From Datadog

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/datadog"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/40a517c7-223e-4174-8543-091459d67657/social-card.svg?v=3e7ae33eec8b" alt="From Datadog" width="600" height="315"></a>
wtctl import datadog --monitors monitors.json --dashboards dash.json --pipelines pipelines.json [--apply]
wtctl import datadog --monitors api --dashboards api --api-key-env DD_API_KEY --app-key-env DD_APP_KEY [--site datadoghq.eu]

A file is a JSON export (an array for monitors and pipelines, one object or an array for dashboards). api reads the live account.

Monitors to alert rules

Datadog

Watchtower

metric alert, query alert with one windowed comparison, e.g. avg(last_5m):avg:system.cpu.user{env:prod} by {host} > 90

metric rule with PromQL avg by (host) (system_cpu_user{env="prod"})

log alert, logs("...").rollup("count").last("5m") > 10

log rule; the search text passes through (check it with the translate route)

APM error ratio (trace.*.errors / trace.*.hits{service:x})

error_rate rule; the 0..1 ratio becomes a percentage

composite

composite rule over the imported child rules (at most 5)

The critical threshold is used; a warning threshold is reported as a warning. Functions, formulas, anomaly and forecast queries, synthetics, service checks and every other type are listed under unsupported.

Dashboards

timeseries, toplist (table), query_value (stat), heatmap (histogram), table, log_stream and note widgets. Note text is appended to the dashboard description. The 12-column grid is doubled to 24. Widgets whose query is not a plain aggregation are listed as unsupported.

Log pipelines

Processors map to stages parse_json (grok %{data::json}), redact, filter (the pipeline query), enrich (remappers) and expr (arithmetic). The result is in the report only: there is no pipeline write API yet, so --apply does not send pipelines.

Updated