{"id":41301,"date":"2026-06-23T01:47:01","date_gmt":"2026-06-23T01:47:01","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=41301"},"modified":"2026-06-23T01:48:50","modified_gmt":"2026-06-23T01:48:50","slug":"what-is-datadog","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/what-is-datadog\/","title":{"rendered":"What is Datadog: Observability, Monitoring, SIEM, AIOps, Security, and DevOps Platform"},"content":{"rendered":"\n

Datadog<\/strong> is a SaaS-based observability, monitoring, security, and service-management platform used by DevOps, SRE, platform, application, security, and business teams to understand the health, performance, reliability, cost, and security posture of modern systems.<\/p>\n\n\n\n

In simple words:<\/p>\n\n\n

Datadog = one platform to collect, correlate, visualize, alert, investigate, and automate around your systems.\n<\/code><\/span><\/pre>\n\n\n
It can monitor:<\/p>\n\n\n
Servers\nContainers\nKubernetes \/ EKS \/ GKE \/ AKS\nApplications\nAPIs\nDatabases\nLogs\nTraces\nUser experience\nSynthetic tests\nCloud costs\nSecurity threats\nCloud misconfigurations\nCI\/CD pipelines\nIncidents\nSLOs\nAI\/LLM applications\n<\/code><\/span><\/pre>\n\n\n
Datadog currently positions its platform around Observability, Security, Digital Experience, Software Delivery, Service Management, AI, and Platform Capabilities<\/strong>. Its official product navigation includes infrastructure monitoring, metrics, network monitoring, container monitoring, Kubernetes autoscaling, serverless, cloud cost management, APM, log management, Error Tracking, Cloud SIEM, Cloud Security, RUM, Synthetic Monitoring, CI Visibility, DORA metrics, Incident Response, SLOs, Workflow Automation, Watchdog, and Bits AI. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
1. Why Datadog exists<\/h1>\n\n\n\n
Modern systems are no longer simple.<\/p>\n\n\n\n
Earlier, we had:<\/p>\n\n\n
One application\nOne server\nOne database\nOne log file\n<\/code><\/span><\/pre>\n\n\n
Now we have:<\/p>\n\n\n
Microservices\nContainers\nKubernetes\nMultiple cloud providers\nServerless functions\nManaged databases\nMessage queues\nCDN\nMobile apps\nFrontend apps\nThird-party APIs\nSecurity events\nCI\/CD pipelines\nAI\/LLM apps\n<\/code><\/span><\/pre>\n\n\n
When something breaks, the real question is not only:<\/p>\n\n\n
Is the server up?\n<\/code><\/span><\/pre>\n\n\n
The real questions are:<\/p>\n\n\n
Which service is slow?\nWhich deployment caused the issue?\nWhich pod\/container has errors?\nWhich API endpoint is failing?\nWhich user journey is impacted?\nIs this<\/span> an infra issue, app issue, database issue, network issue, or security issue?\nDid cost suddenly increase?\nDid a security threat happen?\nCan we detect it earlier next time?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Datadog helps answer these questions by collecting telemetry from many places and correlating it in one platform.<\/p>\n\n\n\n
\n\n\n\n
2. Monitoring vs observability<\/h1>\n\n\n\n
Traditional monitoring<\/h2>\n\n\n\n
Monitoring usually answers known questions:<\/p>\n\n\n
CPU is high?\nDisk is full?\nService is down?\nEndpoint returns 500?\n<\/code><\/span><\/pre>\n\n\n
This is useful, but limited.<\/p>\n\n\n\n
Observability<\/h2>\n\n\n\n
Observability helps investigate unknown problems:<\/p>\n\n\n
Why<\/span> did<\/span> latency<\/span> increase<\/span> only<\/span> for<\/span> one<\/span> region<\/span>?\nWhy<\/span> did<\/span> checkout<\/span> fail<\/span> only<\/span> after<\/span> version<\/span> 1.8<\/span>.4<\/span>?\nWhy<\/span> are<\/span> only<\/span> Android<\/span> users<\/span> seeing<\/span> errors<\/span>?\nWhy<\/span> is<\/span> one<\/span> Kubernetes<\/span> node<\/span> causing<\/span> more<\/span> failures<\/span>?\nWhich<\/span> downstream<\/span> service<\/span> caused<\/span> this<\/span> trace<\/span> to<\/span> fail<\/span>?\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Observability usually depends on four major telemetry pillars:<\/p>\n\n\n
Metrics\nLogs\nTraces\nEvents\n<\/code><\/span><\/pre>\n\n\n
Datadog also adds more data types:<\/p>\n\n\n
Profiles\nRUM sessions\nSynthetic tests\nSecurity signals\nCloud cost data\nCI\/CD data\nDeployment data\nService ownership data\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
3. Datadog high-level architecture<\/h1>\n\n\n
