Datadog

Arcade toolkit · docs.arcade.dev

Datadog toolkit for Arcade provides LLM tools to search, aggregate, and inspect Datadog logs, APM spans, and traces programmatically. It enables AI agents to perform observability triage — identifying error patterns, latency trends, and trace-level diagnostics — directly against a Datadog account.

Capabilities

Log & span search: Query log events and APM spans over configurable time windows using Datadog search syntax.
Aggregation & bucketing: Aggregate events or spans by count, percentile, or other measures, optionally grouped by facets and bucketed by time — suited for triage questions like rising error rates or latency trends without paginating raw results.
Facet discovery: Probe which facets have live data in a given window and dataset before filtering or grouping, resolving environment-specific naming empirically (e.g. @http.status_code vs @http.status).
Trace inspection: Retrieve a single assembled trace with span summary, handling internal pagination to avoid oversized responses on large traces.

Secrets

This toolkit requires three secrets configured in your Arcade environment.

DATADOG_API_KEY — A Datadog API key that authenticates requests to the Datadog API. Generate one in the Datadog dashboard under Organization Settings → API Keys. API keys are not scoped; any valid key for your org works. See Datadog API Keys docs.
DATADOG_APPLICATION_KEY — A Datadog Application key, required alongside the API key to authorize read operations against logs, spans, and traces. Create one under Organization Settings → Application Keys. For least-privilege access, scope it to the specific permissions your agent needs (e.g. logs_read_data, apm_read). See Datadog Application Keys docs.
DATADOG_SITE — The Datadog site URL for your account (e.g. datadoghq.com, datadoghq.eu, us3.datadoghq.com). This determines which regional API endpoint the toolkit calls. Find your site in the Datadog dashboard URL or under Organization Settings. See Datadog site list.

Configure secrets at https://api.arcade.dev/dashboard/auth/secrets. For details on how Arcade handles secrets in tools, see https://docs.arcade.dev/en/guides/create-tools/tool-basics/create-tool-secrets.

Tools5

Datadog_AggregateEvents
Aggregate log events or spans over a window, optionally grouped and bucketed by time. Use this single call for triage questions like which service errors most, whether an error rate is rising, or whether a span's latency percentile is climbing (set aggregation to a percentile with measure '@duration' and an interval), instead of paginating raw events. For spans, group_by facets, query filters, and the returned bucket labels all use the same field names span results expose ('resource', 'operation'); the Datadog resource_name/operation_name facets are handled internally.
Datadog_DiscoverFacets
Probe which standard facets are groupable and filterable for a dataset in a window. Call this before grouping or filtering when the right facet name is uncertain, instead of guessing a name and reading an empty bucket set back: it returns the facets that actually have data to break down by right now, each with sample values. This resolves environment-specific naming (e.g. whether HTTP status is exposed as @http.status_code or @http.status) empirically rather than by guess.
Datadog_GetTrace
Retrieve a single trace assembled with a summary, bounding the span list. Pages through the trace's spans internally; an unknown trace id returns an empty trace. Use this single call to inspect a trace end to end without risking an oversized response on large traces.
Datadog_SearchLogs
Search Datadog log events matching a query over a time window.
Datadog_SearchSpans
Search Datadog APM spans matching a query over a time window.