Events

Events

An event represents any record of activity noteworthy for engineers (devs, ops, and security). See the developer documentation to learn about submitting events to Datadog.

Event stream

The event stream is a display of the most recent events generated by your infrastructure and the associated monitors.

Event stream

The event stream is a display of the most recent events generated by your infrastructure and the associated monitors.

Events explorer

The events explorer is a display of the most recent events generated by your infrastructure and the associated monitors. You can customize the columns displayed by using the Options button to the top right of the events.

Events explorer

The events explorer is a display of the most recent events generated by your infrastructure and the associated monitors. You can customize the columns displayed by using the Options button to the top right of the events.

Full text

Full text search works on all keywords provided in the search query after applying filters. Full text search looks inside the event text, title, tags, users who commented on the event, host names, and devices tied to the event.

Filters

Target specific event properties using these prefixes:

sources:github,chef
Show events from GitHub OR Chef.
tags:env-prod,db
Show events tagged with #env-prod OR #db.
hosts:i-0ade23e6,db.myapp.com
Show events from i-0ade23e6 OR db.myapp.com.
status:error
Show events with an error status (supports: error, warning, success).
priority:low
Show only low-priority events (supports low or normal, defaults to all).
sources:github,chef
Show events from GitHub OR Chef.
tags:env-prod,db
Show events tagged with #env-prod OR #db.
hosts:i-0ade23e6,db.myapp.com
Show events from i-0ade23e6 OR db.myapp.com.
status:error
Show events with an error status (supports: error, warning, success).
priority:low
Show only low-priority events (supports low or normal, defaults to all).
source:github,chef
Show events from GitHub OR Chef.
host:i-0ade23e6,db.myapp.com
Show events from i-0ade23e6 OR db.myapp.com.
service:kafka
Show events from the kafka service.
status:error
Show events with an error status (supports: error, warning, success).
role:
availability-zone:us-east-1a
Show events in the us-east-1a AWS availability zone (AZ).
container_id:foo
Show events from the container with the ID foo.
@evt.name:foo
Show the event named foo.
source:github,chef
Show events from GitHub OR Chef.
host:i-0ade23e6,db.myapp.com
Show events from i-0ade23e6 OR db.myapp.com.
service:kafka
Show events from the kafka service.
status:error
Show events with an error status (supports: error, warning, success).
role:
availability-zone:us-east-1a
Show events in the us-east-1a AWS availability zone (AZ).
container_id:foo
Show events from the container with the ID foo.
@evt.name:foo
Show the event named foo.

Note: Filters perform an exact match search. Partial strings are not considered.

Context

Build up a context to explore your events on the Events Explorer page by selecting the proper time range, then use the search bar to filter your events and analytics.

Facets and measures

After collection, your event attributes can be indexed as facets or measures. On the left side, use facets and measures to filter your results. You can create new facets or measures from existing event tags or attributes.

A facet displays all the distinct members of an attribute or a tag and provides some basic analytics, such as the number of events represented. Facets allow you to pivot or filter your datasets based on a given attribute. To filter, select the values that you want to see. To start using an attribute as a facet, click on it and use the option to Create facet. The value of this attribute is stored for all new events.

A measure is an attribute with a numerical value contained in your event. To start using an attribute as a measure, click on a numerical attribute and use the option to Create measure. The value of this attribute is stored for all new events.

Saved views

Use saved views to automatically configure your events explorer with a preselected set of facets, measures, searches, time ranges, and visualizations. Check the dedicated saved views documentation to learn more.

Context

Build up a context to explore your events on the Events Explorer page by selecting the proper time range, then use the search bar to filter your events and analytics.

Facets and measures

After collection, your event attributes can be indexed as facets or measures. On the left side, use facets and measures to filter your results. You can create new facets or measures from existing event tags or attributes.

A facet displays all the distinct members of an attribute or a tag and provides some basic analytics, such as the number of events represented. Facets allow you to pivot or filter your datasets based on a given attribute. To filter, select the values that you want to see. To start using an attribute as a facet, click on it and use the option to Create facet. The value of this attribute is stored for all new events.

A measure is an attribute with a numerical value contained in your event. To start using an attribute as a measure, click on a numerical attribute and use the option to Create measure. The value of this attribute is stored for all new events.

Saved views

Use saved views to automatically configure your events explorer with a preselected set of facets, measures, searches, time ranges, and visualizations. Check the dedicated saved views documentation to learn more.

Advanced

For a more advanced search, use the Datadog event query language, for example:

tags:env-prod OR db
Show events tagged with #env-prod OR #db.
tags:security-group:sg-123 AND role:common-node
Show events tagged with #security-group:sg-123 AND #role:common-node.
cloud_provider:* NOT "azure"
Show all cloud providers except the ones tagged with “azure”.

