Search Datadog logs from Slack incident reports
Give your team a fast path from an incident message to the logs that explain it.
Trigger
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Action
Search logs
Searches datadog logs with advanced filtering capabilities. important notes: - sort parameter is not supported by the datadog logs api and will cause errors - time parameters must be in milliseconds (13-digit unix timestamps) - limit parameter is passed as string to the api - log content is nested under 'content' field in api response useful for troubleshooting, monitoring application behavior, and analyzing log patterns.
Why this helps
Investigating an incident means copying timestamps, service names, and error text between Slack and Datadog.
- Reduce context switching during outages
- Surface matching errors quickly
- Keep investigation results in the team channel
Setup
Build it in a few focused steps.
- 1Connect Slackbot and Datadog in the Notis portal.
- 2Create a new automation and name it for incident log searches.
- 3Tell Notis to search Datadog logs using the service, error text, and time window from each channel message, then summarize matches.
- 4Choose Channel Message Received as the trigger and select a report channel.
- 5Test it with one real incident message.
Questions about this workflow
What details should the Slack message include?
Include the affected service, error or symptom, and an approximate time window when available.
Where does the result appear?
Notis posts the summarized Datadog log findings to your chosen report channel.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Slackbot to Datadog. A trigger fires from one place; an action lands in another.
Slackbot triggers
Datadog actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Create Dashboard
Create a dashboard in datadog. dashboards provide customizable visualizations for monitoring your infrastructure, applications, and business metrics in a unified view.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Create downtime
Creates a new downtime in datadog to suppress alerts during maintenance windows or planned outages. useful for preventing false alarms during deployments or maintenance.
New Channel Created Trigger
Triggered when a new channel is created in Slack.
Create event
Creates a new event in datadog. events are useful for tracking deployments, outages, configuration changes, and other important occurrences.
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Create monitor
Creates a new datadog monitor to track metrics, logs, or other data sources with configurable alerting thresholds and notifications.
Direct Message Received
Triggered when a new direct message (DM) is sent to a user in Slack. Catches all DMs across all DM channels.
Create SLO
Create a service level objective (slo) in datadog. slos help you define and track reliability targets for your services, enabling data-driven decisions about service quality and reliability investments.
Message Reaction Added
Triggered when a reaction is added to a message in Slack. Supports optional filtering by channel and emoji name.
Create Synthetic API Test
Create a synthetic api test in datadog. creates a new synthetic api test that continuously monitors api endpoints from multiple locations worldwide. useful for proactive monitoring of api uptime, performance, and functionality.
Message Reaction Removed
Triggered when a reaction is removed from a message in Slack. Supports optional filtering by channel and emoji name.
Create Webhook
Create a webhook in datadog. webhooks enable you to receive notifications from datadog monitors and alerts to external services and applications.
Reaction Added Trigger
DEPRECATED: use `SLACK_MESSAGE_REACTION_ADDED` instead. Triggered when a reaction is added to a message in Slack.
Delete Dashboard
Delete a dashboard in datadog. permanently removes a dashboard from your organization. this action cannot be undone. use with caution.
Connect any two apps with Notis in the middle.
Slackbot and Datadog, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Datadog.