datadog-cli_skill

Overview

This skill provides a Datadog CLI that helps search logs, query metrics, trace requests, and manage dashboards from the command line. It is designed for fast production debugging and observability workflows, giving agents and engineers a compact toolset for triage and investigation. Use it to gather context, correlate traces, and export results for reporting or automation.

How this skill works

The CLI issues Datadog API queries using the DD_API_KEY and DD_APP_KEY environment variables and supports site selection for non-US regions. Commands cover log search, real-time tailing, trace correlation, metric timeseries queries, error summaries, and CRUD operations for dashboards and lists. Global flags control human-readable output, JSON export, and time ranges, while specialized commands support aggregation, pattern detection, and period comparison.

When to use it

• Triage production incidents to quickly identify error spikes and affected services.
• Correlate distributed traces with log entries to follow request flows across services.
• Run ad-hoc metric queries when investigating resource or latency anomalies.
• Stream real-time logs during a deploy or live debug session.
• Generate JSON exports of queries for postmortems, reporting, or automated pipelines.

Best practices

• Set DD_API_KEY and DD_APP_KEY in a secure environment before running commands.
• Start with the errors overview and period comparison to determine scope and novelty.
• Use narrow queries (service, status, trace id) and then broaden as needed to avoid noise.
• Prefer --pretty for interactive work and --output for reproducible artifacts or automation.
• Read the query syntax and logs/metrics reference before crafting complex queries.

Example use cases

• Quickly list services with recent error activity and drill down to the top offenders.
• Tail API logs in real time while reproducing a bug on a staging or production replica.
• Find all log events related to a distributed trace id and collect surrounding context.
• Compare error counts between the last hour and the previous hour to detect regressions.
• Query avg:system.cpu.user over the last 1h to confirm a CPU spike coincides with increased errors.