- 重要な情報
- アプリ内
- インフラストラクチャー
- アプリケーションパフォーマンス
- 継続的インテグレーション
- ログ管理
- セキュリティ
- UX モニタリング
- 管理
Once log management is enabled for your organization, you can create a logs monitor to alert you when a specified type of log exceeds a user-defined threshold over a given period of time. The logs monitor only evaluates indexed logs.
To create a logs monitor in Datadog, use the main navigation: Monitors –> New Monitor –> Logs.
As you define the search query, the graph above the search fields updates.
Construct a search query using the same logic as a log explorer search.
Choose to monitor over a log count, facet, or measure:
Unique value count
of the facet. For example, if you have a facet on user.email
, the unique value count is the number of unique user emails.min
, avg
, sum
, median
, pc75
, pc90
, pc95
, pc98
, pc99
, or max
).Group logs by multiple dimensions (optional):
All logs matching the query are aggregated into groups based on the value of up to four log facets. When there are multiple dimensions, the top values are determined according to the first dimension, then according to the second dimension within the top values of the first dimension, and so on up to the last dimension. Dimensions limit depends on the total number of dimension:
Configure the alerting grouping strategy (optional):
system.disk.in_use
by device
to receive a separate alert for each device that is running out of space.above
, above or equal to
, below
, or below or equal to
5 minutes
, 15 minutes
, 1 hour
, etc. or custom
to set a value between 5 minutes
and 2 days
.<NUMBER>
<NUMBER>
NO DATA
is a state given when no logs match the monitor query during the timeframe.
To receive a notification when all groups matching a specific query have stopped sending logs, set the condition to below 1
. This notifies when no logs match the monitor query in a given timeframe across all aggregate groups.
When splitting the monitor by any dimension (tag or facet) and using a below
condition, the alert is triggered if and only if there are logs for a given group, and the count is below the threshold—or if there are no logs for all of the groups.
Examples:
backend
:For detailed instructions on the advanced alert options (evaluation delay, new group delay, etc.), see the Monitor configuration page.
For detailed instructions on the Say what’s happening and Notify your team sections, see the Notifications page.
When a logs monitor is triggered, samples or values can be added to the notification message.
Monitor Setup | Can be added to notification message |
---|---|
Ungrouped Simple-Alert Log count | Up to 10 log samples. |
Grouped Simple-Alert Log count | Up to 10 facet or measure values. |
Grouped Multi Alert Log count | Up to 10 log samples. |
Ungrouped Simple-Alert measure | Up to 10 log samples. |
Grouped Simple-Alert measure | Up to 10 facet or measure values. |
Grouped Multi Alert Log count | Up to 10 facet or measure values. |
These are available for notifications sent to Slack, Jira, webhooks, Microsoft Teams, Pagerduty, and email. Note: Samples are not displayed for recovery notifications.
To disable log samples, uncheck the box at the bottom of the Say what’s happening section. The text next to the box is based on your monitor’s grouping (as stated above).
Include a table of the top 10 breaching values:
Include a sample of 10 logs in the alert notification: