Network Performance Monitoring is now generally available! Network Monitoring is now available!

Event Stream

The event stream is a display of the most recent events generated by your infrastructure and the associated monitors.

Event Query Language

Narrow your search by filtering on certain event properties. See the list of filters below for more details. Note: Filters perform an exact match search. Partial strings are not considered.

sources:github,chefShow events from GitHub OR Chef.
tags:env-prod OR dbShow events tagged with #env-prod OR #db.
tags:security-group:sg-123 AND role:common-nodeShow events tagged with #security-group:sg-123 AND #role:common-node.
hosts:i-0ade23e6,db.myapp.comShow events from i-0ade23e6 OR
status:errorShow events with error status. (supports: error, warning, success)
priority:lowShow only low-priority events. (supports: low or normal. defaults to all)
cloud_provider:* NOT "azure"Show all cloud providers except the ones tagged with “azure”

Full text search works on all keywords provided in the search query after applying any filters. Full text search looks inside the event text, title, tags, users who commented on the event, host names, and devices tied to the event.

Use tag search to find all events with the same key tag with the following query:

tags:<KEY>:<VALUE>Shows events with the <KEY>:<VALUE> tag.
<KEY>:*Shows all events with the <KEY> attached.
<KEY>:<REGEX>Shows all events with <KEY>:<VALUE> tag where <VALUE> matches the <REGEX>
tags:<KEY>Doesn’t return anything.
<KEY>:<VALUE>Doesn’t return anything.

To combine multiple terms into a complex query, use any of the following Boolean operators:

ANDIntersection: both terms are in the selected events (for tags, if nothing is added, AND is taken by default).redis_* AND down
ORUnion: either term is contained in the selected events. Use a comma (,) for tags.sources:nagios,chef directory OR Mixlib
NOTExclusion: the following term is NOT in the event. This operator works for strings only—use - in front of tags.-tags:<KEY>:<VALUE> NOT "<STRING>"

Note: Some of the advanced query language features (e.g. boolean logic) work only in the event stream page, and are not available in graph tiles or dashboard widgets.

Combine prefixes to construct more complex searches. For example, if you wanted to find all open chef or nagios errors that mention cassandra, you’d have a search like:

sources:nagios,chef status:error cassandra

Note: Do not use spaces after the colon or commas in these lists. Anything not attached to a prefix goes to full text search.

Show events unaggregated

To show unaggregated events in your event stream, un-check the Aggregate related events toggle in the upper right corner of your event stream:

@ notifications

  • @support-datadog - Creates a Datadog support ticket when posted directly to your event stream (including comments).
  • @all – Sends a notification to all members of your organization.
  • @yourname – Notifies the specific user named ‘yourname’.
  • Sends an email to
  • If you have Slack, Webhooks, Pagerduty, or VictorOps, use:
    • @slack-<SLACK_ACCOUNT>-<CHANNEL_NAME> – posts the event or graph to that channel.
    • @webhook – Alerts or triggers whatever is attached to that webhook. Check out our blogpost on Webhooks!
    • @pagerduty – Sends an alert to Pagerduty. You can also use @pagerduty-acknowledge and @pagerduty-resolve.