Skip to content

Instantly share code, notes, and snippets.

@rhowardiv
Created August 5, 2019 13:32
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rhowardiv/d6ae821f7b2343266027ae832d768484 to your computer and use it in GitHub Desktop.
Save rhowardiv/d6ae821f7b2343266027ae832d768484 to your computer and use it in GitHub Desktop.
Datadog log export -- approach not viable due to rate limit (300 reqs/h)
#!/bin/bash
set -e
if [[ -z "$DD_APP_KEY" ]]; then
echo "I expect the Datadog app key in DD_APP_KEY"
exit
fi
if [[ -z "$DD_API_KEY" ]]; then
echo "I expect the Datadog API key in DD_API_KEY"
exit
fi
if [[ -z "$1" ]]; then
echo 'I expect a "from" date/time as my first argument.'
exit
fi
if [[ -z "$2" ]]; then
echo 'I expect a "to" date/time as my second argument.'
exit
fi
if [[ -z "$3" ]]; then
echo 'I expect a Datadog log query as my third argument'
exit
fi
nice_from="$1"
nice_to="$2"
from=$(( $(date -d "$nice_from" +%s) * 1000))
to=$(( $(date -d "$nice_to" +%s) * 1000))
query="$3"
d="$(jq -rc '.' <<EOF
{
"query": "$query",
"time": {
"from": $from,
"to": $to
},
"sort": "desc",
"limit": 1000
}
EOF
)"
url="https://api.datadoghq.com/api/v1/logs-queries/list?api_key=${DD_API_KEY}&application_key=${DD_APP_KEY}"
#echo "BODY: $d" 1>&2
check_for_errors() {
errors="$(cat | jq -r '.errors')"
if [[ "$errors" != "null" ]]; then
echo "$errors" | jq -r 'join("\n")' 1>&2
exit 1
fi
}
first="$(curl -s "$url" -H 'content-type: application/json' -d "$d")"
#echo "$first" 1>&2
next_log_id="$( echo "$first" | jq -r '.nextLogId')"
echo "$first" | check_for_errors
just_stack() {
jq -r '.logs | map("\"" + (.content.attributes.msg.stack | join("\n")) + "\"") | join("\n")'
}
echo "$first" | just_stack
while [[ "$next_log_id" != "null" ]]; do
url="https://api.datadoghq.com/api/v1/logs-queries/list?api_key=${DD_API_KEY}&application_key=${DD_APP_KEY}"
d="$(jq '.' <<-EOF
{
"query": "$query",
"time": {
"from": $from,
"to": $to
},
"sort": "desc",
"startAt": "$next_log_id",
"limit": 1000
}
EOF
)"
#echo "BODY: $d" 1>&2
next="$(curl -s "$url" -H 'content-type: application/json' -d "$d")"
echo "$next" | check_for_errors
next_log_id="$( echo "$next" | jq -r '.nextLogId')"
echo "$next" | just_stack
echo "next_log_id: $next_log_id" 1>&2
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment