assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for cost queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert
assets
\n[object]
The list of monitor assets tied to a monitor, which represents key links for users to take action on monitor alerts (for example, runbooks).
category [required]
\nenum
Indicates the type of asset this entity represents on a monitor. \nAllowed enum values: runbook
name [required]
\nstring
Name for the monitor asset
resource_key
\nstring
Represents the identifier of the internal Datadog resource that this asset represents. IDs in this field should be passed in as strings.
resource_type
\nenum
Type of internal Datadog resource associated with a monitor asset. \nAllowed enum values: notebook
url [required]
\nstring
URL link for the asset. For links with an internal resource type set, this should be the relative path to where the Datadog domain is appended internally. For external links, this should be the full URL path.
created
\ndate-time
Timestamp of the monitor creation.
creator
\nobject
Object describing the creator of the shared element.
string
Email of the creator.
handle
\nstring
Handle of the creator.
name
\nstring
Name of the creator.
deleted
\ndate-time
Whether or not the monitor is deleted. (Always null)
draft_status
\nenum
Indicates whether the monitor is in a draft or published state.
draft: The monitor appears as Draft and does not send notifications.\npublished: The monitor is active and evaluates conditions and notify as configured.
This field is in preview. The draft value is only available to customers with the feature enabled. \nAllowed enum values: draft,published
default: published
id
\nint64
ID of this monitor.
matching_downtimes
\n[object]
A list of active v1 downtimes that match this monitor.
end
\nint64
POSIX timestamp to end the downtime.
id [required]
\nint64
The downtime ID.
scope
\n[string]
The scope(s) to which the downtime applies. Must be in key:value format. For example, host:app2.\nProvide multiple scopes as a comma-separated list like env:dev,env:prod.\nThe resulting downtime applies to sources that matches ALL provided scopes (env:dev AND env:prod).
start
\nint64
POSIX timestamp to start the downtime.
message
\nstring
A message to include with notifications for this monitor.
modified
\ndate-time
Last timestamp when the monitor was edited.
multi
\nboolean
Whether or not the monitor is broken down on different groups.
name
\nstring
The monitor name.
options
\nobject
List of options associated with your monitor.
aggregation
\nobject
Type of aggregation performed in the monitor query.
group_by
\nstring
Group to break down the monitor on.
metric
\nstring
Metric name used in the monitor.
type
\nstring
Metric type used in the monitor.
device_ids
\n[string]
DEPRECATED: IDs of the device the Synthetics monitor is running on.
enable_logs_sample
\nboolean
Whether or not to send a log sample when the log monitor triggers.
enable_samples
\nboolean
Whether or not to send a list of samples when the monitor triggers. This is only used by CI Test and Pipeline monitors.
escalation_message
\nstring
We recommend using the is_renotify,\nblock in the original message instead.\nA message to include with a re-notification. Supports the @username notification we allow elsewhere.\nNot applicable if renotify_interval is None.
evaluation_delay
\nint64
Time (in seconds) to delay evaluation, as a non-negative integer. For example, if the value is set to 300 (5min),\nthe timeframe is set to last_5m and the time is 7:00, the monitor evaluates data from 6:50 to 6:55.\nThis is useful for AWS CloudWatch and other backfilled metrics to ensure the monitor always has data during evaluation.
group_retention_duration
\nstring
The time span after which groups with missing data are dropped from the monitor state.\nThe minimum value is one hour, and the maximum value is 72 hours.\nExample values are: "60m", "1h", and "2d".\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors.
groupby_simple_monitor
\nboolean
DEPRECATED: Whether the log alert monitor triggers a single alert or multiple alerts when any group breaches a threshold. Use notify_by instead.
include_tags
\nboolean
A Boolean indicating whether notifications from this monitor automatically inserts its triggering tags into the title.
