菜单
Query Datadog logs, monitors, and observability data via pup CLI. Trigger on log queries, error rates, monitor status, or production investigations — even if Datadog isn't named.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Bring changes from a source branch into a target branch when a plain git merge is not enough: re-apply each logical change freshly against the target branch's current state, verify it independently, and double-check at the end. Use when the user says "backfill merge", "/backfill-merge", "re-apply changes onto another branch after merging", or describes merging a branch where each feature must be reconstructed against the target rather than trusted from the merged diff.
Batch all open Dependabot/Renovate PRs into a consolidated batch branch, deduplicating by package, merging each branch, then closing the individual PRs with a comment. Works on any Prometheum repo (boats, cows, ...). Trigger when the user says "run dep batch", "batch dependencies", or "consolidate renovate/dependabot PRs".
Feature-work loop: attempt the whole feature as a loose throwaway spike, measure the diff, and if it exceeds the line threshold (~1500) recursively decompose into atomic, reviewable tasks built by parallel agents. Trigger on "draw the owl", "/draw-the-owl", or open-ended feature implementation you want kept reviewable.
Teach the user a new skill or concept, within this workspace.
Execute read-only PostgreSQL queries across local, QA, UAT, and prod environments for the Prometheum platform. Knows all connection strings and enforces read-only mode on all non-localhost connections. Use when investigating data issues, verifying DB state, or querying boats/platform databases as part of an investigation.
Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".
基于 SOC 职业分类
| name | datadog |
| version | 1.0.0 |
| description | Query Datadog logs, monitors, and observability data via pup CLI. Trigger on log queries, error rates, monitor status, or production investigations — even if Datadog isn't named. |
| argument-hint | [logs|monitors] [query or service name] |
pup is Datadog's official CLI (from datadog-labs). It provides full access to the Datadog API including logs, monitors, metrics, and more. It authenticates via OAuth2+PKCE and stores tokens in macOS Keychain.
Run these checks in order before executing any pup command. Do all three in a single Bash call to keep it fast.
which pup && pup --version && pup auth status 2>&1
Tell the user and offer to install:
brew tap datadog-labs/pack && brew install datadog-labs/pack/pup
Check the status field in the auth output. If it's not valid, or authenticated is false, run:
pup auth login
This opens a browser for OAuth2 login. The user must complete the flow interactively. Wait for them to confirm before proceeding. If the token is valid but expiring soon (< 5 minutes), proactively refresh:
pup auth refresh
Before running any log query, check if the user specified a time range. If they didn't, use AskUserQuestion:
How far back should I search?
1. 15m — last 15 minutes
2. 1h — last hour (default)
3. 4h — last 4 hours
4. 1d — last day
Use the selected value as the --from flag. If the user already specified a range in their request, skip the question and use it directly.
pup has several log commands. Choose based on what the user needs:
| Command | Use when |
|---|---|
pup logs search | Fetching individual log lines to read (v1 API, up to 1000 results) |
pup logs query | Same but v2 API, default 50 results |
pup logs aggregate | Counting, grouping, or computing stats — never fetch all logs just to count them |
pup logs search --query '<query>' --from '<time>' --limit <n>
Flags:
--query (required): Datadog log query syntax--from: Start time — relative (15m, 1h, 4h, 1d, 7d) or absolute (RFC3339). Default: 1h--to: End time. Default: now--limit: Max results, 1-1000. Default: 50--sort: asc or desc (default: desc, newest first)--index: Comma-separated index names--storage: indexes, online-archives, or flexservice:boats-api # by service
env:prod # by environment
status:error # by log level
host:ip-10-* # wildcard match
@http.status_code:>=500 # attribute filter
service:boats-api env:prod status:error # AND (space-separated)
service:boats-api OR service:trading-backend # OR
-status:info # NOT (exclude)
"exact phrase match" # exact match
Use aggregation instead of fetching raw logs when the user wants counts or distributions:
# Count errors by service in the last hour
pup logs aggregate --query 'status:error' --from '1h' --compute count --group-by service
# Count logs per environment
pup logs aggregate --query '*' --from '4h' --compute count --group-by env
Flags:
--compute: count (default), or a metric expression--group-by: Field to group results by--limit: Max groups (default: 10)# Errors across all prod services
pup logs search --query 'env:prod status:error' --from '1h' --limit 50
# Specific service logs
pup logs search --query 'service:boats-api env:prod' --from '15m'
# Specific cluster
pup logs search --query 'cluster_name:procap-prod-prod status:error' --from '1h'
# Trading backend warnings and errors
pup logs search --query 'service:trading-backend status:(warn OR error)' --from '30m'
# List all monitors (up to 200)
pup monitors list
# Filter by name substring
pup monitors list --name 'boats'
# Filter by tags
pup monitors list --tags 'env:prod,team:backend'
# Increase limit
pup monitors list --limit 500
pup monitors search --query '<search term>'
pup monitors search --query 'boats-api' --per-page 50
pup monitors get <monitor-id>
pup outputs JSON by default. Use jq to extract specific fields when the output is large:
# Just log messages
pup logs search --query 'status:error' --from '1h' | jq '.data[].attributes.message'
# Monitor names and status
pup monitors list | jq '.data[] | {name: .name, status: .overall_state}'
For human-readable table output:
pup logs search --query 'status:error' --from '1h' --output table
15m, 1h) and widen only if needed — large ranges are slowpup logs aggregate for counts instead of fetching all logs and counting locally--tags to filter rather than listing all and parsing locallypup auth login