dynatrace/dt-obs-logs
>- Log querying, filtering, pattern analysis, and error rate calculation. Use when searching application or infrastructure logs, analyzing error patterns, or correlating log data. "logs from last hour", "find log entries", "top error messages", "log patterns", "parse JSON logs", "logs by process group", "log trends over time", "log entry counts per minute". Do NOT use for explaining existing queries, product documentation questions, distributed tracing or span analysis (use dt-obs-tracing).
npx skills add https://github.com/Dynatrace/dynatrace-for-ai --skill dt-obs-logsQuery, filter, and analyze Dynatrace log data using DQL for troubleshooting and monitoring.
> Cross-source join required: If the query must combine logs with host attributes
> (OS type, hostname, IP address, cloud provider) → also read
> dt-dql-essentials/references/smartscape-topology-navigation.md before writing the query.
Use this skill when users want to:
from:now() - <duration> for time windowsmatchesPhrase() and contains() for content searchFind specific log entries by time, severity, and content.
Typical steps:
Example:
fetch logs, from:now() - 1h
| filter status == "ERROR"
| fields timestamp, content, process_group = dt.process_group.detected_name
| sort timestamp desc
| limit 100
Narrow down logs using multiple criteria (severity, entity, content).
Typical steps:
Example:
fetch logs, from:now() - 2h
| filter in(status, {"ERROR", "FATAL", "WARN"})
| summarize count(), by: {dt.process_group.id, dt.process_group.detected_name}
| fieldsAdd process_group = dt.process_group.detected_name
| sort `count()` desc
Identify patterns, trends, and anomalies in log data.
Typical steps:
Example:
fetch logs, from:now() - 2h
| filter status == "ERROR"
| fieldsAdd
has_exception = if(matchesPhrase(content, "exception"), true, else: false),
has_timeout = if(matchesPhrase(content, "timeout"), true, else: false)
| summarize
count(),
exception_count = countIf(has_exception == true),
timeout_count = countIf(has_timeout == true),
by: {process_group = dt.process_group.detected_name}
filter status == "ERROR" - Filter by status levelin(status, {"ERROR", "FATAL", "WARN"}) - Multi-status filter (use curly braces for literal sets)contains(content, "keyword") - Simple substring searchmatchesPhrase(content, "exact phrase") - Full-text phrase searchdt.process_group.detected_name - Get human-readable process group namefilter process_group == "service-name" - Filter by specific entitycount() - Count all log entriescountIf(condition) - Conditional countby: {dimension} - Group by entity or time bucketbin(timestamp, 5m) - Time bucketing for trendsfields timestamp, content, status - Select specific fieldsfieldsAdd name = expression - Add computed fieldsif(condition, true_value, else: false_value) - Conditional logicSimple substring search:
fetch logs, from:now() - 1h
| filter contains(content, "database")
| fields timestamp, content, status
Full-text phrase search:
fetch logs, from:now() - 1h
| filter matchesPhrase(content, "connection timeout")
| fields timestamp, content, process_group = dt.process_group.detected_name
Calculate error rates over time:
fetch logs, from:now() - 2h
| summarize
total_logs = count(),
error_logs = countIf(status == "ERROR"),
by: {time_bucket = bin(timestamp, 5m)}
| fieldsAdd error_rate = (error_logs * 100.0) / total_logs
| sort time_bucket asc
Find most common errors:
fetch logs, from:now() - 24h
| filter status == "ERROR"
| summarize error_count = count(), by: {content}
| sort error_count desc
| limit 20
Filter logs by process group:
fetch logs, from:now() - 1h
| fieldsAdd process_group = dt.process_group.detected_name
| filter process_group == "payment-service"
| filter status == "ERROR"
| fields timestamp, content, status
| sort timestamp desc
Many applications emit JSON-formatted log lines. Use parse to extract fields instead of dumping raw content:
fetch logs, from:now() - 1h
| filter status == "ERROR"
| parse content, "JSON:log"
| fieldsAdd level = log[level], message = log[msg], error = log[error]
| fields timestamp, level, message, error
| sort timestamp desc
| limit 50
Aggregate by a parsed field:
fetch logs, from:now() - 4h
| filter status == "ERROR"
| parse content, "JSON:log"
| fieldsAdd message = log[msg]
| summarize error_count = count(), by: {message}
| sort error_count desc
| limit 20
Notes:
parse content, "JSON:log" creates a record field log — access nested values with log[key]contains() before parse to reduce parsing overheadcontentfrom:now() - <duration> to limit datacontains() for simple, matchesPhrase() for exact| limit 100 to prevent overwhelming outputdt.process_group.detected_name or getNodeName() for human-readable outputbin(timestamp, 5m) for time-series analysisdt.process_group.id for service correlationbin() and time rangesmatchesPhrase()summarize and conditional functionsmatchesPhrase) may have performance implications on large datasets| Problem | Cause | Solution |
|---------|-------|----------|
| No logs returned | Missing time range or too narrow | Widen from: window; verify log ingestion is active |
| getNodeName() returns null | OneAgent not monitoring the entity or entity not yet resolved | Verify OneAgent is deployed and entity is discovered; use dt.process_group.detected_name as a reliable alternative |
| matchesPhrase() slow on large data | Full-text search without pre-filtering | Add filter status == "ERROR" before matchesPhrase() |
| Wrong field name log.level | Common mistake | Use loglevel (no dot) for severity; see dt-dql-essentials |
| Empty content field | Log line was empty or not ingested | Check log source configuration in OneAgent |
Take dynatrace/dt-obs-logs from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.