dt-mcp-server: Skill for Claude Code

Log Analysis Skill

Query, filter, and analyze Dynatrace log data using DQL for troubleshooting and monitoring.

What This Skill Covers

• Fetching and filtering logs by severity, content, and entity
• Searching log messages using pattern matching
• Calculating error rates and statistics
• Analyzing log patterns and trends
• Grouping and aggregating log data by dimensions

When to Use This Skill

Use this skill when users want to:

• Find specific log entries (e.g., "show me error logs from the last hour")
• Filter logs by severity, process group, or content
• Search logs for specific keywords or phrases
• Calculate error rates or log statistics
• Identify common error messages or patterns
• Analyze log trends over time
• Troubleshoot issues using log data

Key Concepts

Log Data Model

• timestamp: When the log entry was created
• content: The log message text
• status: Log level (ERROR, FATAL, WARN, INFO, etc.)
• dt.process_group.id: Associated process group entity
• dt.process_group.detected_name: Resolves process group IDs to human-readable names

Query Patterns

• fetch logs: Primary command for log data access
• Time ranges: Use from:now() - <duration> for time windows
• Filtering: Apply severity, content, and entity filters
• Aggregation: Group and summarize log data
• Pattern Detection: Use matchesPhrase() and contains() for content search

Common Operations

• Severity filtering (single or multiple levels)
• Content search (simple and full-text)
• Entity-based filtering (process groups)
• Time-series analysis (bucketing, sorting)
• Error rate calculation
• Pattern analysis (exceptions, timeouts, etc.)

Core Workflows

1. Log Searching

Find specific log entries by time, severity, and content.

Typical steps:

1. Define time range
2. Filter by severity (optional)
3. Search content for keywords
4. Select relevant fields
5. Sort and limit results

Example:

fetch logs, from:now() - 1h
| filter status == "ERROR"
| fields timestamp, content, process_group = dt.process_group.detected_name
| sort timestamp desc
| limit 100