dd-logs

dd-logs is a Datadog log-management skill that helps search, process, and archive logs with an emphasis on cost awareness, driven through Datadog's `pup` CLI. It solves the everyday observability problem of finding the right log data quickly while keeping indexing costs under control, giving the agent a token-efficient command order (check context, run a discovery command if a value is missing, confirm if ambiguous, then run the target command) so it avoids speculative calls that fail.

The skill documents log search syntax (full-text, tag and attribute matches, numeric ranges, boolean, and wildcard queries), configuration APIs for listing archives, restriction queries, and custom destinations, and pipeline processors such as grok-parser, status-remapper, and attribute-remapper. For cost control it covers exclusion filters for high-volume noise (health checks, debug logs, static assets, heartbeats), log-based metrics as a cheaper alternative to indexing, and S3 archive configuration for compliance retention. It also includes sensitive-data guidance — hash-remapper scrubbing rules and an application-side example that redacts credit card and SSN patterns before logs are sent.

It is aimed at platform, SRE, and DevOps engineers who use Datadog and want cost-conscious log workflows. The commands shown are predominantly read-only or list operations (search, archives list, metrics list/get) targeting pinned pup 0.42.0 behavior, and authentication is handled through the official `pup auth login`. Rehydration is deliberately deferred to the Datadog UI/API because no CLI command exists. This is a single-file catalogue-style skill that assumes pup is already installed per the upstream repository's setup instructions.