Download logs from DataDog API

search.sh

#!/bin/bash
DATADOG_API_KEY=ZZZ
DATADOG_APP_KEY=ZZZ
FILENAME=output
INDEX=0

response=$(curl -L -X POST "https://api.datadoghq.com/api/v2/logs/events/search" \
  -H "Content-Type: application/json" \
  -H "DD-API-KEY: $DATADOG_API_KEY" \
  -H "DD-APPLICATION-KEY: $DATADOG_APP_KEY" --data-raw '{
  "filter": {
    "from": "2022-01-05T22:30:00-03:00",
    "to": "2022-01-05T22:40:00-03:00",
    "query": "kube_namespace:ig-core-prod updated-payable-successfully"
  },
  "page": {
    "limit": 500
  }
}')

echo $response | jq . > "${FILENAME}.${INDEX}.log"

cursor=$(echo $response | jq -r .meta.page.after)

echo "Cursor: ${cursor}"

((INDEX=INDEX+1))

while [ "${cursor}" != "null" ]
do
    data='{
    "filter": {
        "from": "2022-01-05T22:30:00-03:00",
        "to": "2022-01-05T22:40:00-03:00",
        "query": "kube_namespace:ig-core-prod updated-payable-successfully"
    },
    "page": {
        "cursor": "{{cursor}}",
        "limit": 500
    }
    }'

    data=$(echo $data | sed "s/{{cursor}}/$cursor/")

    response=$(curl -L -X POST "https://api.datadoghq.com/api/v2/logs/events/search" \
    -H "Content-Type: application/json" \
    -H "DD-API-KEY: $DATADOG_API_KEY" \
    -H "DD-APPLICATION-KEY: $DATADOG_APP_KEY" \
    --data-raw "$data")

    echo $response | jq . > "${FILENAME}.${INDEX}.log"

    cursor=$(echo $response | jq -r .meta.page.after)

    echo "Cursor: ${cursor}"

    ((INDEX=INDEX+1))
done

Hi, need help to filter data by a specific field (customerId). If you know how I can write syntax for the same in filter then do share the knowledge. It would be very helpful. Thank You.