Events
Security Monitoring is now available Security Monitoring is now available

Events

An event represents any record of activity noteworthy for engineers (devs, ops, and security). See the developer documentation to learn about submitting events to Datadog.

Event stream

The event stream is a display of the most recent events generated by your infrastructure and the associated monitors.

Full text

Full text search works on all keywords provided in the search query after applying filters. Full text search looks inside the event text, title, tags, users who commented on the event, host names, and devices tied to the event.

Filters

Target specific event properties using these prefixes:

FilterDescription
sources:github,chefShow events from GitHub OR Chef.
tags:env-prod,dbShow events tagged with #env-prod OR #db.
hosts:i-0ade23e6,db.myapp.comShow events from i-0ade23e6 OR db.myapp.com.
status:errorShow events with an error status (supports: error, warning, success).
priority:lowShow only low-priority events (supports low or normal, defaults to all).

Note: Filters perform an exact match search. Partial strings are not considered.

Advanced

For a more advanced search, use the Datadog event query language, for example:

FilterDescription
tags:env-prod OR dbShow events tagged with #env-prod OR #db.
tags:security-group:sg-123 AND role:common-nodeShow events tagged with #security-group:sg-123 AND #role:common-node.
cloud_provider:* NOT "azure"Show all cloud providers except the ones tagged with “azure”.

Use tag search to find all events with the same key tag, for example:

FilterDescription
tags:<KEY>:<VALUE>Shows events with the <KEY>:<VALUE> tag.
<KEY>:*Shows all events with the <KEY> attached.
<KEY>:<REGEX>Shows all events with <KEY>:<VALUE> tag where the <VALUE> matches the <REGEX>.
tags:<KEY>This is not a valid search.
<KEY>:<VALUE>This is not a valid search.

To combine multiple terms into a complex query, use the following Boolean operators:

OperatorDescriptionExample
ANDIntersection: both terms are in the selected events (for tags, if nothing is added, AND is the default).redis_* AND down
ORUnion: either term is contained in the selected events. Use a comma (,) for tags.sources:nagios,chef directory OR Mixlib
NOTExclusion: the following term is NOT in the event. This operator works for strings only—use - in front of tags.-tags:<KEY>:<VALUE> NOT "<STRING>"

Note: Some of the advanced query language features like Boolean logic work only in the event stream page, and are not available in graph tiles or dashboard widgets.

Combine prefixes to construct more complex searches. For example, to find all open chef or nagios errors that mention cassandra, use:

sources:nagios,chef status:error cassandra

Note: Do not use spaces after the colon or commas in these lists. Anything not attached to a prefix goes to full text search.

Aggregation

By default, related events are aggregated when displayed in the events stream. To show unaggregated events, un-check the Aggregate related events box at the top right of your event stream:

Notifications

Datadog supports @notifications in the event stream, for example:

ExampleDescription
@support-datadogCreates a Datadog support ticket when posted directly to your event stream (including comments).
@allSends a notification to all members of your organization.
@johnNotifies the user named john.
@test@example.comSends an email to test@example.com.
@slack-<SLACK_ACCOUNT>-<CHANNEL_NAME>Posts the event or graph to the specified Slack channel.
@webhookAlerts or triggers the webhook. See the blog post on webhooks.
@pagerdutySends an alert to Pagerduty. You can also use @pagerduty-acknowledge and @pagerduty-resolve.

Further Reading

Additional helpful documentation, links, and articles: