Connect Claude to Datadog

Return individual log events matching a Datadog log search query, newest first. Use this when you need the actual lines around an incident; use aggregate_logs when you want counts, rates or a breakdown instead, because a raw search of a noisy service will fill a context window without answering the question. Time bounds accept Datadog's relative syntax (now-15m, now-1h) as well as ISO 8601.

Count or measure logs instead of listing them, optionally broken down by a facet. This is the right first call for "how many errors, by service, in the last hour" - it returns a handful of buckets rather than thousands of lines. Follow up with search_logs on the worst bucket to read the actual events.

Evaluate a Datadog metric query over a time window and return the points. The query uses Datadog's own syntax, e.g. "avg:system.cpu.user{env:prod} by {host}" or "sum:trace.http.request.errors{service:checkout}.as_rate()". Call list_metrics first if you do not know the exact metric name. Timestamps are epoch milliseconds.

List the metric names that have reported since a point in time, so query_timeseries can be given a name that actually exists. `from` is epoch SECONDS, not milliseconds, and is required by Datadog - pass the start of the period you care about.

List monitors with their current alert state, which is the fastest way to see what is alerting right now. Returns the numeric monitor ids that get_monitor, mute_monitor and unmute_monitor need. Filter with name for a substring of the monitor title, or tags for the scope a monitor watches.

Fetch one monitor by its numeric id: its query, thresholds, notification message, current state and per-group states. Call list_monitors first to find the id. Use this before muting anything, so the mute is applied to the monitor you meant.

Search the Datadog event stream - deploys, monitor transitions, integration events and anything posted through the events intake. Use it to line an alert up against a deployment. Reverse it with a query like "source:github" or "tags:service:checkout". Time bounds accept Datadog's relative syntax.

List Datadog incidents newest first, with their state, severity and commander. Use it to see what is currently declared before deciding whether an alert is already being handled, then pass an id to get_incident. Requires the Incident Management product and an application key with incident_read.

Fetch one incident by its UUID: title, state, severity, timeline fields, and the users attached to it. Call list_incidents first for the id. Pass include to pull related records back in the same call rather than making a second one.

List dashboards with their ids, titles and authors. Use it to find the dashboard id that get_dashboard needs; the widget definitions are not included here.

Fetch one dashboard by id, including its widget definitions and the metric queries behind them. This is the quickest way to learn which queries a team already trusts for a service - read the widgets, then re-run one through query_timeseries. Deeply nested widget groups are trimmed.

List hosts reporting to Datadog with their tags, apps and mute status. Hosts seen in the last three hours are returned by default; pass `from` as epoch seconds to widen that. Use it to confirm whether a host stopped reporting at all, which no metric query can tell you.