datadog-ops

Files (1)

• SKILL.md

SKILL.md (first lines)

# Datadog Operations

Call Datadog REST APIs directly via `curl`. No MCP server or extra dependencies needed.

## Prerequisites

Three environment variables must be set:
- `DD_API_KEY` — Datadog API key
- `DD_APP_KEY` — Datadog Application key (required for reading data)
- `DD_SITE` — (optional) Datadog site, defaults to `datadoghq.com`. Common values: `datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`, `us5.datadoghq.com`, `ap1.datadoghq.com`

Before the first API call in a session, verify they exist:
```bash
test -n "$DD_API_KEY" && test -n "$DD_APP_KEY" && echo "OK" || echo "MISSING: set DD_API_KEY and DD_APP_KEY"
```

If missing, ask the user to set them. Do NOT proceed without them.

## Base URL

All endpoints use: `https://api.${DD_SITE:-datadoghq.com}`

## Auth Headers

All requests must include:
```
-H "DD-API-KEY: $DD_API_KEY" \
-H "DD-APPLICATION-KEY: $DD_APP_KEY"
```

## Core Operations

### 1. Search Logs (most common)

```bash
curl -s -X POST "https://api.${DD_SITE:-datadoghq.com}/api/v2/logs/events/search" \
  -H 'Content-Type: application/json' \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
  -d '{
    "filter": {
      "query": "service:my-service status:error",
      "from": "now-1h",
      "to": "now"
    },
    "sort": "-timestamp",
    "page": {
      "limit": 25
    }
  }' \
  | python3 -m json.tool
```

**Common log query syntax:**
| Filter | Example |
|--------|---------|
| By service | `service:my-service` |
| By status | `status:error`, `status:warn`, `status:info` |
| By host | `host:web-01` |
| By tag | `env:production`, `version:2.1` |
| Free text | `"connection timeout"` |
| Exclude | `-status:debug` |
| Combine | `service:api status:error "timeout"` |
| Wildcard | `service:payment*` |
| Facet | `@http.status_code:500` |

**Time range formats:**
- Relative: `now-15m`, `now-1h`, `now-1d`, `now-1w`
- Absolute ISO: `2024-01-15T10:00:00Z`

### 2. Search Logs with Aggregation

```bash
curl -s -X POST "https://api.${DD_SITE:-datadoghq.com}/api/v2/logs/analytics/aggregate" \
  -H 'Content-Type: application/json' \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
  -d '{
    "filter": {
      "query": "status:error",
      "from": "now-1h",
      "to": "now"
    },
    "compute": [
      { "aggregation": "count" }
    ],
    "group_by": [
      { "facet": "service", "limit": 10, "sort": { "aggregation": "count", "order": "desc" } }
    ]
  }' \
  | python3 -m json.tool
```

**Aggregation types:** `count`, `avg`, `sum`, `min`, `max`, `pc75`, `pc90`, `pc95`, `pc99`

**Common group_by facets:** `service`, `host`, `status`, `@http.status_code`, `@http.url_details.path`

### 3. Query Metrics

```bash
curl -s -G "https://api.${DD_SITE:-datadoghq.com}/api/v1/query" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
  --data-urlencode "query=avg:system.cpu.user{*} by {host}" \
  --data-urlencode "from=$(date -v-1H +%s)" \
  --data-urlencode "to=$(date +%s)" \
  | python3 -m json.tool
```

**Common metrics:**
| Metric | What |
|--------|------|
| `system.cpu.user` | Host CPU usage |
| `system.mem.used` | Memory used |
| `system.disk.used` | Disk used |
| `system.load.1` | Load average (1 min) |
| `trace.servlet.request.hits` | APM request count |
| `trace.servlet.request.duration` | APM request duration |
| `trace.servlet.request.errors` | APM error count |

From Ivlad003/plugins, MIT.

More from Ivlad003/plugins