Datadog
Arcade.dev LLM tools for Datadog log and trace search
2.0.1Datadog toolkit for Arcade enables LLMs to search, aggregate, and inspect Datadog logs and APM traces programmatically — no OAuth required; access is controlled entirely via API credentials.
Capabilities
- Log search & aggregation: Query log events by filter and time window; aggregate results by count, percentile, or other statistics, optionally grouped into time buckets — useful for triage without paginating raw events.
- APM span search & aggregation: Search spans across services and operations; aggregate latency percentiles or error rates grouped by facets such as resource or operation name.
- Trace inspection: Retrieve a complete, pre-assembled trace summary by trace ID, with internal pagination over spans to avoid oversized responses.
- Facet discovery: Probe which groupable/filterable facets actually have data in a given window, resolving environment-specific naming (e.g.
@http.status_codevs@http.status) before committing to a query.
Secrets
All three secrets are required to authenticate and route requests to your Datadog organization.
-
DATADOG_API_KEY— A Datadog API key that authenticates the request. Create one in your Datadog organization under Organization Settings → API Keys (Datadog docs). Any role can generate an API key, but the key inherits the permissions of the user who created it. -
DATADOG_APPLICATION_KEY— A Datadog Application key that scopes which APIs the request may call. Create one under Organization Settings → Application Keys (Datadog docs). Application keys carry the permissions of their owner, so use a service account or a key scoped to the minimum required endpoints (Logs Read, APM Read). -
DATADOG_SITE— The regional Datadog intake hostname for your organization (e.g.datadoghq.com,datadoghq.eu,us3.datadoghq.com). Find your site in the Datadog UI under Organization Settings → Overview, or see the Datadog site list. If omitted or wrong, all API calls will route to the incorrect region and fail.
Store all three secrets in Arcade as described in the Arcade secrets guide. You can manage stored secrets at https://api.arcade.dev/dashboard/auth/secrets.
Available tools(5)
| Tool name | Description | Secrets | |
|---|---|---|---|
Aggregate log events or spans over a window, optionally grouped and bucketed by time.
Use this single call for triage questions like which service errors most, whether an
error rate is rising, or whether a span's latency percentile is climbing (set
aggregation to a percentile with measure '@duration' and an interval), instead of
paginating raw events. For spans, group_by facets, query filters, and the returned
bucket labels all use the same field names span results expose ('resource',
'operation'); the Datadog resource_name/operation_name facets are handled internally. | 2 | ||
Retrieve a single trace assembled with a summary, bounding the span list.
Pages through the trace's spans internally; an unknown trace id returns an
empty trace. Use this single call to inspect a trace end to end without
risking an oversized response on large traces. | 2 | ||
Probe which standard facets are groupable and filterable for a dataset in a window.
Call this before grouping or filtering when the right facet name is uncertain,
instead of guessing a name and reading an empty bucket set back: it returns the
facets that actually have data to break down by right now, each with sample
values. This resolves environment-specific naming (e.g. whether HTTP status is
exposed as @http.status_code or @http.status) empirically rather than by guess. | 2 | ||
Search Datadog log events matching a query over a time window. | 2 | ||
Search Datadog APM spans matching a query over a time window. | 2 |