Datadog Skill

Query Datadog observability data via the API. Read-only access to logs, metrics, monitors, dashboards, hosts, APM, and incidents.

When to Use

• Investigating production issues or outages
• Checking monitor status and alert history
• Searching logs for errors or patterns
• Reviewing APM traces and service maps
• Pulling metric data for dashboards
• Checking host infrastructure status

Prerequisites

# Required environment variables
export DD_API_KEY="your-api-key"
export DD_APP_KEY="your-application-key"
export DD_SITE="datadoghq.com"  # or datadoghq.eu, us3.datadoghq.com, etc.

Usage

The bundled script provides a CLI interface to Datadog API endpoints:

# Search logs
npx tsx scripts/datadog.ts logs search --query "service:api error" --from 1h

# Get metrics
npx tsx scripts/datadog.ts metrics query --metric "system.cpu.user" --from 1h

# List monitors
npx tsx scripts/datadog.ts monitors list

# Get dashboard
npx tsx scripts/datadog.ts dashboards get --id abc-123

# List hosts
npx tsx scripts/datadog.ts hosts list

# APM traces
npx tsx scripts/datadog.ts traces list --service api --from 1h

Common Patterns

Incident Investigation

# 1. Check for firing monitors
npx tsx scripts/datadog.ts monitors list --status alert

# 2. Search error logs
npx tsx scripts/datadog.ts logs search --query "status:error" --from 30m

# 3. Check APM for slow traces
npx tsx scripts/datadog.ts traces list --service api --from 30m

Log Search Syntax

# By service
service:api-service

# By status
status:error OR status:warn

# By time range
@timestamp:[now-1h TO now]

# Combined
service:api-service status:error "timeout"

Metric Queries

# Simple metric
avg:system.cpu.user{host:my-host}

# By tag
avg:system.cpu.user{env:production}

# Rate
diff(avg:system.cpu.user{host:my-host})

Notes

• All operations are read-only — no write or modify operations
• API and application keys need appropriate scopes
• Respect rate limits on high-volume queries
• Use --from to limit time ranges (default: 1h)