flowchart<\/span> TD<\/span>\n    A<\/span>[Applications]<\/span> --<\/span>> B<\/span>[Datadog Agent \/ SDK \/ OpenTelemetry]<\/span>\n    C<\/span>[Servers \/ VMs]<\/span> --<\/span>> B<\/span>\n    D<\/span>[Kubernetes \/ Containers]<\/span> --<\/span>> B<\/span>\n    E<\/span>[Cloud Providers: AWS Azure GCP]<\/span> --<\/span>> F<\/span>[Datadog Cloud Integrations]<\/span>\n    G<\/span>[Databases \/ Queues \/ SaaS Tools]<\/span> --<\/span>> H<\/span>[Datadog Integrations]<\/span>\n    I<\/span>[Frontend \/ Mobile Apps]<\/span> --<\/span>> J<\/span>[RUM SDK]<\/span>\n    K<\/span>[Synthetic Tests]<\/span> --<\/span>> L<\/span>[Datadog Managed or Private Locations]<\/span>\n    M<\/span>[Security Logs \/ Cloud Audit Logs]<\/span> --<\/span>> N<\/span>[Cloud SIEM \/ Cloud Security]<\/span>\n\n    B<\/span> --<\/span>> O<\/span>[Datadog Platform]<\/span>\n    F<\/span> --<\/span>> O<\/span>\n    H<\/span> --<\/span>> O<\/span>\n    J<\/span> --<\/span>> O<\/span>\n    L<\/span> --<\/span>> O<\/span>\n    N<\/span> --<\/span>> O<\/span>\n\n    O<\/span> --<\/span>> P<\/span>[Dashboards]<\/span>\n    O<\/span> --<\/span>> Q<\/span>[Monitors and Alerts]<\/span>\n    O<\/span> --<\/span>> R<\/span>[APM Service Map]<\/span>\n    O<\/span> --<\/span>> S<\/span>[Log Explorer]<\/span>\n    O<\/span> --<\/span>> T<\/span>[Error Tracking]<\/span>\n    O<\/span> --<\/span>> U<\/span>[SIEM Signals]<\/span>\n    O<\/span> --<\/span>> V<\/span>[Watchdog \/ Bits AI]<\/span>\n    O<\/span> --<\/span>> W<\/span>[Incident Response \/ SLOs]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
4. Main Datadog components<\/h1>\n\n\n\n
4.1 Datadog Agent<\/h2>\n\n\n\n
The Datadog Agent<\/strong> is a lightweight process installed on hosts, containers, or Kubernetes nodes. It collects infrastructure metrics, logs, traces, events, and integration data, then sends them to Datadog.<\/p>\n\n\n\n
Typical Agent use cases:<\/p>\n\n\n
Collect host CPU, memory, disk, network\nCollect container and Kubernetes metrics\nCollect application logs\nReceive APM traces\nReceive DogStatsD custom metrics\nRun integration checks\nSend events and service checks\n<\/code><\/span><\/pre>\n\n\n
The Agent is the foundation for most infrastructure and application observability.<\/p>\n\n\n\n
\n\n\n\n
4.2 Datadog Cluster Agent<\/h2>\n\n\n\n
In Kubernetes, Datadog often uses:<\/p>\n\n\n
Datadog Agent DaemonSet\nDatadog Cluster Agent Deployment\n<\/code><\/span><\/pre>\n\n\n
The Agent runs on each node, while the Cluster Agent handles cluster-level metadata, Kubernetes API communication, cluster checks, and scaling-related features.<\/p>\n\n\n\n
For EKS\/GKE\/AKS, this pattern is common:<\/p>\n\n\n
One Datadog Agent pod per node\nOne or<\/span> more Cluster Agent pods per cluster\nApplication pods emit logs, metrics, traces\nDatadog adds pod, namespace<\/span>, deployment<\/span>, node<\/span>, and<\/span> cluster<\/span> metadata<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Datadog\u2019s Kubernetes documentation includes Kubernetes monitoring as a first-class setup path and integrates it with containers, Autodiscovery, the Datadog Operator, logs, APM, security, and tagging. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
4.3 Integrations<\/h2>\n\n\n\n
Datadog integrations connect external systems to Datadog.<\/p>\n\n\n\n
Examples:<\/p>\n\n\n
AWS\nAzure\nGoogle Cloud\nKubernetes\nDocker\nPostgreSQL\nMySQL\nRedis\nKafka\nNGINX\nEnvoy\nIstio\nTerraform\nGitHub\nGitLab\nPagerDuty\nSlack\nJira\nServiceNow\n<\/code><\/span><\/pre>\n\n\n
An integration usually provides:<\/p>\n\n\n
Default<\/span> metrics\nDefault<\/span> dashboards\nRecommended monitors\nLog pipelines\nMetadata\nService checks\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
4.4 APIs and Terraform<\/h2>\n\n\n\n
Datadog can be managed manually through UI, or as code using:<\/p>\n\n\n
Datadog API\nTerraform provider\nCI\/CD pipelines\nDashboard JSON<\/span>\nMonitor definitions\nSLO definitions\nSynthetic test definitions\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
For enterprise teams, Datadog-as-code is a big deal because dashboards, monitors, synthetics, and SLOs should be version-controlled like application code.<\/p>\n\n\n\n
\n\n\n\n
5. Core Datadog data types<\/h1>\n\n\n\n
5.1 Metrics<\/h2>\n\n\n\n
Metrics are numeric time-series data.<\/p>\n\n\n\n
Examples:<\/p>\n\n\n
CPU usage\nMemory usage\nRequest count\nError<\/span> count\nLatency p95\nQueue lag\nPod restart count\nDatabase connections\nKafka consumer lag\nCustom business events\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Metric example:<\/p>\n\n\n
