monitors

Creates, updates, deletes, gets or lists a monitors resource.

Overview

Name	monitors
Type	Resource
Id	datadog.monitoring.monitors

Fields

The following fields are returned by SELECT queries:

get_monitor

Name	Datatype	Description
id	integer (int64)	ID of this monitor.
name	string	The monitor name. (example: My monitor)
assets	array	The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
created	string (date-time)	Timestamp of the monitor creation.
creator	object	Object describing the creator of the shared element.
deleted	string (date-time)	Whether or not the monitor is deleted. (Always null)
draft_status	string	Indicates whether the monitor is in a draft or published state. draft: The monitor appears as Draft and does not send notifications. published: The monitor is active and evaluates conditions and notify as configured. This field is in preview. The draft value is only available to customers with the feature enabled. (draft, published) (default: published)
matching_downtimes	array	A list of active v1 downtimes that match this monitor.
message	string	A message to include with notifications for this monitor.
modified	string (date-time)	Last timestamp when the monitor was edited.
multi	boolean	Whether or not the monitor is broken down on different groups.
options	object	List of options associated with your monitor.
overall_state	string	The different states your monitor can be in. (Alert, Ignored, No Data, OK, Skipped, Unknown, Warn)
priority	integer (int64)	Integer from 1 (high) to 5 (low) indicating alert severity.
query	string	The monitor query. (example: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100)
restricted_roles	array	A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the [Roles API](https:​//docs.datadoghq.com/api/latest/roles/#list-roles) and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the [Restriction Policies API](https:​//docs.datadoghq.com/api/latest/restriction-policies/) to manage write authorization for individual monitors by teams and users, in addition to roles.
state	object	Wrapper object with the different monitor states.
tags	array	Tags associated to your monitor.
type	string	The type of the monitor. For more information about type, see the [monitor options](https:​//docs.datadoghq.com/monitors/guide/monitor_api_options/) docs. (composite, event alert, log alert, metric alert, process alert, query alert, rum alert, service check, synthetics alert, trace-analytics alert, slo alert, event-v2 alert, audit alert, ci-pipelines alert, ci-tests alert, error-tracking alert, database-monitoring alert, network-performance alert, cost alert, data-quality alert, network-path alert, data-jobs alert, llm-observability alert) (example: query alert)

list_monitors

Name	Datatype	Description
id	integer (int64)	ID of this monitor.
name	string	The monitor name. (example: My monitor)
assets	array	The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
created	string (date-time)	Timestamp of the monitor creation.
creator	object	Object describing the creator of the shared element.
deleted	string (date-time)	Whether or not the monitor is deleted. (Always null)
draft_status	string	Indicates whether the monitor is in a draft or published state. draft: The monitor appears as Draft and does not send notifications. published: The monitor is active and evaluates conditions and notify as configured. This field is in preview. The draft value is only available to customers with the feature enabled. (draft, published) (default: published)
matching_downtimes	array	A list of active v1 downtimes that match this monitor.
message	string	A message to include with notifications for this monitor.
modified	string (date-time)	Last timestamp when the monitor was edited.
multi	boolean	Whether or not the monitor is broken down on different groups.
options	object	List of options associated with your monitor.
overall_state	string	The different states your monitor can be in. (Alert, Ignored, No Data, OK, Skipped, Unknown, Warn)
priority	integer (int64)	Integer from 1 (high) to 5 (low) indicating alert severity.
query	string	The monitor query. (example: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100)
restricted_roles	array	A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the [Roles API](https:​//docs.datadoghq.com/api/latest/roles/#list-roles) and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the [Restriction Policies API](https:​//docs.datadoghq.com/api/latest/restriction-policies/) to manage write authorization for individual monitors by teams and users, in addition to roles.
state	object	Wrapper object with the different monitor states.
tags	array	Tags associated to your monitor.
type	string	The type of the monitor. For more information about type, see the [monitor options](https:​//docs.datadoghq.com/monitors/guide/monitor_api_options/) docs. (composite, event alert, log alert, metric alert, process alert, query alert, rum alert, service check, synthetics alert, trace-analytics alert, slo alert, event-v2 alert, audit alert, ci-pipelines alert, ci-tests alert, error-tracking alert, database-monitoring alert, network-performance alert, cost alert, data-quality alert, network-path alert, data-jobs alert, llm-observability alert) (example: query alert)

check_can_delete_monitor

Name	Datatype	Description
ok	array	An array of Monitor IDs that can be safely deleted.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_monitor	select	monitor_id	group_states, with_downtimes, with_assets	Get details about the specified monitor from your organization.
list_monitors	select		group_states, name, tags, monitor_tags, with_downtimes, id_offset, page, page_size	Get all monitors from your organization.
check_can_delete_monitor	select	monitor_ids		Check if the given monitors can be deleted.
create_monitor	insert	type, query		Create a monitor using the specified options.<br /><br />#### Monitor Types<br /><br />The type of monitor chosen from:<br /><br />- anomaly: query alert<br />- APM: query alert or trace-analytics alert<br />- composite: composite<br />- custom: service check<br />- forecast: query alert<br />- host: service check<br />- integration: query alert or service check<br />- live process: process alert<br />- logs: log alert<br />- metric: query alert<br />- network: service check<br />- outlier: query alert<br />- process: service check<br />- rum: rum alert<br />- SLO: slo alert<br />- watchdog: event-v2 alert<br />- event-v2: event-v2 alert<br />- audit: audit alert<br />- error-tracking: error-tracking alert<br />- database-monitoring: database-monitoring alert<br />- network-performance: network-performance alert<br />- cloud cost: cost alert<br />- network-path: network-path alert<br /><br />Notes:<br />- Synthetic monitors are created through the Synthetics API. See the [Synthetics API](https:​//docs.datadoghq.com/api/latest/synthetics/) documentation for more information.<br />- Log monitors require an unscoped App Key.<br /><br />#### Query Types<br /><br />##### Metric Alert Query<br /><br />Example: time_aggr(time_window):space_aggr:metric&#123;tags&#125; &#91;by &#123;key&#125;&#93; operator #<br /><br />- time_aggr: avg, sum, max, min, change, or pct_change<br />- time_window: last_#m (with # between 1 and 10080 depending on the monitor type) or last_#h(with # between 1 and 168 depending on the monitor type) or last_1d, or last_1w<br />- space_aggr: avg, sum, min, or max<br />- tags: one or more tags (comma-separated), or <br />- key: a 'key' in key:value tag syntax; defines a separate alert for each tag in the group (multi-alert)<br />- operator: <, <=, >, >=, ==, or !=<br />- #: an integer or decimal number used to set the threshold<br /><br />To use a dynamic threshold on a metric monitor with a formula query, replace # with the threshold keyword<br />(for example, ... &gt; threshold) and provide the threshold as a query via critical_query on options.thresholds.<br />This feature is in preview.<br /><br />If you are using the _change_ or _pct_change_ time aggregator, instead use change_aggr(time_aggr(time_window),&lt;br /&gt;timeshift):space_aggr:metric&#123;tags&#125; &#91;by &#123;key&#125;&#93; operator # with:<br /><br />- change_aggr change, pct_change<br />- time_aggr avg, sum, max, min [Learn more](https:​//docs.datadoghq.com/monitors/create/types/#define-the-conditions)<br />- time_window last_#m (between 1 and 2880 depending on the monitor type), last_#h (between 1 and 48 depending on the monitor type), or last_#d (1 or 2)<br />- timeshift #m_ago (5, 10, 15, or 30), #h_ago (1, 2, or 4), or 1d_ago<br /><br />Use this to create an outlier monitor using the following query:<br />avg(last_30m):outliers(avg:system.cpu.user&#123;role:es-events-data&#125; by &#123;host&#125;, 'dbscan', 7) &gt; 0<br /><br />##### Service Check Query<br /><br />Example: "check".over(tags).last(count).by(group).count_by_status()<br /><br />- check name of the check, for example datadog.agent.up<br />- tags one or more quoted tags (comma-separated), or "". for example: .over("env:prod", "role:db"); over cannot be blank.<br />- count must be at greater than or equal to your max threshold (defined in the options). It is limited to 100.<br />For example, if you've specified to notify on 1 critical, 3 ok, and 2 warn statuses, count should be at least 3.<br />- group must be specified for check monitors. Per-check grouping is already explicitly known for some service checks.<br />For example, Postgres integration monitors are tagged by db, host, and port, and Network monitors by host, instance, and url. See [Service Checks](https:​//docs.datadoghq.com/api/latest/service-checks/) documentation for more information.<br /><br />##### Event Alert Query<br /><br />Note: The Event Alert Query has been replaced by the Event V2 Alert Query. For more information, see the [Event Migration guide](https:​//docs.datadoghq.com/service_management/events/guides/migrating_to_new_events_features/).<br /><br />##### Event V2 Alert Query<br /><br />Example: events(query).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### Process Alert Query<br /><br />Example: processes(search).over(tags).rollup('count').last(timeframe) operator #<br /><br />- search free text search string for querying processes.<br />Matching processes match results on the [Live Processes](https:​//docs.datadoghq.com/infrastructure/process/?tab=linuxwindows) page.<br />- tags one or more tags (comma-separated)<br />- timeframe the timeframe to roll up the counts. Examples: 10m, 4h. Supported timeframes: s, m, h and d<br />- operator <, <=, >, >=, ==, or !=<br />- # an integer or decimal number used to set the threshold<br /><br />##### Logs Alert Query<br /><br />Example: logs(query).index(index_name).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- index_name For multi-index organizations, the log index in which the request is performed.<br />- rollup_method The stats roll-up method - supports count, avg and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### Composite Query<br /><br />Example: 12345 && 67890, where 12345 and 67890 are the IDs of non-composite monitors<br /><br />* name [required, default = dynamic, based on query]: The name of the alert.<br />* message [required, default = dynamic, based on query]: A message to include with notifications for this monitor.<br />Email notifications can be sent to specific users by using the same '@username' notation as events.<br />* tags [optional, default = empty list]: A list of tags to associate with your monitor.<br />When getting all monitor details via the API, use the monitor_tags argument to filter results by these tags.<br />It is only available via the API and isn't visible or editable in the Datadog UI.<br /><br />##### SLO Alert Query<br /><br />Example: error_budget("slo_id").over("time_window") operator #<br /><br />- slo_id: The alphanumeric SLO ID of the SLO you are configuring the alert for.<br />- time_window: The time window of the SLO target you wish to alert on. Valid options: 7d, 30d, 90d.<br />- operator: &gt;= or &gt;<br /><br />##### Audit Alert Query<br /><br />Example: audits(query).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### CI Pipelines Alert Query<br /><br />Example: ci-pipelines(query).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### CI Tests Alert Query<br /><br />Example: ci-tests(query).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### Error Tracking Alert Query<br /><br />"New issue" example: error-tracking(query).source(issue_source).new().rollup(rollup_method&#91;, measure&#93;).by(group_by).last(time_window) operator #<br />"High impact issue" example: error-tracking(query).source(issue_source).impact().rollup(rollup_method&#91;, measure&#93;).by(group_by).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- issue_source The issue source - supports all, browser, mobile and backend and defaults to all if omitted.<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality and defaults to count if omitted.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- group by Comma-separated list of attributes to group by - should contain at least issue.id.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />Database Monitoring Alert Query<br /><br />Example: database-monitoring(query).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />Network Performance Alert Query<br /><br />Example: network-performance(query).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />Cost Alert Query<br /><br />Example: formula(query).timeframe_type(time_window).function(parameter) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- timeframe_type The timeframe type to evaluate the cost<br /> - for forecast supports current<br /> - for change, anomaly, threshold supports last<br />- time_window - supports daily roll-up e.g. 7d<br />- function - [optional, defaults to threshold monitor if omitted] supports change, anomaly, forecast<br />- parameter Specify the parameter of the type<br /> - for change:<br /> - supports relative, absolute<br /> - [optional] supports #, where # is an integer or decimal number used to set the threshold<br /> - for anomaly:<br /> - supports direction=both, direction=above, direction=below<br /> - [optional] supports threshold=#, where # is an integer or decimal number used to set the threshold<br />- operator<br /> - for threshold supports &lt;, &lt;=, &gt;, &gt;=, ==, or !=<br /> - for change supports &gt;, &lt;<br /> - for anomaly supports &gt;=<br /> - for forecast supports &gt;<br />- # an integer or decimal number used to set the threshold.<br /><br />Network Path Alert Query<br /><br />Example: network-path(query).index(index_name).rollup(rollup_method&#91;, measure&#93;).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- index_name The data type to monitor on - supports netpath-path and netpath-hop.<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator &lt;, &lt;=, &gt;, &gt;=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.
update_monitor	replace	monitor_id		Edit the specified monitor.
delete_monitor	delete	monitor_id	force	Delete the specified monitor
validate_monitor	exec	type, query		Validate the monitor provided in the request.<br /><br />Note: Log monitors require an unscoped App Key and logs_read_data permission.
validate_existing_monitor	exec	monitor_id, type, query		Validate the monitor provided in the request.<br /><br />Note: Log monitors require an unscoped App Key and logs_read_data permission.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
monitor_id	integer (int64)	The ID of the monitor
monitor_ids	array	The IDs of the monitor to check.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
force	string	Delete the monitor even if it's referenced by other resources (for example SLO, composite monitor).
group_states	string	When specified, shows additional information about the group states. Choose one or more from all, alert, warn, and no data.
id_offset	integer (int64)	Use this parameter for paginating through large sets of monitors. Start with a value of zero, make a request, set the value to the last ID of result set, and then repeat until the response is empty.
monitor_tags	string	A comma separated list indicating what service and/or custom tags, if any, should be used to filter the list of monitors. Tags created in the Datadog UI automatically have the service key prepended. For example, service:my-app.
name	string	A string to filter monitors by name.
page	integer (int64)	The page to start paginating from. If this argument is not specified, the request returns all monitors without pagination.
page_size	integer (int32)	The number of monitors to return per page. If the page argument is not specified, the default behavior returns all monitors without a page_size limit. However, if page is specified and page_size is not, the argument defaults to 100.
tags	string	A comma separated list indicating what tags, if any, should be used to filter the list of monitors by scope. For example, host:host0.
with_assets	boolean	If this argument is set to true, the returned data includes all assets tied to this monitor.
with_downtimes	boolean	If this argument is set to true, then the returned data includes all current active downtimes for each monitor.

