Datadog
Arcade.dev LLM tools for Datadog log and trace search
0.1.0Datadog toolkit for Arcade provides LLM tools to search, aggregate, and inspect Datadog logs, APM spans, and traces programmatically. It enables AI agents to perform observability triage — identifying error patterns, latency trends, and trace-level diagnostics — directly against a Datadog account.
Capabilities
- Log & span search: Query log events and APM spans over configurable time windows using Datadog search syntax.
- Aggregation & bucketing: Aggregate events or spans by count, percentile, or other measures, optionally grouped by facets and bucketed by time — suited for triage questions like rising error rates or latency trends without paginating raw results.
- Facet discovery: Probe which facets have live data in a given window and dataset before filtering or grouping, resolving environment-specific naming empirically (e.g.
@http.status_codevs@http.status). - Trace inspection: Retrieve a single assembled trace with span summary, handling internal pagination to avoid oversized responses on large traces.
Secrets
This toolkit requires three secrets configured in your Arcade environment.
-
DATADOG_API_KEY— A Datadog API key that authenticates requests to the Datadog API. Generate one in the Datadog dashboard under Organization Settings → API Keys. API keys are not scoped; any valid key for your org works. See Datadog API Keys docs. -
DATADOG_APPLICATION_KEY— A Datadog Application key, required alongside the API key to authorize read operations against logs, spans, and traces. Create one under Organization Settings → Application Keys. For least-privilege access, scope it to the specific permissions your agent needs (e.g.logs_read_data,apm_read). See Datadog Application Keys docs. -
DATADOG_SITE— The Datadog site URL for your account (e.g.datadoghq.com,datadoghq.eu,us3.datadoghq.com). This determines which regional API endpoint the toolkit calls. Find your site in the Datadog dashboard URL or under Organization Settings. See Datadog site list.
Configure secrets at https://api.arcade.dev/dashboard/auth/secrets. For details on how Arcade handles secrets in tools, see https://docs.arcade.dev/en/guides/create-tools/tool-basics/create-tool-secrets.
Available tools(5)
| Tool name | Description | Secrets | |
|---|---|---|---|
Aggregate log events or spans over a window, optionally grouped and bucketed by time.
Use this single call for triage questions like which service errors most, whether an
error rate is rising, or whether a span's latency percentile is climbing (set
aggregation to a percentile with measure '@duration' and an interval), instead of
paginating raw events. For spans, group_by facets, query filters, and the returned
bucket labels all use the same field names span results expose ('resource',
'operation'); the Datadog resource_name/operation_name facets are handled internally. | 2 | ||
Probe which standard facets are groupable and filterable for a dataset in a window.
Call this before grouping or filtering when the right facet name is uncertain,
instead of guessing a name and reading an empty bucket set back: it returns the
facets that actually have data to break down by right now, each with sample
values. This resolves environment-specific naming (e.g. whether HTTP status is
exposed as @http.status_code or @http.status) empirically rather than by guess. | 2 | ||
Retrieve a single trace assembled with a summary, bounding the span list.
Pages through the trace's spans internally; an unknown trace id returns an
empty trace. Use this single call to inspect a trace end to end without
risking an oversized response on large traces. | 2 | ||
Search Datadog log events matching a query over a time window. | 2 | ||
Search Datadog APM spans matching a query over a time window. | 2 |