Datadog Monitor

Create monitor

Create a monitor using the specified options.

Inputs

Expand All

Field

Type

Description

name [required]

string

The monitor name.

monitorType [required]

 <oneOf>

The type of the monitor.

Option 1

object

option [required]

string

Logs Alert Query monitor type option.

query [required]

string

Construct a search query using the same logic as a log explorer search, for example:

  • logs("@http.status_code:[500 TO 599]").index("*").rollup("count").last("20m")
  • logs("foo").index("*").rollup("count").by("@service").last("1m")

Format: logs(query).index(index_name).rollup(rollup_method[, measure]).last(time_window).

See documentation for further formatting help.

operator [required]

enum

Operator of the query. Determines whether the monitor will trigger when the evaluated value is compared using the operator to the alert threshold. Allowed enum values: <,<=,>,>=,==,!=

critical_threshold [required]

number

The monitor CRITICAL threshold, also known as the alert threshold.

warning_threshold

number

The monitor WARNING threshold.

other_thresholds

object

List of other optional monitor thresholds available.

critical_recovery

number

The monitor CRITICAL recovery threshold.

ok

number

The monitor OK threshold.

unknown

number

The monitor UNKNOWN threshold.

warning_recovery

number

The monitor WARNING recovery threshold.

on_missing_data

enum

Controls how groups or monitors are treated if an evaluation does not return any data points. The default option results in different behavior depending on the monitor query type. For monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions. For monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status. Allowed enum values: default,show_no_data,show_and_notify_no_data,resolve

default: default

enable_logs_sample

boolean

Whether or not to send a log sample when the log monitor triggers.

Option 2

object

option [required]

string

Metric Alert Query monitor type option.

query [required]

string

Your source metric queries use the same definition language as metric graphs, for example:

  • avg:system.cpu.idle{*} - week_before(max:system.cpu.idle{*})
  • max:system.disk.in_use{*} by {host} - min:system.disk.in_use{*}
  • rate(avg:system.load.1{*}) + 1

See the graphing primer for further examples.

Format: time_aggr(time_window):space_aggr:metric{tags} [by {key}].

See documentation for further formatting help.

operator [required]

enum

Operator of the query. Determines whether the monitor will trigger when the evaluated value is compared using the operator to the alert threshold. Allowed enum values: <,<=,>,>=,==,!=

critical_threshold [required]

number

The monitor CRITICAL threshold, also known as the alert threshold.

warning_threshold

number

The monitor WARNING threshold.

other_thresholds

object

List of other optional monitor thresholds available.

critical_recovery

number

The monitor CRITICAL recovery threshold.

ok

number

The monitor OK threshold.

unknown

number

The monitor UNKNOWN threshold.

warning_recovery

number

The monitor WARNING recovery threshold.

notify_no_data

boolean

A Boolean indicating whether this monitor notifies when data stops reporting.

message [required]

markdown

A message to include with notifications for this monitor. You can build a notification section in the monitor product using autocomplete and copy and paste it into this field.

priority

enum

Integer from 1 (high) to 5 (low) indicating alert severity. Allowed enum values: 1,2,3,4,5

default: 5

tags

Tags associated to your monitor.

escalation_message

markdown

We recommend using the is_renotify, block in the original message instead. A message to include with a re-notification. Supports the @username notification we allow elsewhere. Not applicable if Renotify interval is null.

include_tags

boolean

A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.

default: true

notify_audit

boolean

A Boolean indicating whether tagged users is notified on changes to this monitor.

renotify_interval

number

The number of minutes after the last notification before a monitor re-notifies on the current status.

renotify_occurrences

number

The number of times re-notification messages should be sent on the current status at the provided re-notification interval.

renotify_statuses

[string]

The types of monitor statuses for which re-notification messages are sent.

