Datadog Skill

Query Datadog observability data via the API. Read-only access to logs, metrics, monitors, dashboards, hosts, APM, and incidents.

When to Use

Investigating production issues or outages
Checking monitor status and alert history
Searching logs for errors or patterns
Reviewing APM traces and service maps
Pulling metric data for dashboards
Checking host infrastructure status

Prerequisites

# Required environment variables
export DD_API_KEY="your-api-key"
export DD_APP_KEY="your-application-key"
export DD_SITE="datadoghq.com"  # or datadoghq.eu, us3.datadoghq.com, etc.

Usage

The bundled script provides a CLI interface to Datadog API endpoints:

# Search logs
npx tsx scripts/datadog.ts logs search --query "service:api error" --from 1h

# Get metrics
npx tsx scripts/datadog.ts metrics query --metric "system.cpu.user" --from 1h

# List monitors
npx tsx scripts/datadog.ts monitors list

# Get dashboard
npx tsx scripts/datadog.ts dashboards get --id abc-123

# List hosts
npx tsx scripts/datadog.ts hosts list

# APM traces
npx tsx scripts/datadog.ts traces list --service api --from 1h

Common Patterns

Incident Investigation

# 1. Check for firing monitors
npx tsx scripts/datadog.ts monitors list --status alert

# 2. Search error logs
npx tsx scripts/datadog.ts logs search --query "status:error" --from 30m

# 3. Check APM for slow traces
npx tsx scripts/datadog.ts traces list --service api --from 30m

Log Search Syntax

# By service
service:api-service

# By status
status:error OR status:warn

# By time range
@timestamp:[now-1h TO now]

# Combined
service:api-service status:error "timeout"

Metric Queries

# Simple metric
avg:system.cpu.user{host:my-host}

# By tag
avg:system.cpu.user{env:production}

# Rate
diff(avg:system.cpu.user{host:my-host})

Notes

All operations are read-only — no write or modify operations
API and application keys need appropriate scopes
Respect rate limits on high-volume queries
Use --from to limit time ranges (default: 1h)