system<\/span>.cpu<\/span>.user<\/span>{host<\/span>:api-01<\/span>,env:prod}\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Useful metric questions:<\/p>\n\n\n
How many requests per minute?\nWhat is the error rate?\nWhat is p95 latency?\nWhich pod has high CPU?\nDid cost increase this<\/span> week?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
5.2 Logs<\/h2>\n\n\n\n
Logs are event records from applications and infrastructure.<\/p>\n\n\n\n
Examples:<\/p>\n\n\n
Application error logs\nNginx access logs\nKubernetes pod logs\nAWS CloudTrail logs\nDatabase slow query logs\nSecurity audit logs\n<\/code><\/span><\/pre>\n\n\n
Datadog Log Management supports collecting logs from hosts, containers, cloud providers, and other sources. It provides Log Explorer, Live Tail, log analytics, patterns, saved views, pipelines, processors, indexes, archives, and log-to-trace\/log-to-metric correlation. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Good log format:<\/p>\n\n\n
{\n  \"timestamp\"<\/span>: \"2026-06-23T10:00:00Z\"<\/span>,\n  \"level\"<\/span>: \"error\"<\/span>,\n  \"service\"<\/span>: \"checkout-api\"<\/span>,\n  \"env\"<\/span>: \"prod\"<\/span>,\n  \"version\"<\/span>: \"1.8.4\"<\/span>,\n  \"message\"<\/span>: \"Payment failed\"<\/span>,\n  \"error.kind\"<\/span>: \"PaymentTimeoutException\"<\/span>,\n  \"error.message\"<\/span>: \"Payment provider timeout\"<\/span>,\n  \"trace_id\"<\/span>: \"123456789\"<\/span>,\n  \"user_region\"<\/span>: \"JP\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
5.3 Traces<\/h2>\n\n\n\n
Traces show how a request moves across services.<\/p>\n\n\n\n
Example:<\/p>\n\n\n
User request\n  \u2192 frontend\n  \u2192 checkout-api\n  \u2192 payment-service\n  \u2192 PostgreSQL\n  \u2192 external payment gateway\n<\/code><\/span><\/pre>\n\n\n
A trace helps answer:<\/p>\n\n\n
Which service was slow?\nWhich downstream dependency failed?\nWhich database query caused delay?\nWhich API version caused error?\n<\/code><\/span><\/pre>\n\n\n
Datadog APM provides distributed tracing, dashboards, service\/resource pages, Trace Explorer, deployment comparison, and correlation with logs, RUM, synthetics, DBM, and profiles. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
5.4 Events<\/h2>\n\n\n\n
Events are notable happenings.<\/p>\n\n\n\n
Examples:<\/p>\n\n\n
Deployment completed\nPod restarted\nAutoscaling happened\nMonitor triggered\nFeature flag changed\nIncident declared\nSecurity signal generated\nCloud resource changed\n<\/code><\/span><\/pre>\n\n\n
Events are useful because many incidents start right after a change.<\/p>\n\n\n\n
\n\n\n\n
5.5 Profiles<\/h2>\n\n\n\n
Continuous profiling shows where application code spends CPU, memory, lock, or wall time.<\/p>\n\n\n\n
It helps answer:<\/p>\n\n\n
Which function<\/span> consumes<\/span> most<\/span> CPU<\/span>?\nWhy<\/span> is<\/span> memory<\/span> increasing<\/span>?\nWhich<\/span> code<\/span> path<\/span> is<\/span> expensive<\/span>?\nWhat<\/span> changed<\/span> after<\/span> deployment<\/span>?\n<\/span><\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
APM tells you which request is slow<\/strong>. Profiling helps tell you which code inside that request is expensive<\/strong>.<\/p>\n\n\n\n
\n\n\n\n
5.6 RUM sessions<\/h2>\n\n\n\n
RUM means Real User Monitoring<\/strong>. It captures real user experience from browser and mobile apps.<\/p>\n\n\n\n
Datadog RUM provides visibility into real user activity and user experience, including web page performance, mobile screen performance, user actions, network requests, frontend errors, user journeys, device\/OS\/country analytics, and feature usage. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
RUM answers:<\/p>\n\n\n
Are real users impacted?\nWhich browser\/device has problems?\nWhich page is slow?\nWhich user journey is broken?\nAre frontend errors connected to backend traces?\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
5.7 Synthetic test results<\/h2>\n\n\n\n
Synthetic Monitoring checks your system from outside.<\/p>\n\n\n\n
Datadog Synthetic tests simulate requests and user actions from global locations. They support webpages, APIs, and network-level checks including HTTP, SSL, DNS, WebSocket, TCP, UDP, ICMP, and gRPC. They can alert on regressions, broken features, high response time, and unexpected status codes. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Synthetic examples:<\/p>\n\n\n
HTTP API uptime check\ngRPC health check\nBrowser login journey\nDNS check\nSSL certificate expiry check\nTCP port check\nPrivate endpoint check from<\/span> inside VPC\/VPN\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
