Datadog Automation

# Datadog Automation via Rube MCP

Automate Datadog monitoring and observability operations through Composio's Datadog toolkit via Rube MCP.

Prerequisites

- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)

- Active Datadog connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `datadog`

- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas

Setup

**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.

1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds

2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `datadog`

3. If connection is not ACTIVE, follow the returned auth link to complete Datadog authentication

4. Confirm connection status shows ACTIVE before running any workflows

Core Workflows

1. Query and Explore Metrics

**When to use**: User wants to query metric data or list available metrics

**Tool sequence**:

1. `DATADOG_LIST_METRICS` - List available metric names [Optional]

2. `DATADOG_QUERY_METRICS` - Query metric time series data [Required]

**Key parameters**:

- `query`: Datadog metric query string (e.g., `avg:system.cpu.user{host:web01}`)

- `from`: Start timestamp (Unix epoch seconds)

- `to`: End timestamp (Unix epoch seconds)

- `q`: Search string for listing metrics

**Pitfalls**:

- Query syntax follows Datadog's metric query format: `aggregation:metric_name{tag_filters}`

- `from` and `to` are Unix epoch timestamps in seconds, not milliseconds

- Valid aggregations: `avg`, `sum`, `min`, `max`, `count`

- Tag filters use curly braces: `{host:web01,env:prod}`

- Time range should not exceed Datadog's retention limits for the metric type

2. Search and Analyze Logs

**When to use**: User wants to search log entries or list log indexes

**Tool sequence**:

1. `DATADOG_LIST_LOG_INDEXES` - List available log indexes [Optional]

2. `DATADOG_SEARCH_LOGS` - Search logs with query and filters [Required]

**Key parameters**:

- `query`: Log search query using Datadog log query syntax

- `from`: Start time (ISO 8601 or Unix timestamp)

- `to`: End time (ISO 8601 or Unix timestamp)

- `sort`: Sort order ('asc' or 'desc')

- `limit`: Number of log entries to return

**Pitfalls**:

- Log queries use Datadog's log search syntax: `service:web status:error`

- Search is limited to retained logs within the configured retention period

- Large result sets require pagination; check for cursor/page tokens

- Log indexes control routing and retention; filter by index if known

3. Manage Monitors

**When to use**: User wants to create, update, mute, or inspect monitors

**Tool sequence**:

1. `DATADOG_LIST_MONITORS` - List all monitors with filters [Required]

2. `DATADOG_GET_MONITOR` - Get specific monitor details [Optional]

3. `DATADOG_CREATE_MONITOR` - Create a new monitor [Optional]

4. `DATADOG_UPDATE_MONITOR` - Update monitor configuration [Optional]

5. `DATADOG_MUTE_MONITOR` - Silence a monitor temporarily [Optional]

6. `DATADOG_UNMUTE_MONITOR` - Re-enable a muted monitor [Optional]

**Key parameters**:

- `monitor_id`: Numeric monitor ID

- `name`: Monitor display name

- `type`: Monitor type ('metric alert', 'service check', 'log alert', 'query alert', etc.)

- `query`: Monitor query defining the alert condition

- `message`: Notification message with @mentions

- `tags`: Array of tag strings

- `thresholds`: Alert threshold values (`critical`, `warning`, `ok`)

**Pitfalls**:

- Monitor `type` must match the query type; mismatches cause creation failures

- `message` supports @mentions for notifications (e.g., `@slack-channel`, `@pagerduty`)

- Thresholds vary by monitor type; metric monitors need `critical` at minimum

- Muting a monitor suppresses notifications but the monitor still evaluates

- Monitor IDs are numeric integers

4. Manage Dashboards

**When to use**: User wants to list, view, update, or delete dashboards

**Tool sequence**:

1. `DATADOG_LIST_DASHBOARDS` - List all dashboards [Req