Outputs

Expand All

Field

Type

Description

url

string

The URL of the monitor.

creator

object

name

string

handle

string

email

string

id

number,string

ID of this monitor.

message

string

A message to include with notifications for this monitor.

name

string

The monitor name.

tags

[string]

Tags associated to your monitor.

tag_value

object

A map of tags where both the keys and the values are strings. If a key has multiple values, the last value wins.

tag_value_list

object

A map of tags where the keys are strings and the values are lists of strings.

options

object

List of options associated with your monitor.

aggregation

object

Type of aggregation performed in the monitor query.

avalanche_window

object

device_ids

[string]

IDs of the device the Synthetics monitor is running on.

enable_logs_sample

boolean

Whether or not to send a log sample when the log monitor triggers.

escalation_message

string

We recommend using the is_renotify, block in the original message instead.

default: none

evaluation_delay

number

Time (in seconds) to delay evaluation, as a non-negative integer.

groupby_simple_monitor

boolean

Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold.

group_retention_duration

string

include_tags

boolean

A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.

default: true

locked

boolean

Whether or not the monitor is locked (only editable by creator and admins).

min_failure_duration

number

How long the test should be in failure before alerting (integer, number of seconds, max 7200).

min_location_failed

number

The minimum number of locations in failure at the same time during at least one moment in the min_failure_duration period (min_location_failed and min_failure_duration are part of the advanced alerting rules - integer, >= 1).

default: 1

new_group_delay

number

Time (in seconds) to skip evaluations for new groups.

new_host_delay

number

Time (in seconds) to allow a host to boot and applications to fully start before starting the evaluation of monitor results.

default: 300

no_data_timeframe

number

The number of minutes before a monitor notifies after data stops reporting.

notification_preset_name

Visibility setting for content displayed in notification.

notify_audit

boolean

A Boolean indicating whether tagged users is notified on changes to this monitor.

notify_no_data

boolean

A Boolean indicating whether this monitor notifies when data stops reporting.

on_missing_data

string

renotify_interval

number

The number of minutes after the last notification before a monitor re-notifies on the current status.

renotify_occurrences

number

The number of times re-notification messages should be sent on the current status at the provided re-notification interval.

renotify_statuses

[string]

The types of monitor statuses for which re-notification messages are sent.

require_full_window

boolean

A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.

restriction_query

string

silenced

object

Information about the downtime applied to the monitor.

synthetics_check_id

string

ID of the corresponding Synthetic check.

thresholds

object

List of the different monitor threshold available.

critical

number,null

The monitor CRITICAL threshold.

critical_recovery

number

The monitor CRITICAL recovery threshold.

ok

number

The monitor OK threshold.

unknown

number

The monitor UNKNOWN threshold.

warning

number

The monitor WARNING threshold.

warning_recovery

number

The monitor WARNING recovery threshold.

threshold_windows

Alerting time window options.

timeout_h

number

The number of hours of the monitor not reporting data before it automatically resolves from a triggered state.

variables

[object]

List of requests that can be used in the monitor query.

data_source [required]

string

Data source for event platform-based queries.

search

object

Search options.

query [required]

string

Events search string.

indexes

[string]

An array of index names to query in the stream.

compute [required]

object

Compute options.

aggregation [required]

enum

Aggregation methods for event platform queries. Allowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,min,max,avg

interval

number

A time interval in milliseconds.

metric

string

Measurable attribute to compute.

group_by

[object]

Group by options.

facet [required]

string

Event facet.

sort

object

Options for sorting group by results.

metric

string

Metric used for sorting group by results.

aggregation [required]

enum

Aggregation methods for event platform queries. Allowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,min,max,avg

order

enum

limit

number

Number of groups to return.

name [required]

string

Name of the query for use in formulas.

overall_state

enum

The different states your monitor can be in. Allowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn

query [required]

string

The monitor query.

type [required]

enum

The type of the monitor. Allowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alert,slo alert,event-v2 alert,audit alert,ci-pipelines alert

priority

number,null

Integer from 1 (high) to 5 (low) indicating alert severity.

multi

boolean

Whether or not the monitor is broken down on different groups.

created

date-time

Timestamp of the monitor creation.

deleted

date-time

Whether or not the monitor is deleted.

modified

date-time

Last timestamp when the monitor was edited.

state

object

Wrapper object with the different monitor states.

groups

object

Dictionary where the keys are groups (comma separated lists of tags) and the values are the list of groups your monitor is broken down on.

restricted_roles

A list of role identifiers that can be pulled from the Roles API.

overall_state_modified

string,null

Timestamp of last time the state of the monitor changed.

created_at

number,null

Unix timestamp of monitor creation.

org_id

number,null