SELECT examples

get_monitor

Get details about the specified monitor from your organization.

SELECT
id,
name,
assets,
created,
creator,
deleted,
draft_status,
matching_downtimes,
message,
modified,
multi,
options,
overall_state,
priority,
query,
restricted_roles,
state,
tags,
type
FROM datadog.monitoring.monitors
WHERE monitor_id = '{{ monitor_id }}' -- required
AND group_states = '{{ group_states }}'
AND with_downtimes = '{{ with_downtimes }}'
AND with_assets = '{{ with_assets }}'
;

list_monitors

Get all monitors from your organization.

SELECT
id,
name,
assets,
created,
creator,
deleted,
draft_status,
matching_downtimes,
message,
modified,
multi,
options,
overall_state,
priority,
query,
restricted_roles,
state,
tags,
type
FROM datadog.monitoring.monitors
WHERE group_states = '{{ group_states }}'
AND name = '{{ name }}'
AND tags = '{{ tags }}'
AND monitor_tags = '{{ monitor_tags }}'
AND with_downtimes = '{{ with_downtimes }}'
AND id_offset = '{{ id_offset }}'
AND page = '{{ page }}'
AND page_size = '{{ page_size }}'
;

check_can_delete_monitor

Check if the given monitors can be deleted.

SELECT
ok
FROM datadog.monitoring.monitors
WHERE monitor_ids = '{{ monitor_ids }}' -- required
;