Use tag search to find all events with the same key tag, for example:

tags:<KEY>:<VALUE>
Shows events with the <KEY>:<VALUE> tag.
<KEY>:*
Shows all events with the <KEY> attached.
<KEY>:<REGEX>
Shows all events with <KEY>:<VALUE> tag where the <VALUE> matches the <REGEX>.
tags:<KEY>
This is not a valid search.
<KEY>:<VALUE>
This is not a valid search.

To combine multiple terms into a complex query, use the following Boolean operators:

AND
Intersection: both terms are in the selected events (for tags, if nothing is added, AND is the default).
Example: redis_* AND down
OR
Union: either term is contained in the selected events. Use a comma (,) for tags.
Example: sources:nagios,chef directory OR Mixlib
NOT
Exclusion: the following term is NOT in the event. This operator works for strings only—use - in front of tags.
Example: -tags:<KEY>:<VALUE> NOT "<STRING>"

Note: Some of the advanced query language features like Boolean logic work only in the event stream page, and are not available in graph tiles or dashboard widgets.

Combine prefixes to construct more complex searches. For example, to find all open chef or nagios errors that mention cassandra, use:

sources:nagios,chef status:error cassandra

Note: Do not use spaces after the colon or commas in these lists. Anything not attached to a prefix goes to full text search.

Advanced

For a more advanced search, use the Datadog event query language, for example:

tags:env-prod OR db
Show events tagged with #env-prod OR #db.
tags:security-group:sg-123 AND role:common-node
Show events tagged with #security-group:sg-123 AND #role:common-node.
cloud_provider:* NOT "azure"
Show all cloud providers except the ones tagged with “azure”.

Use tag search to find all events with the same key tag, for example:

tags:<KEY>:<VALUE>
Shows events with the <KEY>:<VALUE> tag.
<KEY>:*
Shows all events with the <KEY> attached.
<KEY>:<REGEX>
Shows all events with <KEY>:<VALUE> tag where the <VALUE> matches the <REGEX>.
tags:<KEY>
This is not a valid search.
<KEY>:<VALUE>
This is not a valid search.

To combine multiple terms into a complex query, use the following Boolean operators:

AND
Intersection: both terms are in the selected events (for tags, if nothing is added, AND is the default).
Example: redis_* AND down
OR
Union: either term is contained in the selected events. Use a comma (,) for tags.
Example: sources:nagios,chef directory OR Mixlib
NOT
Exclusion: the following term is NOT in the event. This operator works for strings only—use - in front of tags.
Example: -tags:<KEY>:<VALUE> NOT "<STRING>"

Note: Some of the advanced query language features like Boolean logic work only in the event stream page, and are not available in graph tiles or dashboard widgets.

Combine prefixes to construct more complex searches. For example, to find all open chef or nagios errors that mention cassandra, use:

sources:nagios,chef status:error cassandra

Note: Do not use spaces after the colon or commas in these lists. Anything not attached to a prefix goes to full text search.

Advanced

For a more advanced search, use the Datadog log query language. See the Log Search Syntax documentation for more details.

To combine multiple terms into a complex query, use the following Boolean operators:

AND
Intersection: both terms are in the selected events (for tags, if nothing is added, AND is the default).
Example: redis_* AND down
OR
Union: either term is contained in the selected events. Use a comma (,) for tags.
Example: sources:nagios,chef directory OR Mixlib
NOT
Exclusion: the following term is NOT in the event. This operator works for strings only—use - in front of tags.
Example: -tags:<KEY>:<VALUE> NOT "<STRING>"

Advanced

For a more advanced search, use the Datadog log query language. See the Log Search Syntax documentation for more details.

To combine multiple terms into a complex query, use the following Boolean operators:

AND
Intersection: both terms are in the selected events (for tags, if nothing is added, AND is the default).
Example: redis_* AND down
OR
Union: either term is contained in the selected events. Use a comma (,) for tags.
Example: sources:nagios,chef directory OR Mixlib
NOT
Exclusion: the following term is NOT in the event. This operator works for strings only—use - in front of tags.
Example: -tags:<KEY>:<VALUE> NOT "<STRING>"

Aggregation

By default, related events are aggregated when displayed in the events stream. To show unaggregated events, un-check the Aggregate related events box at the top right of your event stream:

Aggregation

By default, related events are aggregated when displayed in the events stream. To show unaggregated events, un-check the Aggregate related events box at the top right of your event stream:

Notifications

Datadog supports @notifications, for example:

@support-datadog
Creates a Datadog support ticket when posted directly to your events (including comments).
@all
Sends a notification to all members of your organization.
@john
Notifies the user named john.
@test@example.com
Sends an email to test@example.com.
@slack-<SLACK_ACCOUNT>-<CHANNEL_NAME>
Posts the event or graph to the specified Slack channel.
@webhook
Alerts or triggers the webhook. See the blog post on webhooks.
@pagerduty
Sends an alert to Pagerduty. You can also use @pagerduty-acknowledge and @pagerduty-resolve.

Further Reading