Datadog cli

Skill softaworks/agent-toolkit/dist/plugins/datadog-cli/skills/datadog-cli

Datadog CLI for searching logs, querying metrics, tracing requests, and managing dashboards. Use this when debugging production issues or working with Datadog observability.From its SKILL.md

Install

npx -y skills add softaworks/agent-toolkit --skill datadog-cli

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

reads credentialsReads from 2 credential sources: `DD_API_KEY` and 1 more.
runs commandsInstructs the agent to run 8 commands, including `npx @leoflores/datadog-cli <command>` and 7 more.

SKILL.md

3.4 KB, 960 tokens by cl100k_base, as published. Nobody here has run it

Datadog CLI

A CLI tool for AI agents to debug and triage using Datadog logs and metrics.

Required Reading

You MUST read the relevant reference docs before using any command:

Setup

Environment Variables (Required)

export DD_API_KEY="your-api-key"
export DD_APP_KEY="your-app-key"

Get keys from: https://app.datadoghq.com/organization-settings/api-keys

Running the CLI

npx @leoflores/datadog-cli <command>

For non-US Datadog sites, use --site flag:

npx @leoflores/datadog-cli logs search --query "*" --site datadoghq.eu

Commands Overview

Command	Description
`logs search`	Search logs with filters
`logs tail`	Stream logs in real-time
`logs trace`	Find logs for a distributed trace
`logs context`	Get logs before/after a timestamp
`logs patterns`	Group similar log messages
`logs compare`	Compare log counts between periods
`logs multi`	Run multiple queries in parallel
`logs agg`	Aggregate logs by facet
`metrics query`	Query timeseries metrics
`errors`	Quick error summary by service/type
`services`	List services with log activity
`dashboards`	Manage dashboards (CRUD)
`dashboard-lists`	Manage dashboard lists

Quick Examples

Search Errors

npx @leoflores/datadog-cli logs search --query "status:error" --from 1h --pretty

Tail Logs (Real-time)

npx @leoflores/datadog-cli logs tail --query "service:api status:error" --pretty

Error Summary

npx @leoflores/datadog-cli errors --from 1h --pretty

Trace Correlation

npx @leoflores/datadog-cli logs trace --id "abc123def456" --pretty

Query Metrics

npx @leoflores/datadog-cli metrics query --query "avg:system.cpu.user{*}" --from 1h --pretty

Compare Periods

npx @leoflores/datadog-cli logs compare --query "status:error" --period 1h --pretty

Global Flags

Flag	Description
`--pretty`	Human-readable output with colors
`--output <file>`	Export results to JSON file
`--site <site>`	Datadog site (e.g., `datadoghq.eu`)

Time Formats

Relative: 30m, 1h, 6h, 24h, 7d
ISO 8601: 2024-01-15T10:30:00Z

Incident Triage Workflow

# 1. Quick error overview
npx @leoflores/datadog-cli errors --from 1h --pretty

# 2. Is this new? Compare to previous period
npx @leoflores/datadog-cli logs compare --query "status:error" --period 1h --pretty

# 3. Find error patterns
npx @leoflores/datadog-cli logs patterns --query "status:error" --from 1h --pretty

# 4. Narrow down by service
npx @leoflores/datadog-cli logs search --query "status:error service:api" --from 1h --pretty

# 5. Get context around a timestamp
npx @leoflores/datadog-cli logs context --timestamp "2024-01-15T10:30:00Z" --service api --pretty

# 6. Follow the distributed trace
npx @leoflores/datadog-cli logs trace --id "TRACE_ID" --pretty

See workflows.md for more debugging workflows.

What ships with it: 6 files

17.3 KB alongside SKILL.md

references/

README.md2.5 KB

Gives 0 of the 12 instructions most log analysis skills give in 960 tokens

Counted across 325 of the 341 authors here whose files we hold, read 2026-09-06

Use structured JSON loggingin 32 of 325, across 30 files
Link every alert to a runbookin 15 of 325, across 13 files
Alert on symptoms, not causesin 11 of 325, across 10 files
Include correlation IDs in every log linein 10 of 325
Propagate trace context across service boundariesin 9 of 325, across 8 files
Include request IDs for correlationin 8 of 325, across 6 files
Include trace_id in every structured log entryin 8 of 325, across 7 files
Include request and user context in every log entryin 8 of 325
Correlate logs and traces with shared trace IDin 7 of 325, across 6 files
Record exceptions and set span status on errorsin 7 of 325
Confirm connection is ACTIVE before running workflowsin 6 of 325, across 3 files
Call RUBE_SEARCH_TOOLS first for current schemasin 6 of 325, across 3 files

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.