INSERT examples

create_monitor

Create a monitor using the specified options.<br /><br />#### Monitor Types<br /><br />The type of monitor chosen from:<br /><br />- anomaly: query alert<br />- APM: query alert or trace-analytics alert<br />- composite: composite<br />- custom: service check<br />- forecast: query alert<br />- host: service check<br />- integration: query alert or service check<br />- live process: process alert<br />- logs: log alert<br />- metric: query alert<br />- network: service check<br />- outlier: query alert<br />- process: service check<br />- rum: rum alert<br />- SLO: slo alert<br />- watchdog: event-v2 alert<br />- event-v2: event-v2 alert<br />- audit: audit alert<br />- error-tracking: error-tracking alert<br />- database-monitoring: database-monitoring alert<br />- network-performance: network-performance alert<br />- cloud cost: cost alert<br />- network-path: network-path alert<br /><br />Notes:<br />- Synthetic monitors are created through the Synthetics API. See the [Synthetics API](https:​//docs.datadoghq.com/api/latest/synthetics/) documentation for more information.<br />- Log monitors require an unscoped App Key.<br /><br />#### Query Types<br /><br />##### Metric Alert Query<br /><br />Example: time_aggr(time_window):space_aggr:metric{tags} [by {key}] operator #<br /><br />- time_aggr: avg, sum, max, min, change, or pct_change<br />- time_window: last_#m (with # between 1 and 10080 depending on the monitor type) or last_#h(with # between 1 and 168 depending on the monitor type) or last_1d, or last_1w<br />- space_aggr: avg, sum, min, or max<br />- tags: one or more tags (comma-separated), or <br />- key: a 'key' in key:value tag syntax; defines a separate alert for each tag in the group (multi-alert)<br />- operator: <, <=, >, >=, ==, or !=<br />- #: an integer or decimal number used to set the threshold<br /><br />To use a dynamic threshold on a metric monitor with a formula query, replace # with the threshold keyword<br />(for example, ... > threshold) and provide the threshold as a query via critical_query on options.thresholds.<br />This feature is in preview.<br /><br />If you are using the _change_ or _pct_change_ time aggregator, instead use change_aggr(time_aggr(time_window),<br />timeshift):space_aggr:metric{tags} [by {key}] operator # with:<br /><br />- change_aggr change, pct_change<br />- time_aggr avg, sum, max, min [Learn more](https:​//docs.datadoghq.com/monitors/create/types/#define-the-conditions)<br />- time_window last_#m (between 1 and 2880 depending on the monitor type), last_#h (between 1 and 48 depending on the monitor type), or last_#d (1 or 2)<br />- timeshift #m_ago (5, 10, 15, or 30), #h_ago (1, 2, or 4), or 1d_ago<br /><br />Use this to create an outlier monitor using the following query:<br />avg(last_30m):outliers(avg:system.cpu.user{role:es-events-data} by {host}, 'dbscan', 7) > 0<br /><br />##### Service Check Query<br /><br />Example: "check".over(tags).last(count).by(group).count_by_status()<br /><br />- check name of the check, for example datadog.agent.up<br />- tags one or more quoted tags (comma-separated), or "". for example: .over("env:prod", "role:db"); over cannot be blank.<br />- count must be at greater than or equal to your max threshold (defined in the options). It is limited to 100.<br />For example, if you've specified to notify on 1 critical, 3 ok, and 2 warn statuses, count should be at least 3.<br />- group must be specified for check monitors. Per-check grouping is already explicitly known for some service checks.<br />For example, Postgres integration monitors are tagged by db, host, and port, and Network monitors by host, instance, and url. See [Service Checks](https:​//docs.datadoghq.com/api/latest/service-checks/) documentation for more information.<br /><br />##### Event Alert Query<br /><br />Note: The Event Alert Query has been replaced by the Event V2 Alert Query. For more information, see the [Event Migration guide](https:​//docs.datadoghq.com/service_management/events/guides/migrating_to_new_events_features/).<br /><br />##### Event V2 Alert Query<br /><br />Example: events(query).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### Process Alert Query<br /><br />Example: processes(search).over(tags).rollup('count').last(timeframe) operator #<br /><br />- search free text search string for querying processes.<br />Matching processes match results on the [Live Processes](https:​//docs.datadoghq.com/infrastructure/process/?tab=linuxwindows) page.<br />- tags one or more tags (comma-separated)<br />- timeframe the timeframe to roll up the counts. Examples: 10m, 4h. Supported timeframes: s, m, h and d<br />- operator <, <=, >, >=, ==, or !=<br />- # an integer or decimal number used to set the threshold<br /><br />##### Logs Alert Query<br /><br />Example: logs(query).index(index_name).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- index_name For multi-index organizations, the log index in which the request is performed.<br />- rollup_method The stats roll-up method - supports count, avg and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### Composite Query<br /><br />Example: 12345 && 67890, where 12345 and 67890 are the IDs of non-composite monitors<br /><br />* name [required, default = dynamic, based on query]: The name of the alert.<br />* message [required, default = dynamic, based on query]: A message to include with notifications for this monitor.<br />Email notifications can be sent to specific users by using the same '@username' notation as events.<br />* tags [optional, default = empty list]: A list of tags to associate with your monitor.<br />When getting all monitor details via the API, use the monitor_tags argument to filter results by these tags.<br />It is only available via the API and isn't visible or editable in the Datadog UI.<br /><br />##### SLO Alert Query<br /><br />Example: error_budget("slo_id").over("time_window") operator #<br /><br />- slo_id: The alphanumeric SLO ID of the SLO you are configuring the alert for.<br />- time_window: The time window of the SLO target you wish to alert on. Valid options: 7d, 30d, 90d.<br />- operator: >= or ><br /><br />##### Audit Alert Query<br /><br />Example: audits(query).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### CI Pipelines Alert Query<br /><br />Example: ci-pipelines(query).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### CI Tests Alert Query<br /><br />Example: ci-tests(query).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />##### Error Tracking Alert Query<br /><br />"New issue" example: error-tracking(query).source(issue_source).new().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator #<br />"High impact issue" example: error-tracking(query).source(issue_source).impact().rollup(rollup_method[, measure]).by(group_by).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- issue_source The issue source - supports all, browser, mobile and backend and defaults to all if omitted.<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality and defaults to count if omitted.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- group by Comma-separated list of attributes to group by - should contain at least issue.id.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />Database Monitoring Alert Query<br /><br />Example: database-monitoring(query).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />Network Performance Alert Query<br /><br />Example: network-performance(query).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.<br /><br />Cost Alert Query<br /><br />Example: formula(query).timeframe_type(time_window).function(parameter) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- timeframe_type The timeframe type to evaluate the cost<br /> - for forecast supports current<br /> - for change, anomaly, threshold supports last<br />- time_window - supports daily roll-up e.g. 7d<br />- function - [optional, defaults to threshold monitor if omitted] supports change, anomaly, forecast<br />- parameter Specify the parameter of the type<br /> - for change:<br /> - supports relative, absolute<br /> - [optional] supports #, where # is an integer or decimal number used to set the threshold<br /> - for anomaly:<br /> - supports direction=both, direction=above, direction=below<br /> - [optional] supports threshold=#, where # is an integer or decimal number used to set the threshold<br />- operator<br /> - for threshold supports <, <=, >, >=, ==, or !=<br /> - for change supports >, <<br /> - for anomaly supports >=<br /> - for forecast supports ><br />- # an integer or decimal number used to set the threshold.<br /><br />Network Path Alert Query<br /><br />Example: network-path(query).index(index_name).rollup(rollup_method[, measure]).last(time_window) operator #<br /><br />- query The search query - following the [Log search syntax](https:​//docs.datadoghq.com/logs/search_syntax/).<br />- index_name The data type to monitor on - supports netpath-path and netpath-hop.<br />- rollup_method The stats roll-up method - supports count, avg, and cardinality.<br />- measure For avg and cardinality rollup_method - specify the measure or the facet name you want to use.<br />- time_window #m (between 1 and 2880), #h (between 1 and 48).<br />- operator <, <=, >, >=, ==, or !=.<br />- # an integer or decimal number used to set the threshold.

