Using Events

Enrichment and normalization

A processor runs data-structuring actions on events attributes when they are ingested. A pipeline is composed of one or multiple processors executed sequentially. With event processing pipelines, you can:

  • Normalize disparate sources of events by remapping attributes. For example, use the same reserved service tags everywhere.
  • Enrich events with external data saved in a Reference Table (beta). For example, map a service name with your service directory to enrich events with team ownership information, links to dashboards, or links to documentation.

To add and configure event processing pipelines, see the Enrich & Normalize tab of Event Management. If you need further help, contact Datadog support.

Custom metrics

Generate metrics with 15-month retention from any event search query to create and monitor historical events and alerts. For more information, see Event Analytics.

Image of metrics with the events search query.

Examples of what to do with events

Triage features

Use the Events Explorer to aggregate and view events coming into Datadog. Group or filter events by attribute and graphically represent them with event analytics. Use the query search syntax to filter events using Boolean and wildcard operators.


You can use events as a data source in graph widgets to build timeseries, tables, and top list widgets of your event search queries. For example, the Monitor Notifications Overview dashboard analyzes monitor alert event trends to help you improve your configuration and reduce alert fatigue.


Option to view event overlays on an example dashboard

Overlays visualize corresponding events on top of your graphs. Use the Dashboard Event Overlays feature to identify when a recent change is causing performance issues within your application or services and find the source of the problem.

Create a monitor

Send monitor alerts and notifications based on significant event queries. To configure an alert, see the Event Monitor documentation.

Further reading