753 Query Syntax Fa60d601

Name: 753 Query Syntax Fa60d601
Author: tools-only

ASecurity

| Operator | Example | Description | |----------|---------|-------------| | `AND` | `service:api status:error` | Both conditions (implicit) | | `OR` | `status:error OR status:warn` | Either condition | | `-` | `-status:info` | Exclude | | `*` | `service:api-*` | Wildcard | | `>=` `<=` | `@http.status_code:>=400` | Numeric comparison | | `[TO]` | `@duration:[1000 TO 5000]` | Range |

9 stars
0 votes
0 copies
0 views
Added October 11, 2026

toolsbashapi

Works with

Security analysis

A100/100

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 753-query-syntax_fa60d601 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 753 Query Syntax Fa60d601?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 753 Query Syntax Fa60d601

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-753-query-syntax-fa60d601/badge)](https://www.skillsdirectory.com/skills/tools-only-753-query-syntax-fa60d601)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md

# Datadog Query Syntax

## Operators

| Operator | Example | Description |
|----------|---------|-------------|
| `AND` | `service:api status:error` | Both conditions (implicit) |
| `OR` | `status:error OR status:warn` | Either condition |
| `-` | `-status:info` | Exclude |
| `*` | `service:api-*` | Wildcard |
| `>=` `<=` | `@http.status_code:>=400` | Numeric comparison |
| `[TO]` | `@duration:[1000 TO 5000]` | Range |

## Common Attributes

| Attribute | Description |
|-----------|-------------|
| `service` | Service name |
| `status` | Log level (error, warn, info, debug) |
| `host` | Hostname |
| `@http.status_code` | HTTP status code |
| `@http.method` | HTTP method |
| `@http.url` | Request URL |
| `@error.kind` | Error type |
| `@error.message` | Error message |
| `@trace_id` | Trace ID |
| `@dd.trace_id` | Datadog trace ID |

## Time Formats

### Relative
- `1m` - 1 minute
- `30m` - 30 minutes
- `1h` - 1 hour
- `6h` - 6 hours
- `24h` - 24 hours
- `7d` - 7 days

### Absolute
- ISO 8601: `2024-01-15T10:30:00Z`

## Example Queries

```bash
# All errors
status:error

# Errors in specific service
service:api status:error

# 5xx HTTP errors
@http.status_code:>=500

# Exclude info logs
-status:info

# Multiple services
service:api OR service:payment

# Timeout errors
error:timeout OR @error.kind:TimeoutError

# Slow requests (>1s)
@duration:>=1000
```