5.8 Security signals<\/h2>\n\n\n\n
Cloud SIEM and security products generate security signals.<\/p>\n\n\n\n
Examples:<\/p>\n\n\n
Suspicious IAM activity\nImpossible travel login\nPrivilege escalation\nPublic<\/span> S3 bucket\nContainer runtime threat\nCloudTrail anomaly\nKubernetes suspicious exec\nSQL injection attempt\nLeaked secret\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
6. Datadog product areas<\/h1>\n\n\n\n
Datadog is no longer only \u201cmonitoring.\u201d It is now a big platform. Best mental model:<\/p>\n\n\n
Observability\nSecurity\nDigital Experience\nSoftware Delivery\nService Management\nAIOps \/ AI\nPlatform Capabilities\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
7. Observability products<\/h1>\n\n\n\n
7.1 Infrastructure Monitoring<\/h2>\n\n\n\n
Used for:<\/p>\n\n\n
VMs\nBare metal servers\nCloud instances\nDisk\nCPU\nMemory\nNetwork\nProcesses\nSystem load\nHost health\n<\/code><\/span><\/pre>\n\n\n
Typical dashboard:<\/p>\n\n\n
CPU usage by host\nMemory by host\nDisk usage by mount\nNetwork throughput\nTop hosts by load\nHost availability\n<\/code><\/span><\/pre>\n\n\n
Best practice:<\/p>\n\n\n
Tag all hosts by env, service, team, region, account, cluster.\n<\/code><\/span><\/pre>\n\n\n
Example tags:<\/p>\n\n\n
env<\/span>:prod<\/span>\nteam<\/span>:platform<\/span>\ncloud<\/span>:aws<\/span>\nregion<\/span>:ap-northeast-1<\/span>\nservice<\/span>:checkout-api<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
7.2 Container and Kubernetes Monitoring<\/h2>\n\n\n\n
Used for:<\/p>\n\n\n
Pods\nContainers\nNodes\nDeployments\nReplicaSets\nDaemonSets\nStatefulSets\nNamespaces\nCluster events\nPod restarts\nOOMKilled events\nCrashLoopBackOff\nResource requests\/limits\n<\/code><\/span><\/pre>\n\n\n
For EKS\/GKE\/AKS, a strong setup includes:<\/p>\n\n\n
Datadog Agent as<\/span> DaemonSet\nDatadog Cluster Agent\nKubernetes state metrics\nContainer logs\nAPM tracing\nUnified service tagging\nProcess monitoring if<\/span> needed\nNetwork monitoring if<\/span> needed\nSecurity monitoring if<\/span> needed\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Common Kubernetes questions Datadog helps answer:<\/p>\n\n\n
Which pod is restarting?\nWhich deployment has high errors?\nWhich namespace<\/span> consumes<\/span> most<\/span> CPU<\/span>?\nWhich<\/span> node<\/span> is<\/span> unhealthy<\/span>?\nWhich<\/span> container<\/span> image<\/span> version<\/span> is<\/span> failing<\/span>?\nWhich<\/span> cluster<\/span> has<\/span> capacity<\/span> pressure<\/span>?\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
7.3 Network Monitoring<\/h2>\n\n\n\n
Network monitoring helps understand service-to-service communication.<\/p>\n\n\n\n
Used for:<\/p>\n\n\n
Traffic between services\nCloud network dependencies\nPacket loss\nDNS failures\nConnection volume\nNetwork path\nLoad balancer traffic\n<\/code><\/span><\/pre>\n\n\n
Useful when troubleshooting:<\/p>\n\n\n
API latency due to network?\nService cannot reach database?\nCross-AZ traffic increase?\nExternal dependency slow?\nDNS issue?\nFirewall\/security group issue?\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
7.4 Serverless Monitoring<\/h2>\n\n\n\n
Used for:<\/p>\n\n\n
AWS Lambda\nServerless traces\nCold starts\nInvocation count\nErrors\nDuration\nTimeouts\nMemory usage\nCloud provider logs\n<\/code><\/span><\/pre>\n\n\n
Useful for cloud-native apps where there is no traditional server.<\/p>\n\n\n\n
\n\n\n\n
7.5 Database Monitoring<\/h2>\n\n\n\n
Database Monitoring gives visibility into:<\/p>\n\n\n
Query performance\nSlow queries\nLock contention\nDatabase load\nConnections\nExecution plans\nWait events\n<\/code><\/span><\/pre>\n\n\n
Common DB use cases:<\/p>\n\n\n
Which query is slow?\nWhich service is causing DB load?\nDid deployment increase query time?\nIs database saturated?\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
7.6 Data Streams Monitoring<\/h2>\n\n\n\n
Useful for event-driven systems.<\/p>\n\n\n\n
Examples:<\/p>\n\n\n
Kafka\nRabbitMQ\nKinesis\nPub\/Sub\nStreaming pipelines\n<\/code><\/span><\/pre>\n\n\n
Questions it helps answer:<\/p>\n\n\n
Where is event lag building?\nWhich consumer is slow?\nWhich topic has backlog?\nIs message processing delayed?\n<\/code><\/span><\/pre>\n\n\n
For your Kafka\/telematics kind of architecture, this is very relevant.<\/p>\n\n\n\n
\n\n\n\n
7.7 Cloud Cost Management<\/h2>\n\n\n\n
Cloud Cost Management helps monitor cost by:<\/p>\n\n\n