INSERT INTO datadog.monitoring.monitors (
assets,
draft_status,
matching_downtimes,
message,
name,
options,
priority,
query,
restricted_roles,
tags,
type
)
SELECT 
'{{ assets }}',
'{{ draft_status }}',
'{{ matching_downtimes }}',
'{{ message }}',
'{{ name }}',
'{{ options }}',
{{ priority }},
'{{ query }}' /* required */,
'{{ restricted_roles }}',
'{{ tags }}',
'{{ type }}' /* required */
RETURNING
id,
name,
assets,
created,
creator,
deleted,
draft_status,
matching_downtimes,
message,
modified,
multi,
options,
overall_state,
priority,
query,
restricted_roles,
state,
tags,
type
;

Manifest

# Description fields are for documentation purposes
- name: monitors
props:
  - name: assets
    description: |
      The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
    value:
      - category: "{{ category }}"
        name: "{{ name }}"
        resource_key: "{{ resource_key }}"
        resource_type: "{{ resource_type }}"
        url: "{{ url }}"
  - name: draft_status
    value: "{{ draft_status }}"
    description: |
      Indicates whether the monitor is in a draft or published state.
      `draft`: The monitor appears as Draft and does not send notifications.
      `published`: The monitor is active and evaluates conditions and notify as configured.
      This field is in preview. The draft value is only available to customers with the feature enabled.
    valid_values: ['draft', 'published']
    default: published
  - name: matching_downtimes
    description: |
      A list of active v1 downtimes that match this monitor.
    value:
      - end: {{ end }}
        id: {{ id }}
        scope: "{{ scope }}"
        start: {{ start }}
  - name: message
    value: "{{ message }}"
    description: |
      A message to include with notifications for this monitor.
  - name: name
    value: "{{ name }}"
    description: |
      The monitor name.
  - name: options
    description: |
      List of options associated with your monitor.
    value:
      aggregation:
        group_by: "{{ group_by }}"
        metric: "{{ metric }}"
        type: "{{ type }}"
      device_ids:
        - "{{ device_ids }}"
      enable_logs_sample: {{ enable_logs_sample }}
      enable_samples: {{ enable_samples }}
      escalation_message: "{{ escalation_message }}"
      evaluation_delay: {{ evaluation_delay }}
      group_retention_duration: "{{ group_retention_duration }}"
      groupby_simple_monitor: {{ groupby_simple_monitor }}
      include_tags: {{ include_tags }}
      locked: {{ locked }}
      min_failure_duration: {{ min_failure_duration }}
      min_location_failed: {{ min_location_failed }}
      new_group_delay: {{ new_group_delay }}
      new_host_delay: {{ new_host_delay }}
      no_data_timeframe: {{ no_data_timeframe }}
      notification_preset_name: "{{ notification_preset_name }}"
      notify_audit: {{ notify_audit }}
      notify_by:
        - "{{ notify_by }}"
      notify_no_data: {{ notify_no_data }}
      on_missing_data: "{{ on_missing_data }}"
      renotify_interval: {{ renotify_interval }}
      renotify_occurrences: {{ renotify_occurrences }}
      renotify_statuses:
        - "{{ renotify_statuses }}"
      require_full_window: {{ require_full_window }}
      scheduling_options:
        custom_schedule:
          recurrences:
            - rrule: "{{ rrule }}"
              start: "{{ start }}"
              timezone: "{{ timezone }}"
        evaluation_window:
          day_starts: "{{ day_starts }}"
          hour_starts: {{ hour_starts }}
          month_starts: {{ month_starts }}
          timezone: "{{ timezone }}"
      silenced: "{{ silenced }}"
      synthetics_check_id: "{{ synthetics_check_id }}"
      threshold_windows:
        recovery_window: "{{ recovery_window }}"
        trigger_window: "{{ trigger_window }}"
      thresholds:
        critical: {{ critical }}
        critical_query: "{{ critical_query }}"
        critical_recovery: {{ critical_recovery }}
        critical_recovery_query: "{{ critical_recovery_query }}"
        ok: {{ ok }}
        unknown: {{ unknown }}
        warning: {{ warning }}
        warning_recovery: {{ warning_recovery }}
      timeout_h: {{ timeout_h }}
      variables:
        - compute:
            aggregation: "{{ aggregation }}"
            interval: {{ interval }}
            metric: "{{ metric }}"
            name: "{{ name }}"
            source: "{{ source }}"
          data_source: "{{ data_source }}"
          group_by: "{{ group_by }}"
          indexes: "{{ indexes }}"
          name: "{{ name }}"
          search:
            query: "{{ query }}"
          aggregator: "{{ aggregator }}"
          query: "{{ query }}"
          filter: "{{ filter }}"
          measure: "{{ measure }}"
          monitor_options:
            crontab_override: "{{ crontab_override }}"
            custom_sql: "{{ custom_sql }}"
            custom_where: "{{ custom_where }}"
            group_by_columns:
              - "{{ group_by_columns }}"
            model_type_override: "{{ model_type_override }}"
            sensitivity: {{ sensitivity }}
          schema_version: "{{ schema_version }}"
          scope: "{{ scope }}"
          job_type: "{{ job_type }}"
          jobs_query: "{{ jobs_query }}"
          query_dialect: "{{ query_dialect }}"
          augment_query:
            compute:
              aggregation: "{{ aggregation }}"
              interval: {{ interval }}
              metric: "{{ metric }}"
              name: "{{ name }}"
              source: "{{ source }}"
            data_source: "{{ data_source }}"
            group_by:
              - facet: "{{ facet }}"
                limit: {{ limit }}
                sort:
                  aggregation: "{{ aggregation }}"
                  metric: "{{ metric }}"
                  order: "{{ order }}"
                source: "{{ source }}"
            indexes:
              - "{{ indexes }}"
            name: "{{ name }}"
            search:
              query: "{{ query }}"
            columns:
              - alias: "{{ alias }}"
                name: "{{ name }}"
            query_filter: "{{ query_filter }}"
            table_name: "{{ table_name }}"
          base_query:
            compute:
              aggregation: "{{ aggregation }}"
              interval: {{ interval }}
              metric: "{{ metric }}"
              name: "{{ name }}"
              source: "{{ source }}"
            data_source: "{{ data_source }}"
            group_by:
              - facet: "{{ facet }}"
                limit: {{ limit }}
                sort:
                  aggregation: "{{ aggregation }}"
                  metric: "{{ metric }}"
                  order: "{{ order }}"
                source: "{{ source }}"
            indexes:
              - "{{ indexes }}"
            name: "{{ name }}"
            search:
              query: "{{ query }}"
            aggregator: "{{ aggregator }}"
            query: "{{ query }}"
          join_condition:
            augment_attribute: "{{ augment_attribute }}"
            base_attribute: "{{ base_attribute }}"
            join_type: "{{ join_type }}"
          filter_query:
            compute:
              aggregation: "{{ aggregation }}"
              interval: {{ interval }}
              metric: "{{ metric }}"
              name: "{{ name }}"
              source: "{{ source }}"
            data_source: "{{ data_source }}"
            group_by:
              - facet: "{{ facet }}"
                limit: {{ limit }}
                sort:
                  aggregation: "{{ aggregation }}"
                  metric: "{{ metric }}"
                  order: "{{ order }}"
                source: "{{ source }}"
            indexes:
              - "{{ indexes }}"
            name: "{{ name }}"
            search:
              query: "{{ query }}"
            columns:
              - alias: "{{ alias }}"
                name: "{{ name }}"
            query_filter: "{{ query_filter }}"
            table_name: "{{ table_name }}"
          filters: "{{ filters }}"
  - name: priority
    value: {{ priority }}
    description: |
      Integer from 1 (high) to 5 (low) indicating alert severity.
  - name: query
    value: "{{ query }}"
    description: |
      The monitor query.
  - name: restricted_roles
    value:
      - "{{ restricted_roles }}"
    description: |
      A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the [Roles API](https://docs.datadoghq.com/api/latest/roles/#list-roles) and are located in the `data.id` field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the [Restriction Policies API](https://docs.datadoghq.com/api/latest/restriction-policies/) to manage write authorization for individual monitors by teams and users, in addition to roles.
  - name: tags
    value:
      - "{{ tags }}"
    description: |
      Tags associated to your monitor.
  - name: type
    value: "{{ type }}"
    description: |
      The type of the monitor. For more information about `type`, see the [monitor options](https://docs.datadoghq.com/monitors/guide/monitor_api_options/) docs.
    valid_values: ['composite', 'event alert', 'log alert', 'metric alert', 'process alert', 'query alert', 'rum alert', 'service check', 'synthetics alert', 'trace-analytics alert', 'slo alert', 'event-v2 alert', 'audit alert', 'ci-pipelines alert', 'ci-tests alert', 'error-tracking alert', 'database-monitoring alert', 'network-performance alert', 'cost alert', 'data-quality alert', 'network-path alert', 'data-jobs alert', 'llm-observability alert']

