anomalies

Creates, updates, deletes, gets or lists an anomalies resource.

Overview

Name	anomalies
Type	Resource
Id	datadog.cloud_costs.anomalies

Fields

The following fields are returned by SELECT queries:

get_cost_anomaly

Name	Datatype	Description
id	string	The unique identifier of the anomaly. (example: b0a6aaa9-3c4c-48cb-9447-a0d1338b3e09)
attributes	object	A single detected Cloud Cost Management anomaly.
type	string	Type of the cost anomalies collection resource. Must be anomalies. (anomalies) (default: anomalies, example: anomalies)

list_cost_anomalies

Name	Datatype	Description
id	string	Static identifier of the cost anomalies collection resource. (example: anomalies)
attributes	object	Cost anomaly results and aggregated totals for the queried window.
type	string	Type of the cost anomalies collection resource. Must be anomalies. (anomalies) (default: anomalies, example: anomalies)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_cost_anomaly	select	anomaly_id		Get a detected Cloud Cost Management anomaly by UUID.
list_cost_anomalies	select		start, end, filter, min_anomalous_threshold, min_cost_threshold, dismissal_cause, order_by, order, limit, offset, provider_ids	List detected Cloud Cost Management anomalies for the organization.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
anomaly_id	string	The UUID of the cost anomaly.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
dismissal_cause	string	Filter by resolution state. Use none for unresolved anomalies, all or * for resolved anomalies, or a comma-separated list of causes.
end	integer (int64)	End time as Unix milliseconds. Defaults to the end of the latest stable seven-day window.
filter	string	Optional JSON object mapping cost tag keys to allowed values, for example {"team":["payments"],"env":["prod"]}. Filters match anomaly dimensions or correlated tags.
limit	integer (int64)	Maximum number of anomalies to return. Defaults to 200.
min_anomalous_threshold	string	Minimum absolute anomalous cost change to include. Numeric value; defaults to 1.
min_cost_threshold	string	Minimum absolute actual cost to include. Numeric value; defaults to 0.
offset	integer (int64)	Pagination offset. Defaults to 0.
order	string	Sort direction. One of asc or desc. Defaults to desc.
order_by	string	Sort field. One of start_date, end_date, duration, max_cost, anomalous_cost, or dismissal_date. Defaults to anomalous_cost.
provider_ids	array	Optional repeated cloud or SaaS provider filters, such as aws, gcp, azure, Oracle, datadog, OpenAI, or Anthropic.
start	integer (int64)	Start time as Unix milliseconds. Defaults to the start of the latest stable seven-day window.

SELECT examples

get_cost_anomaly

Get a detected Cloud Cost Management anomaly by UUID.

SELECT
id,
attributes,
type
FROM datadog.cloud_costs.anomalies
WHERE anomaly_id = '{{ anomaly_id }}' -- required
;

list_cost_anomalies

List detected Cloud Cost Management anomalies for the organization.

SELECT
id,
attributes,
type
FROM datadog.cloud_costs.anomalies
WHERE start = '{{ start }}'
AND end = '{{ end }}'
AND filter = '{{ filter }}'
AND min_anomalous_threshold = '{{ min_anomalous_threshold }}'
AND min_cost_threshold = '{{ min_cost_threshold }}'
AND dismissal_cause = '{{ dismissal_cause }}'
AND order_by = '{{ order_by }}'
AND order = '{{ order }}'
AND limit = '{{ limit }}'
AND offset = '{{ offset }}'
AND provider_ids = '{{ provider_ids }}'
;