Cloud account\nProject\nService\nRegion\nKubernetes workload\nTeam\nEnvironment\nProduct\n<\/code><\/span><\/pre>\n\n\n
Typical FinOps questions:<\/p>\n\n\n
Which environment costs most?\nWhich service increased cost?\nWhich Kubernetes namespace<\/span> is<\/span> expensive<\/span>?\nDid<\/span> a<\/span> deployment<\/span> increase<\/span> cost<\/span>?\nAre<\/span> idle<\/span> resources<\/span> wasting<\/span> money<\/span>?\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
8. Application observability products<\/h1>\n\n\n\n
8.1 APM<\/h2>\n\n\n\n
Application Performance Monitoring is one of Datadog\u2019s strongest areas.<\/p>\n\n\n\n
It helps monitor:<\/p>\n\n\n
Request rate\nError<\/span> rate\nLatency\np50\/p95\/p99 duration\nService dependencies\nEndpoint performance\nDatabase calls\nExternal API calls\nDeployment impact\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
APM flow:<\/p>\n\n\n
sequenceDiagram\n    participant User\n    participant FE as<\/span> Frontend\n    participant API as<\/span> checkout-api\n    participant PAY as<\/span> payment-service\n    participant DB as<\/span> PostgreSQL\n    participant DD as<\/span> Datadog APM\n\n    User->>FE: Click checkout\n    FE->>API: POST \/checkout\n    API->>PAY: Create payment\n    PAY->>DB: Insert transaction\n    DB-->>PAY: OK\n    PAY-->>API: Timeout\/Error<\/span>\n    API-->>DD: Trace with<\/span> error\n    DD-->>DD: Correlate trace, logs, metrics, deployment, pod\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
APM is where you see:<\/p>\n\n\n
Service Map<\/span>\nTrace Explorer\nEndpoint latency\nError<\/span> traces\nSlow spans\nDeployment comparison\nService ownership\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Datadog APM\u2019s Trace Explorer lets teams search and analyze traces in real time, identify performance bottlenecks, troubleshoot errors, and pivot to related logs and metrics. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
8.2 Universal Service Monitoring<\/h2>\n\n\n\n
Universal Service Monitoring can discover service communication without full code instrumentation in some scenarios. This is useful when you want a service map quickly but have not yet instrumented every application.<\/p>\n\n\n\n
Best use:<\/p>\n\n\n
Initial discovery\nLegacy services\nService dependency mapping\nBefore full APM rollout\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
8.3 Error Tracking<\/h2>\n\n\n\n
Error Tracking groups similar application errors into issues.<\/p>\n\n\n\n
It is useful as a Sentry-like capability.<\/p>\n\n\n\n
It helps answer:<\/p>\n\n\n
What are the top application errors?\nIs this<\/span> error new<\/span>?\nDid this<\/span> error regress after deployment?\nWhich version introduced it?\nWhich team owns it?\nWhich logs\/traces\/session replays are related?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Error Tracking can work from:<\/p>\n\n\n
APM errors\nLogs\nRUM browser errors\nMobile crashes\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
8.4 Continuous Profiler<\/h2>\n\n\n\n
Profiler tells you where your code is spending resources.<\/p>\n\n\n\n
Use it when:<\/p>\n\n\n
CPU is high but traces are not enough\nMemory is increasing\nA specific endpoint is slow\nYou need code-level optimization\n<\/code><\/span><\/pre>\n\n\n
Example:<\/p>\n\n\n
APM says \/checkout is slow\nProfiler says JSON<\/span> serialization consumes 40<\/span>% CPU\nLogs show large payloads\nFix payload handling\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
8.5 Dynamic Instrumentation<\/h2>\n\n\n\n
Dynamic Instrumentation lets teams add observability into running applications without always changing code and redeploying. It is useful when debugging production problems where you need extra context but cannot safely add noisy logs everywhere.<\/p>\n\n\n\n
Use carefully in production with ownership, access control, and guardrails.<\/p>\n\n\n\n
\n\n\n\n
8.6 LLM Observability<\/h2>\n\n\n\n
Modern Datadog also includes AI\/LLM observability capabilities for teams building AI applications.<\/p>\n\n\n\n
Use cases:<\/p>\n\n\n
Monitor LLM latency\nTrack token usage\nTrack prompt\/response quality\nMonitor model errors\nDebug AI agent workflows\nUnderstand cost by model\/provider\nDetect regressions in AI behavior\n<\/code><\/span><\/pre>\n\n\n
Datadog\u2019s current platform navigation lists AI Observability, LLM Observability, AI integrations, GPU Monitoring, and Bits AI agents as part of its AI product area. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