Examples
\nTrue, [Triggered on {host:h1}] Monitor TitleFalse, [Triggered] Monitor Titledefault: true
locked
\nboolean
DEPRECATED: Whether or not the monitor is locked (only editable by creator and admins). Use restricted_roles instead.
min_failure_duration
\nint64
How long the test should be in failure before alerting (integer, number of seconds, max 7200).
min_location_failed
\nint64
The minimum number of locations in failure at the same time during\nat least one moment in the min_failure_duration period (min_location_failed and min_failure_duration\nare part of the advanced alerting rules - integer, >= 1).
default: 1
new_group_delay
\nint64
Time (in seconds) to skip evaluations for new groups.
For example, this option can be used to skip evaluations for new hosts while they initialize.
Must be a non negative integer.
new_host_delay
\nint64
DEPRECATED: Time (in seconds) to allow a host to boot and applications\nto fully start before starting the evaluation of monitor results.\nShould be a non negative integer.
Use new_group_delay instead.
default: 300
no_data_timeframe
\nint64
The number of minutes before a monitor notifies after data stops reporting.\nDatadog recommends at least 2x the monitor timeframe for query alerts or 2 minutes for service checks.\nIf omitted, 2x the evaluation timeframe is used for query alerts, and 24 hours is used for service checks.
notification_preset_name
\nenum
Toggles the display of additional content sent in the monitor notification. \nAllowed enum values: show_all,hide_query,hide_handles,hide_all,hide_query_and_handles,show_only_snapshot,hide_handles_and_footer
default: show_all
notify_audit
\nboolean
A Boolean indicating whether tagged users is notified on changes to this monitor.
notify_by
\n[string]
Controls what granularity a monitor alerts on. Only available for monitors with groupings.\nFor instance, a monitor grouped by cluster, namespace, and pod can be configured to only notify on each\nnew cluster violating the alert conditions by setting notify_by to ["cluster"]. Tags mentioned\nin notify_by must be a subset of the grouping tags in the query.\nFor example, a query grouped by cluster and namespace cannot notify on region.\nSetting notify_by to ["*"] configures the monitor to notify as a simple-alert.
notify_no_data
\nboolean
A Boolean indicating whether this monitor notifies when data stops reporting. Defaults to false.
on_missing_data
\nenum
Controls how groups or monitors are treated if an evaluation does not return any data points.\nThe default option results in different behavior depending on the monitor query type.\nFor monitors using Count queries, an empty monitor evaluation is treated as 0 and is compared to the threshold conditions.\nFor monitors using any query type other than Count, for example Gauge, Measure, or Rate, the monitor shows the last known status.\nThis option is only available for APM Trace Analytics, Audit Trail, CI, Error Tracking, Event, Logs, and RUM monitors. \nAllowed enum values: default,show_no_data,show_and_notify_no_data,resolve
renotify_interval
\nint64
The number of minutes after the last notification before a monitor re-notifies on the current status.\nIt only re-notifies if it’s not resolved.
renotify_occurrences
\nint64
The number of times re-notification messages should be sent on the current status at the provided re-notification interval.
renotify_statuses
\n[string]
The types of monitor statuses for which re-notification messages are sent.\nDefault: null if renotify_interval is null.\nIf renotify_interval is set, defaults to renotify on Alert and No Data.
require_full_window
\nboolean
A Boolean indicating whether this monitor needs a full window of data before it’s evaluated.\nWe highly recommend you set this to false for sparse metrics,\notherwise some evaluations are skipped. Default is false. This setting only applies to\nmetric monitors.
scheduling_options
\nobject
Configuration options for scheduling.
custom_schedule
\nobject
Configuration options for the custom schedule. This feature is in private beta.
recurrences
\n[object]
Array of custom schedule recurrences.
rrule
\nstring
Defines the recurrence rule (RRULE) for a given schedule.
start
\nstring
Defines the start date and time of the recurring schedule.
timezone
\nstring
Defines the timezone the schedule runs on.
evaluation_window
\nobject
Configuration options for the evaluation window. If hour_starts is set, no other fields may be set. Otherwise, day_starts and month_starts must be set together.
day_starts
\nstring
The time of the day at which a one day cumulative evaluation window starts.
hour_starts
\nint32
The minute of the hour at which a one hour cumulative evaluation window starts.
month_starts
\nint32
The day of the month at which a one month cumulative evaluation window starts.
timezone
\nstring
The timezone of the time of the day of the cumulative evaluation window start.
silenced
\nobject
DEPRECATED: Information about the downtime applied to the monitor. Only shows v1 downtimes.
