Migrating to Watchtower

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/readme"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/713b6ba1-7450-4a46-833b-f2642dcce263/social-card.svg?v=3e7ae33eec8b" alt="Migrating to Watchtower" width="600" height="315"></a>

wtctl import reads another product's configuration and maps it onto Watchtower resources.

From

Command

Guide

Datadog monitors, dashboards, log pipelines

wtctl import datadog

datadog.md

Grafana dashboards and alert rules

wtctl import grafana

grafana.md

Splunk searches

POST /v1/translate/log-query (dialect spl)

splunk.md

VictorOps, Grafana OnCall

wtctl import victorops, wtctl import grafana-oncall

oncall.md

PagerDuty, Opsgenie

wtctl import pagerduty, wtctl import opsgenie

oncall.md

New Relic NRQL policies and dashboards

wtctl import newrelic --alerts policies.json --dashboards dash.json

exports.md

Splunk saved-search alerts

wtctl import splunk --alerts saved-searches.json

exports.md

Prometheus rule files and Alertmanager config; Chronosphere

wtctl import promrules --alerts rules.yaml --alertmanager am.yaml (chronosphere is an alias)

exports.md

Sentry, Honeycomb, Dynatrace, Kibana

wtctl import sentry, honeycomb, dynatrace, kibana

exports.md

Splunk On-Call (VictorOps), Opsgenie (end of sale), Grafana OnCall OSS (frozen)

wtctl import victorops (alias splunk-on-call), opsgenie, grafana-oncall

oncall.md

Helicone, Traceloop, Galileo (acquired or rebranded)

wtctl import helicone --file <export.jsonl> for Helicone history; point the OTLP exporter at the Watchtower gateway (OpenLLMetry spans are ingested as is)

exports.md

How every importer behaves:

  • Dry run by default (datadog, grafana, victorops, grafana-oncall). Add --apply to write through the API. Each created object is sent with Idempotency-Key: import:<source>:<id> and found again by name, so a second run creates nothing.

  • A report on every run: --report <prefix> writes <prefix>.json and <prefix>.md with imported, mapped, unsupported (kind, name, reason) and warnings. Nothing is dropped silently.

  • The API address and key come from --api, --key, --project (or WT_API, WT_API_KEY, WT_PROJECT). Vendor keys are read from the environment variable you name, never from a flag value.

  • Imported objects never carry wt.* attributes; labels with that prefix are dropped.

  • Log queries inside dashboards are translated by the API (/v1/translate/log-query), so the importer needs the project API even for a dry run.

How imports run (DX-21)

wtctl import <source> --alerts ... --dashboards ... [--apply] and wtctl datasets import <file> upload the export file to POST /v1/projects/{p}/imports and poll GET /v1/projects/{p}/imports/{id}; the mappings run server-side in the notifier's import runner, so the public CLI carries none of them. Export-file sources only (datadog, grafana, newrelic, splunk, promrules, chronosphere, sentry, honeycomb, dynatrace, kibana). The API-pull importers (pagerduty, opsgenie, victorops, grafana-oncall, and Datadog --api-key-env) are not offered by the public CLI yet. Uploads are capped at 10 MiB, stored sealed and deleted when the job ends or after one hour.

Updated