# Datadog

Use when the user says "check Datadog", "查 Datadog", "查日志", "check logs", "crash logs"...

- Repository: https://github.com/nexu-io/nexu (3280 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-04-26
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add nexu-io/nexu --skill datadog -g -a claude-code -y`
Codex: `npx skills add nexu-io/nexu --skill datadog -g -a codex -y`
Cursor: `npx skills add nexu-io/nexu --skill datadog -g -a cursor -y`
Gemini CLI: `npx skills add nexu-io/nexu --skill datadog -g -a gemini-cli -y`

## Description

Use when the user says "check Datadog", "查 Datadog", "查日志", "check logs", "crash logs", "查 crash", "gateway crash", "查告警", "check alerts", "check metrics", or needs to investigate production issues via Datadog Logs API.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Datadog Log Investigation

Query Datadog Logs API to investigate production issues for the Nexu platform.

## Authentication

**Before making any Datadog API call, you MUST ask the user for these two keys:**

- `DD_API_KEY`, Datadog API Key (Organization Settings → API Keys)
- `DD_APP_KEY`, Datadog Application Key (Organization Settings → Application Keys, requires `logs_read_data` scope)

Store them in shell variables for the session. Never hardcode or commit them.

Site: `datadoghq.com` (US)

## API Base

All requests go to `https://api.datadoghq.com/api/v2/logs/events/search`.

Headers:
```
DD-API-KEY: <api_key>
DD-APPLICATION-KEY: <app_key>
Content-Type: application/json
```

## Common Queries

### OpenClaw Crash Events

```bash
curl -s "https://api.datadoghq.com/api/v2/logs/events/search" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": {
      "query": "service:nexu-gateway @event:openclaw_crash",
      "from": "now-1h",
      "to": "now"
    },
    "sort": "-timestamp",
    "page": {"limit": 20}
  }'
```

Key fields in results:
- `attributes.attributes.exitCode`, process exit code (1 = fatal error, null = signal)
- `attributes.attributes.signal`, kill signal (SIGKILL, SIGTERM, etc.)
- `attributes.tags` → `pod_name`, `image_tag`, which pod and which version

### OpenClaw stderr Output (Crash Details)

```bash
curl -s "https://api.datadoghq.com/api/v2/logs/events/search" \
  -H "DD-API-KEY: $DD_API_KEY" \
  -H "DD-APPLICATION-KEY: $DD_APP_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": {
      "query": "service:nexu-gateway @stream:stderr",
      "from": "now-1h",
      "to": "now"
    },
    "sort": "-timestamp",
    "page": {"limit": 50}
  }'
```

This shows the actual error output from the OpenClaw process (e.g., `invalid_auth`, `EADDRINUSE`, config validation failures).

### Gateway Startup / Recovery Events

The rest: https://github.com/nexu-io/nexu/blob/HEAD/skills/localdev/datadog/SKILL.md