Query Datadog observability data via the API. Read-only access to logs, metrics, monitors, dashboards, hosts, APM, and incidents.
When to Use
- Investigating production issues or outages
- Checking monitor status and alert history
- Searching logs for errors or patterns
- Reviewing APM traces and service maps
- Pulling metric data for dashboards
- Checking host infrastructure status
Prerequisites
# Required environment variables
export DD_API_KEY="your-api-key"
export DD_APP_KEY="your-application-key"
export DD_SITE="datadoghq.com" # or datadoghq.eu, us3.datadoghq.com, etc.
Usage
The bundled script provides a CLI interface to Datadog API endpoints:
# Search logs
npx tsx scripts/datadog.ts logs search --query "service:api error" --from 1h
# Get metrics
npx tsx scripts/datadog.ts metrics query --metric "system.cpu.user" --from 1h
# List monitors
npx tsx scripts/datadog.ts monitors list
# Get dashboard
npx tsx scripts/datadog.ts dashboards get --id abc-123
# List hosts
npx tsx scripts/datadog.ts hosts list
# APM traces
npx tsx scripts/datadog.ts traces list --service api --from 1h
Common Patterns
Incident Investigation
# 1. Check for firing monitors
npx tsx scripts/datadog.ts monitors list --status alert
# 2. Search error logs
npx tsx scripts/datadog.ts logs search --query "status:error" --from 30m
# 3. Check APM for slow traces
npx tsx scripts/datadog.ts traces list --service api --from 30m
Log Search Syntax
# By service
service:api-service
# By status
status:error OR status:warn
# By time range
@timestamp:[now-1h TO now]
# Combined
service:api-service status:error "timeout"
Metric Queries
# Simple metric
avg:system.cpu.user{host:my-host}
# By tag
avg:system.cpu.user{env:production}
# Rate
diff(avg:system.cpu.user{host:my-host})
Notes
- All operations are read-only — no write or modify operations
- API and application keys need appropriate scopes
- Respect rate limits on high-volume queries
- Use
--fromto limit time ranges (default: 1h)