9. Log Management<\/h1>\n\n\n\n
Datadog Log Management helps collect, process, search, analyze, archive, and correlate logs.<\/p>\n\n\n\n
Main features:<\/p>\n\n\n
Log collection\nLog pipelines\nParsing\nProcessors\nFacets\nIndexes\nFlex Logs\nArchives\nRehydration\nLive Tail\nLog Explorer\nPatterns\nLog analytics\nLog-based metrics\nSensitive data scanning\n<\/code><\/span><\/pre>\n\n\n
Log pipeline example:<\/p>\n\n\n
flowchart<\/span> LR<\/span>\n    A<\/span>[Application stdout\/stderr]<\/span> --<\/span>> B<\/span>[Datadog Agent]<\/span>\n    B<\/span> --<\/span>> C<\/span>[Log Pipeline]<\/span>\n    C<\/span> --<\/span>> D<\/span>[Parser]<\/span>\n    D<\/span> --<\/span>> E<\/span>[Processor]<\/span>\n    E<\/span> --<\/span>> F<\/span>[Index or Archive]<\/span>\n    F<\/span> --<\/span>> G<\/span>[Log Explorer]<\/span>\n    G<\/span> --<\/span>> H<\/span>[Dashboards \/ Monitors \/ SIEM \/ Error Tracking]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Best practices:<\/p>\n\n\n
Use JSON<\/span> logs where possible.\nAlways include service, env, version.\nInclude trace_id and span_id for<\/span> trace correlation.\nDo not log secrets, tokens, passwords, PII, or raw payment data.\nUse log indexes carefully to control cost.\nArchive long-term logs for<\/span> compliance.\nGenerate metrics from<\/span> logs only for<\/span> important signals.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
10. Digital Experience Monitoring<\/h1>\n\n\n\n
Digital Experience covers what real or simulated users experience.<\/p>\n\n\n\n
10.1 RUM<\/h2>\n\n\n\n
RUM shows real users.<\/p>\n\n\n\n
Use it for:<\/p>\n\n\n
Page load time\nFrontend errors\nUser sessions\nUser actions\nMobile screen performance\nBrowser\/device\/OS analysis\nGeographic performance\nSession Replay\nFrontend-to-backend trace correlation\n<\/code><\/span><\/pre>\n\n\n
RUM is best when product, frontend, and backend teams need shared visibility.<\/p>\n\n\n\n
Example:<\/p>\n\n\n
Japan<\/span> users<\/span> on<\/span> Android<\/span> app<\/span> version<\/span> 5.4<\/span> are<\/span> seeing<\/span> checkout<\/span> errors<\/span>.\nBackend<\/span> trace<\/span> shows<\/span> payment-service<\/span> timeout<\/span>.\nAPM<\/span> shows<\/span> the<\/span> timeout<\/span> started<\/span> after<\/span> version<\/span> 1.8<\/span>.4<\/span>.\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
10.2 Session Replay<\/h2>\n\n\n\n
Session Replay helps see what the user did before an error.<\/p>\n\n\n\n
Useful for:<\/p>\n\n\n
Frontend debugging\nUX issue investigation\nBug reproduction\nSupport team investigation\n<\/code><\/span><\/pre>\n\n\n
Use privacy controls carefully.<\/p>\n\n\n\n
\n\n\n\n
10.3 Synthetic Monitoring<\/h2>\n\n\n\n
Synthetic tests are simulated checks.<\/p>\n\n\n\n
Use them for:<\/p>\n\n\n
Availability checks\nAPI uptime\nLogin journey\nPayment journey\nSSL expiry\nDNS resolution\ngRPC service checks\nPrivate<\/span> endpoint monitoring\nRelease validation\nSLO measurement\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Datadog supports creating synthetic tests in the UI, through API, or Terraform. API tests can verify systems across HTTP, SSL, DNS, WebSocket, TCP, UDP, ICMP, and gRPC; browser tests monitor end-to-end webpage journeys; mobile app tests monitor iOS and Android app flows. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Synthetic test flow:<\/p>\n\n\n
flowchart TD\n    A[Datadog Synthetic Location] --> B[Call API or Browser Journey]\n    B --> C{Success?}\n    C -->|Yes| D[Record Latency and Availability]\n    C -->|No| E[Alert]\n    E --> F[Connect to APM Trace]\n    F --> G[Root Cause: frontend, backend, network, or dependency]\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
11. Security products<\/h1>\n\n\n\n
Datadog has moved deeply into DevSecOps and cloud security.<\/p>\n\n\n\n
11.1 Cloud SIEM<\/h2>\n\n\n\n
Cloud SIEM means Security Information and Event Management<\/strong>.<\/p>\n\n\n\n
It collects security telemetry and detects threats.<\/p>\n\n\n\n
Sources:<\/p>\n\n\n
AWS CloudTrail\nGCP audit logs\nAzure logs\nKubernetes audit logs\nFirewall logs\nIdentity provider logs\nApplication logs\nContainer runtime events\nEndpoint\/security tools\n<\/code><\/span><\/pre>\n\n\n
Cloud SIEM helps with:<\/p>\n\n\n
Threat detection\nSecurity signal generation\nInvestigation\nDetection rules\nMITRE ATT&CK mapping\nContent packs\nSecurity dashboards\nSOAR workflows\nCase<\/span> management\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
