Datadog

Connect Datadog to CloudThinker for log search, metric queries, infrastructure monitoring, and incident investigation

Connect your Datadog account to enable CloudThinker agents to search logs, query metrics, monitor infrastructure, and investigate incidents across your entire stack. Datadog authenticates with an API key and a scoped Application key pair.

---

Supported platforms

Site	URL
US1	app.datadoghq.com
US3	us3.datadoghq.com
US5	us5.datadoghq.com
EU1	app.datadoghq.eu
AP1	ap1.datadoghq.com
AP2	ap2.datadoghq.com

GovCloud (US1-FED) is not supported by the Datadog MCP server.

---

Prerequisites

You need a Datadog API key and a scoped Application key.

Create an API key:

1. Go to Organization Settings → API Keys in your Datadog account.
2. Click + New Key, name it (e.g., CloudThinker), and save.
3. Copy the key value.

Create a scoped Application key:

1. Go to Organization Settings → Application Keys.
2. Click + New Key, name it (e.g., CloudThinker).
3. Under Scopes, select the permissions listed in Required permissions.
4. Save and copy the key value.

Always use scoped Application keys instead of unscoped ones. An unscoped key inherits all permissions from the user who created it.

---

Setup

1. Open CloudThinker

   Navigate to Connections → Datadog in your CloudThinker workspace.

2. Select your Datadog site

   Choose the Datadog site that matches your account (e.g., US1 for datadoghq.com, EU1 for datadoghq.eu).

3. Enter your API key

   Paste your Datadog API key.

4. Enter your Application key

   Paste your Datadog Application key.

5. Connect

   Click Connect. CloudThinker verifies the credentials and shows a Connected status.

---

Connection details

Field	Description	Example
Site	Datadog site matching your account	US1 (datadoghq.com)
API Key	Datadog API key	—
Application Key	Datadog Application key with explicit scopes	—

---

Required permissions

Select these scopes when creating your Application key. Read scopes cover all investigation tools; notebooks_write is optional and enables notebook creation.

Scope	What it enables
logs_read_data, logs_read_index_data	Search and analyze logs
metrics_read, timeseries_query	Query metrics and time-series data
monitors_read	Search monitors by status and tag
incidents_read	Search incidents and get details
dashboards_read	Inspect dashboard configurations
hosts_read	List and inspect infrastructure hosts
apm_read	Retrieve traces and search APM spans
apm_service_catalog_read	List services and map dependencies
events_read	Search platform and custom events
notebooks_read	Search and retrieve investigation notebooks
rum_apps_read	Search Real User Monitoring data
notebooks_write	Create and edit investigation notebooks (optional)

Start with read scopes only. Add notebooks_write only for workflows where agents need to create investigation notebooks.

---

Agent capabilities

Once connected, agents can perform read and write operations across your Datadog environment.

Capability	What the agent can do
Logs	Search logs across services and environments, analyze patterns and trends
Metrics	Search available metrics, query time-series data, retrieve metric metadata
Monitors	Find monitors by status, name, or tag
Incidents	Search active and resolved incidents, get full incident details
Dashboards	Search and inspect dashboard configurations
Infrastructure	List and inspect hosts across your infrastructure
APM	Retrieve distributed traces, search spans for latency analysis
Service catalog	List services and map service dependency relationships
Events	Search platform and custom events
Notebooks	Search, retrieve, create, and edit investigation notebooks
RUM	Search Real User Monitoring data
Connection health	Validate that the Datadog connection is working

Notebook write operations require user approval before execution.

Verify the connection

@alex run the Datadog connection health check and summarize active monitors and host count

Example prompts

@alex search for error logs in the production environment from the last 15 minutes
@alex check for active Datadog incidents and investigate root causes
@alex analyze APM traces for the checkout service and identify latency bottlenecks

---

Troubleshooting

Connection test fails with 403

Verify your API key is valid and not revoked. Confirm your Application key has the required scopes and that both keys belong to the same Datadog organization.

Missing data after connecting

Check that your Application key scopes include the data type you are querying (e.g., logs_read_data for logs). Verify your Datadog retention settings and confirm the service or host is actively sending data.

Wrong Datadog site selected

If queries return empty results, you may have selected the wrong site. Check your Datadog URL — app.datadoghq.com is US1, us3.datadoghq.com is US3, app.datadoghq.eu is EU1. Disconnect and reconnect with the correct site.

API key vs Application key confusion

Both keys are required and serve different roles. The API key authenticates requests. The Application key controls which Datadog features and data the agent can access. One alone is not sufficient.

---

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Scoped Application keys — always specify explicit scopes; an unscoped key inherits the creating user’s full permissions.
• Separate keys per integration — create dedicated API and Application keys for CloudThinker so you can revoke them independently.

---

Related

Grafana Connection

Alternative metrics and dashboards

PagerDuty Connection

Incident alerting and on-call