Summary
Ask the incident question, not the query builder.
Logs and spans come back in the same conversation, and the span aggregation answers "which service is slow" without anything being exported to a notebook first.
What it is
A read layer over the Datadog API for three questions: what the logs say, what the trace spans say, and what the spans look like once grouped. Each search takes a query string and a time range given as UNIX timestamps, and pages through results with a cursor.
What you get
- Logs searched by query over a time range, returned with service, host, status, tags and the message, trimmed to a readable length
- The HTTP attributes pulled out beside each log line - method, URL, status code and error
- Trace spans searched the same way, with service, resource name, duration, host, environment and type
- Spans aggregated by a dimension you choose, so the answer comes back as a shape rather than a list
- Cursor paging, 25 results by default and up to 1,000 per page
- A default window of the last 15 minutes when you do not give one
Requirements
A Datadog account with API access, and its credentials supplied to the server through your client config. Searches run against Datadog's logs and spans APIs, so your own retention settings decide how far back a query can reach.
Setup effort
One command plus a key — npx -y datadog-mcp, then supply credentials