Security Monitoring is now available Security Monitoring is now available



Recommended for expert users only.

Appending the .rollup() function at the end of a query allows you to perform custom time aggregation, i.e. this function enables you to define:

The function takes two parameters, <METHOD> and <TIME>: .rollup(<METHOD>,<TIME>).

<METHOD>Can be sum/min/max/count/avg and defines how data points are aggregated within a given time interval.
<TIME>Time (in seconds) of the interval between two data points displayed.

You can use them individually or together, for instance .rollup(sum,120). The following bar graph displays a week’s worth of CPU usage for a host without using the .rollup() function:

The following bar graph displays the same metric, graphed using a day-long rollup with .rollup(avg,86400):

Rollup Interval: Enforced vs Custom

When graphing, Datadog imposes a limit of 350 points per graph. In order to respect this limit, Datadog rolls up data points automatically with the avg method, effectively displaying the average of all data points within a time interval for a given metric.

A custom .rollup() function can be used to enforce the type of time aggregation applied (avg, min, max, count, or sum) and the time interval to rollup. However, if a custom .rollup() function is applied and uses a smaller time interval than the Datadog limit, the Datadog limit is used instead while still using the specified rollup method. For example, if you’re requesting .rollup(20) for a month-long window, data is returned at a rollup greater than 20 seconds in order to prevent returning more than 350 points.

Note: Queries for COUNT and RATE type metrics have the .as_count() modifier appended automatically in the UI, which sets the rollup method used to sum and disables interpolation. This .as_count() is explicitly visible at the end of the query:

For more details about how to use .as_count() and .as_rate() see the blog post or learn more about the effects of those functions with the documentation on in-application modifiers.

Rollups in monitors

Rollups should usually be avoided in monitor queries, because of the possibility of misalignment between the rollup interval and the evaluation window of the monitor. The start and end of rollup intervals are aligned to UNIX time, not to the start and end of monitor queries. Therefore, a monitor may evaluate (and trigger on) an incomplete rollup interval containing only a small sample of data. To avoid this issue, delay the evaluation of your monitor by (at least) the length of the setup rollup interval.

Other functions