<any-key>
\nint64
UTC epoch timestamp in seconds when the downtime for the group expires.
synthetics_check_id
\nstring
DEPRECATED: ID of the corresponding Synthetic check.
threshold_windows
\nobject
Alerting time window options.
recovery_window
\nstring
Describes how long an anomalous metric must be normal before the alert recovers.
trigger_window
\nstring
Describes how long a metric must be anomalous before an alert triggers.
thresholds
\nobject
List of the different monitor threshold available.
critical
\ndouble
The monitor CRITICAL threshold.
critical_recovery
\ndouble
The monitor CRITICAL recovery threshold.
ok
\ndouble
The monitor OK threshold.
unknown
\ndouble
The monitor UNKNOWN threshold.
warning
\ndouble
The monitor WARNING threshold.
warning_recovery
\ndouble
The monitor WARNING recovery threshold.
timeout_h
\nint64
The number of hours of the monitor not reporting data before it automatically resolves from a triggered state. The minimum allowed value is 0 hours. The maximum allowed value is 24 hours.
variables
\n[ <oneOf>]
List of requests that can be used in the monitor query. This feature is currently in beta.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions cost query.
aggregator
\nenum
Aggregation methods for metric queries. \nAllowed enum values: avg,sum,max,min,last,area,l2norm,percentile,stddev
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name [required]
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The monitor query.
Option 3
\nobject
A formula and functions data quality query.
data_source [required]
\nenum
Data source for data quality queries. \nAllowed enum values: data_quality_metrics
filter [required]
\nstring
Filter expression used to match on data entities. Uses Aastra query syntax.
group_by
\n[string]
Optional grouping fields for aggregation.
measure [required]
\nstring
The data quality measure to query. Common values include:\nbytes, cardinality, custom, freshness, max, mean, min,\nnullness, percent_negative, percent_zero, row_count, stddev,\nsum, uniqueness. Additional values may be supported.
monitor_options
\nobject
Monitor configuration options for data quality queries.
crontab_override
\nstring
Crontab expression to override the default schedule.
custom_sql
\nstring
Custom SQL query for the monitor.
custom_where
\nstring
Custom WHERE clause for the query.
group_by_columns
\n[string]
Columns to group results by.
model_type_override
\nenum
Override for the model type used in anomaly detection. \nAllowed enum values: freshness,percentage,any
name [required]
\nstring
Name of the query for use in formulas.
schema_version
\nstring
Schema version for the data quality query.
scope
\nstring
Optional scoping expression to further filter metrics. Uses metrics filter syntax.\nThis is useful when an entity has been configured to emit metrics with additional tags.
Option 4
\nobject
A formula and functions aggregate augmented query. Used to enrich base query results with data from a reference table.
augment_query [required]
\n<oneOf>
Augment query for aggregate augmented queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute [required]
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate augmented queries. \nAllowed enum values: aggregate_augmented_query
group_by [required]
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
join_condition [required]
\nobject
Join condition for aggregate augmented queries.
augment_attribute [required]
\nstring
Attribute from the augment query to join on.
base_attribute [required]
\nstring
Attribute from the base query to join on.
join_type [required]
\nenum
Join type for aggregate query join conditions. \nAllowed enum values: inner,left
name
\nstring
Name of the query for use in formulas.
Option 5
\nobject
A formula and functions aggregate filtered query. Used to filter base query results using data from another source.
base_query [required]
\n<oneOf>
Base query for aggregate queries. Can be an events query or a metrics query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A formula and functions metrics query for use in aggregate queries.
aggregator
\nenum
Aggregator for metrics queries. \nAllowed enum values: avg,min,max,sum,last,mean,area,l2norm,percentile,stddevShow 1 more
,count_unique
data_source [required]
\nenum
Data source for metrics queries. \nAllowed enum values: metrics,cloud_cost,datadog_usage
name
\nstring
Name of the query for use in formulas.
query [required]
\nstring
The metrics query definition.
compute
\n[object]
Compute options for the query.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for aggregate filtered queries. \nAllowed enum values: aggregate_filtered_query
filter_query [required]
\n<oneOf>
Filter query for aggregate filtered queries. Can be an events query or a reference table query.
