Datadog

Datadog is a monitoring and analytics platform for infrastructure, applications, logs, and APM. Most operations are account-scoped.

Data Model

• Monitors — alert rules with type, query, thresholds, and notification targets (create, read, update, delete)
• Dashboards — saved visualizations with widgets and template variables (create, read, update, delete)
• Downtimes — scheduled maintenance windows that silence monitor notifications (create, read, update, delete)
• Hosts — infrastructure hosts reporting metrics and tags (read + mute/unmute)
• Metrics — timeseries data points; query with from/to epoch timestamps and Datadog metric expressions (read + metadata)
• Logs — structured log events; search with Datadog query syntax (search only)
• Events — infrastructure and deployment events with tags and priority (read + create)
• Incidents — active/postmortem incident records with timeline and teams (create, read, update, delete)
• SLOs — service level objectives with target, timeframe, and history (create, read, update, delete)
• Synthetics — API and browser test checks with locations and scheduling (read only)
• Notebooks — collaborative investigation documents (create, read, update, delete)
• APM Services — application performance monitoring service catalog (read only)
• Audit Logs — compliance and user activity tracking (search only)
• Security — threat detection rules and signals (search only)

Operation shape

• Single vs collection: Provide an id for one resource; omit it (or use filters) to enumerate.
• Create vs update: Include an id when mutating an existing row; omit for new rows when the operation supports both.
• Delete: Permanent removal by id where offered.
• Side-effect helpers: Some actions emit synthetic events or toggle host maintenance—use them sparingly and intentionally.

Query Patterns

• Metrics query: avg:system.cpu.user{host:web01} — metric:aggregation{tags}
• Logs search: service:web status:error — Datadog query syntax
• Time ranges: Unix epoch seconds for from/to params

Gotchas

• Site alignment: Datadog sites (US1, EU, etc.) are isolated—IDs, hosts, and queries do not carry across regions; stay within one site per investigation.
• Metrics discovery vs series pull: One family of reads resolves metric names/metadata; another returns actual timeseries samples—pick based on whether you need catalog or values.
• Events time range: Listing events requires start and end epoch timestamps — max 32 days apart.
• Hosts filtering: Use filter param with Datadog tag syntax (e.g. env:production).
• Dashboard PUT: Update replaces the entire dashboard definition, not a partial patch.
• Incident severity: Set via fields.severity dropdown, not a top-level attribute.