메뉴
Search Datadog events from the command line. Use when the user wants to query events (deploys, alerts, custom events) or correlate events with logs from the terminal.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Search and export Datadog logs and RUM errors from the command line. Use when the user wants to query logs, query RUM (Real User Monitoring) errors, export data, or search Datadog from the terminal.
Query Datadog metrics from the command line. Use when the user wants to query metric data, view timeseries graphs, or inspect metric values from the terminal.
Query CI Visibility test events from Datadog. Use when the user wants to find failing CI tests, investigate test flakiness, or check test status on a branch.
Inspect Datadog monitors from the command line. Use when the user shares a Datadog monitor URL or wants to investigate a monitor alert — shows metadata, underlying metric chart, and monitor events.
Create, read, update, or manage Datadog notebooks. Use when the user wants to write a notebook, convert markdown to a Datadog notebook, read a notebook back as markdown, or when the user pastes a Datadog notebook URL (e.g. https://app.datadoghq.com/notebook/...).
Unfurl a Datadog dashboard, metric explorer, notebook, logs, or RUM URL (e.g. https://app.datadoghq.com/s/e16e18c08/yry-azg-bva) — resolve shared links, show widget/query details, and download the snapshot image. Use when the user pastes a Datadog dashboard, metric explorer, notebook, logs, RUM, or shared link and wants to understand what it shows.
| name | datadog-events |
| description | Search Datadog events from the command line. Use when the user wants to query events (deploys, alerts, custom events) or correlate events with logs from the terminal. |
The datadog events subcommand searches Datadog events using the V2 Events API and outputs each event as a JSON line. It paginates automatically with cursor-based pagination.
Run command -v datadog before use. If it is unavailable, install the local source with cargo install --path ~/code/datadog-cli/datadog.
Set these environment variables (or pass as flags):
export DD_API_KEY="your-api-key"
export DD_APPLICATION_KEY="your-app-key"
Keys can be managed at:
datadog events --time-range "last 1 hour"
datadog events --time-range "last 1 day" --query "source:deploy"
datadog events --time-range "last 4 hours" --limit 5
datadog events --time-range "last 1 day" --query "source:pagerduty" --sort-by oldest
By default, output includes timestamp, title, message plus all tags except common infrastructure noise (aws, kube, karpenter, security-group, etc.). This surfaces meaningful tags like env, event_type, commit_hash, pipeline_id, cluster_name, version.
To show only specific tags (whitelist mode), use --tags:
datadog events --time-range "last 1 day" --query "source:deploy" \
--tags "env,commit_hash,version"
To force-include an excluded infra tag, use --add-tags:
datadog events --time-range "last 1 day" --add-tags "pod_name,kube_namespace"
Use --all-tags to show everything including the full raw tags array:
datadog events --time-range "last 1 hour" --all-tags
If a search is cut off, the CLI prints the last cursor. Resume with --cursor:
datadog events --time-range "last 1 day" --cursor "eyJhZnRlciI6..."
| Flag | Required | Description |
|---|---|---|
--dd-api-key | Yes (or DD_API_KEY env) | Datadog API key |
--dd-application-key | Yes (or DD_APPLICATION_KEY env) | Datadog application key |
--time-range | Yes | Time range string, e.g. "last 1 day", "last 30 minutes" |
--query | No | Event search query (e.g. "source:deploy") |
--sort-by | No | Sort order: newest (default) or oldest |
--limit | Yes* | Maximum number of events to output (must be <= 100, or use --force) |
--force | No | Bypass the --limit <= 100 guard |
--cursor | No | Pagination cursor to resume a previous search |
--tags | No | Whitelist specific tags (omit to auto-show all non-infra tags) |
--add-tags | No | Force-include additional tags (even excluded infra tags) |
--all-tags | No | Output all event attributes and the full tags array |
*--limit must be <= 100 unless --force is used.
Each event is printed as a single-line JSON object with timestamp, title, message, plus non-infrastructure tag values:
{"timestamp":"2026-02-25T15:00:05+00:00","title":"Pipeline Started","message":"Pipeline Started","env":"production","event_type":"pipeline_started","commit_hash":"40d879be...","pipeline_id":"1257070","cluster_name":"eks-production-us-west-2-core-1","version":"0e4767ef...","service":"deploysv2","project":"multiplayer"}
Pipe to jq for further processing:
datadog events --time-range "last 1 day" --query "source:deploy" | jq '.title'
"last 15 minutes", "last 30 mins", "last 30m""last 1 hour", "last 4 hours", "last 1h""last 1 day", "last 7 days", "last 1d""last 1 week", "last 2 weeks", "last 1w""last 1 month", "last 6 months""last 1 year", "last 1y""2026-02-19T17:35:00Z to 2026-02-19T23:00:00Z"service:deploysv2When querying deploy events with service:deploysv2, the env and version tags are rejected if explicitly requested via --tags or --add-tags:
env is a Datadog reserved tag for the deploysv2 service environment, not the deploy targetversion is the deploysv2 service version, not the source commit — use commit_hash instead for the actual source SHA (for git log, etc.)# Recent deploy events for multiplayer in prod
datadog events --time-range "last 1 day" \
--query 'service:deploysv2 project:multiplayer env:production "Pipeline Started"'
# PagerDuty alerts in the last week with extra tags
datadog events --time-range "last 1 week" --query "source:pagerduty" \
--limit 50 --add-tags "service,version"
# All events in the last hour, oldest first, all tags
datadog events --time-range "last 1 hour" --sort-by oldest --all-tags
# Pipe to jq for filtering
datadog events --time-range "last 4 hours" | jq 'select(.event_type == "pipeline_started")'