Option 1
\nobject
A formula and functions events query.
compute [required]
\nobject
Compute options.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
interval
\nint64
A time interval in milliseconds.
metric
\nstring
Measurable attribute to compute.
name
\nstring
The name assigned to this aggregation, when multiple aggregations are defined for a query.
data_source [required]
\nenum
Data source for event platform-based queries. \nAllowed enum values: rum,ci_pipelines,ci_tests,audit,events,logs,spans,database_queries,network,network_path
group_by
\n[object]
Group by options.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
indexes
\n[string]
An array of index names to query in the stream. Omit or use [] to query all indexes at once.
name [required]
\nstring
Name of the query for use in formulas.
search
\nobject
Search options.
query [required]
\nstring
Events search string.
Option 2
\nobject
A reference table query for use in aggregate queries.
columns
\n[object]
List of columns to retrieve from the reference table.
alias
\nstring
Optional alias for the column.
name [required]
\nstring
Name of the column.
data_source [required]
\nenum
Data source for reference table queries. \nAllowed enum values: reference_table
name
\nstring
Name of the query.
query_filter
\nstring
Optional filter expression for the reference table query.
table_name [required]
\nstring
Name of the reference table.
filters [required]
\n[object]
Filter conditions for the query.
base_attribute [required]
\nstring
Attribute from the base query to filter on.
exclude
\nboolean
Whether to exclude matching records instead of including them.
filter_attribute [required]
\nstring
Attribute from the filter query to match against.
group_by
\n[object]
Group by options for the query.
facet [required]
\nstring
Event facet.
limit
\nint64
Number of groups to return.
sort
\nobject
Options for sorting group by results.
aggregation [required]
\nenum
Aggregation methods for event platform queries. \nAllowed enum values: count,cardinality,median,pc75,pc90,pc95,pc98,pc99,sum,minShow 2 more
,max,avg
metric
\nstring
Metric used for sorting group by results.
order
\nenum
Direction of sort. \nAllowed enum values: asc,desc
default: desc
name
\nstring
Name of the query for use in formulas.
overall_state
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
priority
\nint64
Integer from 1 (high) to 5 (low) indicating alert severity.
query [required]
\nstring
The monitor query.
restricted_roles
\n[string]
A list of unique role identifiers to define which roles are allowed to edit the monitor. The unique identifiers for all roles can be pulled from the Roles API and are located in the data.id field. Editing a monitor includes any updates to the monitor configuration, monitor deletion, and muting of the monitor for any amount of time. You can use the Restriction Policies API to manage write authorization for individual monitors by teams and users, in addition to roles.
state
\nobject
Wrapper object with the different monitor states.
groups
\nobject
Dictionary where the keys are groups (comma separated lists of tags) and the values are\nthe list of groups your monitor is broken down on.
<any-key>
\nobject
Monitor state for a single group.
last_nodata_ts
\nint64
Latest timestamp the monitor was in NO_DATA state.
last_notified_ts
\nint64
Latest timestamp of the notification sent for this monitor group.
last_resolved_ts
\nint64
Latest timestamp the monitor group was resolved.
last_triggered_ts
\nint64
Latest timestamp the monitor group triggered.
name
\nstring
The name of the monitor.
status
\nenum
The different states your monitor can be in. \nAllowed enum values: Alert,Ignored,No Data,OK,Skipped,Unknown,Warn
tags
\n[string]
Tags associated to your monitor.
type [required]
\nenum
The type of the monitor. For more information about type, see the monitor options docs. \nAllowed enum values: composite,event alert,log alert,metric alert,process alert,query alert,rum alert,service check,synthetics alert,trace-analytics alertShow 11 more
,slo alert,event-v2 alert,audit alert,ci-pipelines alert,ci-tests alert,error-tracking alert,database-monitoring alert,network-performance alert,cost alert,data-quality alert,network-path alert