11.2 Cloud Security Management<\/h2>\n\n\n\n
Cloud Security focuses on posture, identity, vulnerability, and cloud risk.<\/p>\n\n\n\n
It helps detect:<\/p>\n\n\n
Cloud misconfigurations\nOver-permissive IAM roles\nPublicly exposed resources\nVulnerable hosts\/images\/functions\nCompliance violations\nRisky cloud relationships\nSensitive data exposure\n<\/code><\/span><\/pre>\n\n\n
Datadog Cloud Security provides continuous configuration audits, identity risk assessment, vulnerability detection, real-time threat detection, security posture score, findings, Security Graph, Resource Catalog, Cloudcraft security maps, and remediation guidance. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Security Graph example:<\/p>\n\n\n
flowchart<\/span> LR<\/span>\n    A<\/span>[Public Internet]<\/span> --<\/span>> B<\/span>[Public Load Balancer]<\/span>\n    B<\/span> --<\/span>> C<\/span>[EC2 \/ EKS Node]<\/span>\n    C<\/span> --<\/span>> D<\/span>[IAM Role]<\/span>\n    D<\/span> --<\/span>> E<\/span>[S3 Bucket]<\/span>\n    E<\/span> --<\/span>> F<\/span>[Sensitive Data Risk]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
This is powerful because security teams can see relationships, not just isolated findings.<\/p>\n\n\n\n
\n\n\n\n
11.3 Workload Protection<\/h2>\n\n\n\n
Used for runtime protection of workloads.<\/p>\n\n\n\n
Typical detections:<\/p>\n\n\n
Suspicious process execution\nContainer escape<\/span> attempts\nSensitive file access\nUnexpected shell in<\/span> container\nCrypto-mining behavior\nRuntime threat activity\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Very useful for Kubernetes and container workloads.<\/p>\n\n\n\n
\n\n\n\n
11.4 App and API Protection<\/h2>\n\n\n\n
Protects applications and APIs from attacks.<\/p>\n\n\n\n
Use cases:<\/p>\n\n\n
Detect SQL injection\nDetect SSRF attempts\nDetect command injection\nDetect auth abuse\nBlock or monitor malicious requests\nCorrelate attack attempts with<\/span> APM traces\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
11.5 Code Security<\/h2>\n\n\n\n
Datadog\u2019s security area also includes code-level and shift-left capabilities:<\/p>\n\n\n
Software Composition Analysis\nStatic<\/span> Application Security Testing\nRuntime Code Analysis \/ IAST\nIaC Security\nSecret Scanning\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
These help find issues before production.<\/p>\n\n\n\n
\n\n\n\n
12. Software Delivery<\/h1>\n\n\n\n
Software Delivery features connect CI\/CD with runtime observability.<\/p>\n\n\n\n
Common features:<\/p>\n\n\n
CI Visibility\nTest Optimization\nContinuous Testing\nDORA Metrics\nFeature Flags\nCode Coverage\nIDE plugins\nInternal Developer Portal\n<\/code><\/span><\/pre>\n\n\n
Use cases:<\/p>\n\n\n
Which pipeline is slow?\nWhich tests are flaky?\nDid deployment increase error rate?\nWhich team owns this<\/span> service?\nWhat is deployment frequency?\nWhat is lead time for<\/span> changes?\nWhat is change failure rate?\nWhat is MTTR?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Datadog\u2019s product navigation lists CI Visibility, Test Optimization, Continuous Testing, IDE plugins, DORA Metrics, Feature Flags, and Code Coverage under Software Delivery. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
13. Service Management<\/h1>\n\n\n\n
Service Management is where observability becomes operations.<\/p>\n\n\n\n
Important features:<\/p>\n\n\n
Incident Response\nSoftware Catalog\nService Level Objectives\nCase<\/span> Management\nEvent Management\nWorkflow Automation\nApp Builder\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
13.1 Software Catalog<\/h2>\n\n\n\n
Software Catalog answers:<\/p>\n\n\n
Who owns this<\/span> service?\nWhat repo is it from<\/span>?\nWhat dashboards belong to it?\nWhat monitors belong to it?\nWhat dependencies does it have?\nWhat SLOs apply?\nIs it production-ready?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
For large organizations, this is critical.<\/p>\n\n\n\n
\n\n\n\n
13.2 SLOs<\/h2>\n\n\n\n
SLO means Service Level Objective<\/strong>.<\/p>\n\n\n\n
Example:<\/p>\n\n\n
Checkout<\/span> API<\/span> should<\/span> have<\/span> 99.9<\/span>% successful<\/span> requests<\/span> over<\/span> 30 days<\/span>.\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Related concepts:<\/p>\n\n\n
SLI = what you measure\nSLO = target\nError<\/span> budget = allowed failure\nBurn rate = how fast you are consuming error budget\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Good SLO examples:<\/p>\n\n\n
