Overview

Datadog automatically creates events from various products including monitors, Watchdog, and Error Tracking. You can also track events generated from the Agent and installed integrations and ingest events from sources, including alert events from third parties, change requests, deployments, configuration changes.

Event monitors alert on ingested events that match a search query, allowing you to focus attention on the events that matter most to your team.

Monitor creation

To create an event monitor in Datadog, navigate to Monitors > New Monitor > Event.

Define the search query

As you define the search query, the top graph updates.

1. Construct a search query using the Event Explorer search syntax.

2. Choose to monitor over an event count, facet, tags, or attributes:

   • Datadog evaluates the number of events over a selected time frame, then compares it to the threshold conditions.
   • For some attributes and tags, Datadog evaluates the aggregate values (for example, Avg, Median, Min, or Sum).
   • Monitor over a facet: If a facet is selected, the monitor alerts over the unique value count of the facet.

3. Group events by multiple dimensions (optional):

   All events matching the query are aggregated into groups based on the value of up to four event facets. When there are multiple dimensions, the top values are determined according to the first dimension, then according to the second dimension within the top values of the first dimension, and so on up to the last dimension. Dimensions limit depends on the total number of dimensions:

   • 1 facet: 1000 top values
   • 2 facets: 30 top values per facet (at most 900 groups)
   • 3 facets: 10 top values per facet (at most 1000 groups)
   • 4 facets: 5 top values per facet (at most 625 groups)

Set alert conditions

Trigger when the query meets one of the following conditions compared to a threshold value:

• above
• above or equal to
• below
• below or equal to
• equal to
• not equal to

Note: Some providers introduce a significant delay between when an event is posted, and when the event is initiated. In this case, Datadog back-dates the event to the time of occurrence, which could place an incoming event outside the current monitor evaluation window. Widening your evaluation window can help account for the time difference.

Advanced alert conditions

For detailed instructions on the advanced alert options (auto resolve, evaluation delay, etc.), see the Monitor configuration page.

Notifications

For detailed instructions on the Configure notifications & automations section, see the Notifications page.

Event template variables

Event monitors have specific template variables you can include in the notification message:

Tags key:value syntax

For the tags env:test, env:staging, and env:prod:

• env is the tag key.
• test, staging, and prod are the tag values.

The template variable is {{event.tags.env}}. The result of using this template variable is test, staging, or prod.

Notification aggregation

Configure the alert grouping strategy: * Simple-Alert: Simple alerts aggregate over all reporting sources. You receive one alert when the aggregated value meets the set conditions. This works best to monitor a metric from a single host or the sum of a metric across many hosts. This strategy may be selected to reduce notification noise. * Multi Alert: Multi alerts apply the alert to each source according to your group parameters, up to 1000 matching groups. An alerting event is generated for each group that meets the set conditions. For example, you can group by host to receive separate alerts for each host.

Further Reading

Additional helpful documentation, links, and articles:

Event Management OverviewDOCUMENTATION Configure your monitor notificationsDOCUMENTATION Schedule a downtime to mute a monitorDOCUMENTATION Check your monitor statusDOCUMENTATION