# Datadog: Search Logs

Retrieves Datadog log events matching a search query and time range, with configurable sort order and a maximum result limit.


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

Retrieve logs from Datadog using search queries and filters.

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

<br />

| Name             | Description                                                                                                                                                                                                                                                        |
| :--------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connection Input | Select a [Workflow Integration](/ai-automation/automation/incident-workflows/workflow-integrations) or click **New Datadog Connection** to establish a new one. For US1 region, this will be the search log url: [https://api.datadoghq.com/api/v2/logs/events/search](https://api.datadoghq.com/api/v2/logs/events/search). |
| Query            | The search query string for logs.                                                                                                                                                                                                                                  |
| Start Time       | Select a value from the dropdown. This represents the logs start time. Default value '`Past 1 Hour`.                                                                                                                                                               |
| End Time         | Select a value from the dropdown. This represents the logs end time. Default value `Now`.                                                                                                                                                                          |
| Sort             | Sort order for the logs. Default value: `timestamp descending`.                                                                                                                                                                                                    |
| Limit            | The maximum number of events in the response.                                                                                                                                                                                                                      |

## Outputs

| Name             | Description                                                                         |
| :--------------- | :---------------------------------------------------------------------------------- |
| Logs             | The JSON array of log entries that were retrieved.                                  |
| Log Count        | Total number of matching logs returned.                                             |
| Query Used       | The processed query string that was sent to Datadog.                                |
| Time Range Start | The start time used for the search.                                                 |
| Time Range End   | The end time used for the search.                                                   |
| Has More Results | Whether there are more results available for pagination.                            |
| Next Page Token  | Token for retrieving the next page of results.                                      |
| Search Duration  | API response time in milliseconds.                                                  |
| Result           | Value that shows if the action was successful or not. Either "Success" or "Failed". |
| Result Summary   | Brief description of what the action did or if it failed.                           |
| Error            | Brief description if the action failed.                                             |