Created
August 5, 2019 13:32
-
-
Save rhowardiv/d6ae821f7b2343266027ae832d768484 to your computer and use it in GitHub Desktop.
Datadog log export -- approach not viable due to rate limit (300 reqs/h)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
set -e | |
if [[ -z "$DD_APP_KEY" ]]; then | |
echo "I expect the Datadog app key in DD_APP_KEY" | |
exit | |
fi | |
if [[ -z "$DD_API_KEY" ]]; then | |
echo "I expect the Datadog API key in DD_API_KEY" | |
exit | |
fi | |
if [[ -z "$1" ]]; then | |
echo 'I expect a "from" date/time as my first argument.' | |
exit | |
fi | |
if [[ -z "$2" ]]; then | |
echo 'I expect a "to" date/time as my second argument.' | |
exit | |
fi | |
if [[ -z "$3" ]]; then | |
echo 'I expect a Datadog log query as my third argument' | |
exit | |
fi | |
nice_from="$1" | |
nice_to="$2" | |
from=$(( $(date -d "$nice_from" +%s) * 1000)) | |
to=$(( $(date -d "$nice_to" +%s) * 1000)) | |
query="$3" | |
d="$(jq -rc '.' <<EOF | |
{ | |
"query": "$query", | |
"time": { | |
"from": $from, | |
"to": $to | |
}, | |
"sort": "desc", | |
"limit": 1000 | |
} | |
EOF | |
)" | |
url="https://api.datadoghq.com/api/v1/logs-queries/list?api_key=${DD_API_KEY}&application_key=${DD_APP_KEY}" | |
#echo "BODY: $d" 1>&2 | |
check_for_errors() { | |
errors="$(cat | jq -r '.errors')" | |
if [[ "$errors" != "null" ]]; then | |
echo "$errors" | jq -r 'join("\n")' 1>&2 | |
exit 1 | |
fi | |
} | |
first="$(curl -s "$url" -H 'content-type: application/json' -d "$d")" | |
#echo "$first" 1>&2 | |
next_log_id="$( echo "$first" | jq -r '.nextLogId')" | |
echo "$first" | check_for_errors | |
just_stack() { | |
jq -r '.logs | map("\"" + (.content.attributes.msg.stack | join("\n")) + "\"") | join("\n")' | |
} | |
echo "$first" | just_stack | |
while [[ "$next_log_id" != "null" ]]; do | |
url="https://api.datadoghq.com/api/v1/logs-queries/list?api_key=${DD_API_KEY}&application_key=${DD_APP_KEY}" | |
d="$(jq '.' <<-EOF | |
{ | |
"query": "$query", | |
"time": { | |
"from": $from, | |
"to": $to | |
}, | |
"sort": "desc", | |
"startAt": "$next_log_id", | |
"limit": 1000 | |
} | |
EOF | |
)" | |
#echo "BODY: $d" 1>&2 | |
next="$(curl -s "$url" -H 'content-type: application/json' -d "$d")" | |
echo "$next" | check_for_errors | |
next_log_id="$( echo "$next" | jq -r '.nextLogId')" | |
echo "$next" | just_stack | |
echo "next_log_id: $next_log_id" 1>&2 | |
done |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment