
ddlogs configure
```
This will prompt you for:
- **Datadog API Key**
- **Datadog Application Key**
- **Datadog Site** (default: `datadoghq.com`)
Configuration is saved to `~/.config/ddlogs/config.toml`.
Alternatively, you can set environment variables:
```bash
export DD_API_KEY=your_api_key
export DD_APP_KEY=your_app_key
export DD_SITE=us5.datadoghq.com # optional, defaults to datadoghq.com
```
## Usage
### Basic log query (last hour)
```bash
ddlogs
```
### Filter by service
```bash
ddlogs --service web-api
```
### Filter by multiple criteria
```bash
ddlogs --service nginx --host prod-01 --limit 50
```
### Custom Datadog query
```bash
ddlogs --query "status:error"
ddlogs --query "service:nginx AND status:error"
```
### Follow mode (like `tail -f`)
```bash
ddlogs --follow
ddlogs -f --service email-api
```
### Custom polling interval
```bash
# Poll every 15 seconds instead of default 12
ddlogs -f --interval 15
```
### Query historical logs
```bash
# Last 24 hours
ddlogs --since 24h
# Last 7 days
ddlogs --since 7d --service api
# Specific time range (ISO 8601 format)
ddlogs --from 2024-01-15T00:00:00Z --to 2024-01-15T12:00:00Z
# Since a duration ago until a specific time
ddlogs --since 2d --to 2024-01-16T00:00:00Z
```
Supported duration units for `--since`: `s` (seconds), `m` (minutes), `h` (hours), `d` (days), `w` (weeks).
### Limit number of results
```bash
ddlogs --limit 50
```
### Pipe to jq for filtering
```bash
ddlogs --service api | jq -r '.content.message'
```
## Options
```
Usage: ddlogs [OPTIONS] [COMMAND]
Commands:
configure Configure ddlogs with API credentials and site
help Print this message or the help of the given subcommand(s)
Options:
-f, --follow Follow mode - continuously poll for new logs
--service Filter by service
--source Filter by source
--host Filter by host
-q, --query Raw Datadog query string
-l, --limit Number of logs to retrieve [default: 100]
--interval Poll interval in seconds for follow mode [default: 12]
--from Start time (ISO 8601, e.g., "2024-01-15T10:00:00Z")
--to End time (ISO 8601, e.g., "2024-01-15T11:00:00Z")
--since Relative time range (e.g., "1h", "30m", "7d", "2w")
-h, --help Print help
```
## Rate Limits
ddlogs respects Datadog's API rate limits:
- Default polling interval: **12 seconds** (300 requests/hour)
- Datadog allows **2 requests per 10 seconds** for log queries
- Adjust `--interval` if you hit rate limits
## Development
```bash
# Build
cargo build --release
# Run tests
cargo test
# Run clippy
cargo clippy
```
## License
Apache-2.0 License - see [LICENSE](LICENSE) file for details.
## Contributing
Contributions are welcome! Please feel free to submit a Pull Request.