REPLACE examples

update_monitor

Edit the specified monitor.

REPLACE datadog.monitoring.monitors
SET 
assets = '{{ assets }}',
draft_status = '{{ draft_status }}',
message = '{{ message }}',
name = '{{ name }}',
options = '{{ options }}',
priority = {{ priority }},
query = '{{ query }}',
restricted_roles = '{{ restricted_roles }}',
tags = '{{ tags }}',
type = '{{ type }}'
WHERE 
monitor_id = '{{ monitor_id }}' --required
RETURNING
id,
name,
assets,
created,
creator,
deleted,
draft_status,
matching_downtimes,
message,
modified,
multi,
options,
overall_state,
priority,
query,
restricted_roles,
state,
tags,
type;

DELETE examples

delete_monitor

Delete the specified monitor

DELETE FROM datadog.monitoring.monitors
WHERE monitor_id = '{{ monitor_id }}' --required
AND force = '{{ force }}'
;

Lifecycle Methods

EXEC variables use wire (API) names.

validate_monitor

Validate the monitor provided in the request.<br /><br />Note: Log monitors require an unscoped App Key and logs_read_data permission.

EXEC datadog.monitoring.monitors.validate_monitor 
@@json=
'{
"assets": "{{ assets }}", 
"draft_status": "{{ draft_status }}", 
"matching_downtimes": "{{ matching_downtimes }}", 
"message": "{{ message }}", 
"name": "{{ name }}", 
"options": "{{ options }}", 
"priority": {{ priority }}, 
"query": "{{ query }}", 
"restricted_roles": "{{ restricted_roles }}", 
"tags": "{{ tags }}", 
"type": "{{ type }}"
}'
;

validate_existing_monitor

Validate the monitor provided in the request.<br /><br />Note: Log monitors require an unscoped App Key and logs_read_data permission.

EXEC datadog.monitoring.monitors.validate_existing_monitor 
@monitor_id='{{ monitor_id }}' --required, 
@@json=
'{
"assets": "{{ assets }}", 
"draft_status": "{{ draft_status }}", 
"matching_downtimes": "{{ matching_downtimes }}", 
"message": "{{ message }}", 
"name": "{{ name }}", 
"options": "{{ options }}", 
"priority": {{ priority }}, 
"query": "{{ query }}", 
"restricted_roles": "{{ restricted_roles }}", 
"tags": "{{ tags }}", 
"type": "{{ type }}"
}'
;