Once log management is enabled for your organization, you can create a logs monitor to alert you when a specified type of log exceeds a user-defined threshold over a given period of time.
To create a logs monitor in Datadog, use the main navigation: Monitors –> New Monitor –> Logs.
As you define the search query, the graph above the search fields updates.
Unique value countof the facet.
deviceto receive a separate alert for each device that is running out of space.
above or equal to,
below or equal to
1 hour, etc. or
customto set a value between 5 minutes and 24 hours.
To receive a notification when all groups in a service have stopped sending logs, set the condition to
below 1. This notifies when no logs match the monitor query in a given timeframe across all aggregate groups.
When splitting the monitor by any dimension (tag or facet) and using a
below condition, the alert is triggered if and only if there are logs for a given group, and the count is below the threshold—or if there are no logs for all of the groups.
For detailed instructions on the Say what’s happening and Notify your team sections, see the Notifications page.
By default, when a logs monitor is triggered, samples or values are added to the notification message.
|Monitor over||Added to notification message|
|Log count||Grouped: The top 10 breaching values and their corresponding counts.|
Ungrouped: Up to 10 log samples.
|Facet or measure||The top 10 facet or measure values.|
These are available for notifications sent to Slack, Jira, webhooks, Microsoft Teams, Pagerduty, and email. Note: Samples are not displayed for recovery notifications.
To disable log samples, uncheck the box at the bottom of the Say what’s happening section. The text next to the box is based on your monitor’s grouping (as stated above).
Include a table of the top 10 breaching values:
Include a sample of 10 logs in the alert notification:
Additional helpful documentation, links, and articles: