Skip to main content

Overview

Connecting Datadog lets Rootly AI query your Datadog data during investigations — logs, metrics, traces, dashboards, monitors, and Datadog incidents. You point Rootly at your Datadog site, authorize, and Rootly AI can start querying.
This integration is for Rootly AI investigation context — it’s how Rootly AI reads Datadog data during investigations. It’s independent of any Datadog Alert Source you may already have configured to ingest Datadog alerts into Rootly. The two configurations don’t overlap; you can (and often should) have both.

Before You Start

You’ll need:
  • A Datadog account with permission to authorize third-party access. In most organizations this means an admin or someone with API-key-management permissions.
  • Your Datadog site — the deployment region your Datadog account is on: US1, US3, US5, EU1, US1-FED, or AP1. If you’re not sure which one, check your Datadog login URL — the subdomain (app.datadoghq.com, app.datadoghq.eu, etc.) maps to the site.

Connecting

Open Configuration → AI → Connectors and click Connect on the Datadog card.
Datadog Site
dropdown
required
Select the deployment region your Datadog account lives on:
  • US1app.datadoghq.com (default US)
  • US3us3.datadoghq.com
  • US5us5.datadoghq.com
  • EU1app.datadoghq.eu
  • US1-FEDapp.ddog-gov.com (Datadog for Government)
  • AP1ap1.datadoghq.com (Asia-Pacific)
Selecting the wrong site sends Rootly’s queries to a region that doesn’t contain your data.
Click Connect Datadog. Rootly redirects to Datadog’s authorization flow — sign in if needed, review the requested access, and approve. Datadog sends you back to Rootly, and the card flips to Connected.

What Rootly AI Can Read

Once connected, Rootly AI can query Datadog for:
  • Logs — search and filter across your ingested log streams.
  • Metrics — query any metric via Datadog’s metric query language, including custom metrics.
  • Traces — inspect APM traces for services under investigation.
  • Dashboards — Rootly AI can look up dashboard configurations to correlate what humans typically monitor with what’s happening in the incident.
  • Monitors — list monitors, check their state (OK, WARN, ALERT, NO DATA), and pull alert conditions.
  • Datadog Incidents — Rootly AI can correlate its own incident context with any incidents you have open in Datadog’s incident management feature.
Access is scoped by the roles and permissions on the authorizing Datadog account.

Best Practices

  • Authorize with a service account, not a personal one. If a personal Datadog account leaves the organization, the integration silently breaks the next time it’s queried. A service account with stable membership avoids that.
  • Verify site selection before authorizing. Wrong-site is the #1 setup failure. Double-check the Datadog site against your actual Datadog URL before hitting Connect.
  • Combine with Datadog as an Alert Source. If your team uses Datadog for alerting, having it configured both as a connector and as an Alert Source gives you the full picture — alerts ingest into Rootly, AI reads Datadog context during investigation. The two configurations don’t conflict.
  • Restrict Datadog roles thoughtfully. Rootly AI inherits whatever the authorizing user can see. If certain hosts, services, or dashboards need to be off-limits to AI, use Datadog’s own role-based access controls to restrict the authorizing account.
  • Test with /rootly test. After connecting, declare a test incident and confirm Rootly AI can pull Datadog signals during the investigation.

Troubleshooting

Common causes: (1) the authorizing user doesn’t have permission to grant third-party access in Datadog — check with a Datadog admin; (2) your organization has restricted third-party grants at the workspace level — contact your Datadog admin.
You authorized against a Datadog region that doesn’t contain your data — for example, selecting US1 when your account is on EU1. Disconnect the integration, reconnect against the correct site, and re-authorize. There’s no way to migrate a wrong-site connection; you have to disconnect and start over.
Datadog role-based access restrictions on the authorizing account. Rootly AI can only see what the authorizing user can see. If a specific service or environment isn’t visible, check the user’s Datadog role and add the necessary permissions.
Rare, but possible during high-frequency investigation prompts. Rootly AI’s calls count against your Datadog account’s API rate limits. If you see this consistently, contact support.
They’re independent. The connector doesn’t touch your Datadog Alert Source configuration. If Alert Source ingestion stopped at the same time, the cause is unrelated — check the Alert Source’s own settings and Datadog’s webhook delivery.

Frequently Asked Questions

No. They’re separate configurations serving different purposes.Alert Source ingests Datadog monitor alerts as Rootly alerts — data flows Datadog → Rootly.Connector lets Rootly AI query Datadog during investigations — data flows Datadog → Rootly AI, on demand.Most teams want both.
One Datadog connector per Rootly team currently. If you operate multiple Datadog accounts, connect the one that hosts most of your observability signal.
No. Rootly AI queries Datadog fresh on each investigation call. Datadog’s own caching still applies on their side.
Yes. Datadog’s audit logs record third-party API activity. Filter by the Rootly AI app to see the full call history.
Yes. Investigation-driven query volume is typically low — a handful of calls per investigation. Rate limits are rarely a concern for typical use.
In practice, Rootly AI reaches for logs and monitors most often — logs for narrative context, monitors for “what already knows this is broken.” Metric queries come next; dashboards and traces are more situational.

Connectors Overview

The full list of Connectors and how they fit together.

Datadog Alert Source

The other Datadog integration — ingesting Datadog monitor alerts into Rootly as alerts. Independent of this AI integration.

Data Privacy for Rootly AI

What Rootly AI sees, retention, and model-training controls.