API availability\np95 latency\nSuccessful checkout rate\nSynthetic uptime\nBackground job success rate\nKafka processing freshness\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
13.3 Incident Response<\/h2>\n\n\n\n
Incident Response helps manage incidents from detection to resolution.<\/p>\n\n\n\n
Typical flow:<\/p>\n\n\n
flowchart<\/span> TD<\/span>\n    A<\/span>[Monitor Alert]<\/span> --<\/span>> B<\/span>[Incident Created]<\/span>\n    B<\/span> --<\/span>> C<\/span>[Assign Commander \/ Team]<\/span>\n    C<\/span> --<\/span>> D<\/span>[Investigate Dashboards, Logs, APM, SIEM]<\/span>\n    D<\/span> --<\/span>> E<\/span>[Run Workflow Automation]<\/span>\n    E<\/span> --<\/span>> F<\/span>[Mitigate Issue]<\/span>\n    F<\/span> --<\/span>> G<\/span>[Resolve Incident]<\/span>\n    G<\/span> --<\/span>> H<\/span>[Postmortem \/ Learnings]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
14. AIOps and AI in Datadog<\/h1>\n\n\n\n
AIOps means applying AI\/ML to operations.<\/p>\n\n\n\n
In Datadog, important areas are:<\/p>\n\n\n
Watchdog\nBits AI\nAnomaly detection\nForecasting\nRoot cause analysis\nFaulty deployment detection\nSecurity triage\nLLM Observability\nWorkflow Automation\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
14.1 Watchdog<\/h2>\n\n\n\n
Watchdog is Datadog\u2019s automated detection and insight engine.<\/p>\n\n\n\n
It helps surface:<\/p>\n\n\n
Anomalies\nOutliers\nError<\/span> spikes\nLatency changes\nFaulty deployments\nPossible root causes\nSuspicious behavior\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
The current Datadog docs list Watchdog capabilities including alerts, impact analysis, RCA, insights, faulty deployment detection, and faulty cloud\/SaaS API detection. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Use case:<\/p>\n\n\n
A deployment happens at 10<\/span>:05.<\/span>\nError<\/span> rate increases at 10<\/span>:08.<\/span>\nLatency increases only for<\/span> checkout-api.\nWatchdog highlights the deployment as<\/span> a possible cause.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
14.2 Bits AI<\/h2>\n\n\n\n
Bits AI is Datadog\u2019s agentic AI teammate. Datadog describes it as helping automate development, security, and operations workflows; users can chat with it or delegate tasks such as alert investigation, code fixes, or security triage. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Bits AI areas include:<\/p>\n\n\n
Bits AI SRE\nBits AI Dev Agent\nBits AI Security Analyst\nBits Assistant\nDatadog MCP Server\n<\/code><\/span><\/pre>\n\n\n
Practical examples:<\/p>\n\n\n
Investigate this<\/span> alert.\nSummarize what changed.\nFind likely root cause.\nGenerate incident summary.\nTriage this<\/span> Cloud SIEM signal.\nExplain why checkout-api latency increased.\nSuggest code fix for<\/span> known error.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
14.3 LLM Observability<\/h2>\n\n\n\n
For AI applications, Datadog can help monitor:<\/p>\n\n\n
Prompt latency\nModel latency\nToken usage\nModel errors\nProvider errors\nCost\nUser feedback\nAgent steps\nRetrieval quality\nPrompt\/response traces\n<\/code><\/span><\/pre>\n\n\n
Use this if your application uses:<\/p>\n\n\n
OpenAI\nAnthropic\nBedrock\nVertex AI\nCustom models\nAI agents\nRAG pipelines\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
15. Unified service tagging<\/h1>\n\n\n\n
This is one of the most important Datadog best practices.<\/p>\n\n\n\n
Use these three tags everywhere:<\/p>\n\n\n
env\nservice\nversion\n<\/code><\/span><\/pre>\n\n\n
Example:<\/p>\n\n\n
env<\/span>:prod<\/span>\nservice<\/span>:checkout-api<\/span>\nversion<\/span>:1.8.4<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Why it matters:<\/p>\n\n\n
Metrics use<\/span> same<\/span> tags<\/span>\nLogs<\/span> use<\/span> same<\/span> tags<\/span>\nTraces<\/span> use<\/span> same<\/span> tags<\/span>\nRUM<\/span> uses<\/span> same<\/span> tags<\/span>\nSynthetics<\/span> use<\/span> same<\/span> tags<\/span>\nDeployments<\/span> use<\/span> same<\/span> tags<\/span>\nErrors<\/span> use<\/span> same<\/span> tags<\/span>\nDashboards<\/span> filter<\/span> consistently<\/span>\nAlerts<\/span> route<\/span> correctly<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Datadog recommends unified service tagging with env<\/code>, service<\/code>, and version<\/code> to connect telemetry across Datadog. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
16. Datadog for Kubernetes\/EKS: practical implementation<\/h1>\n\n\n\n
For EKS, a production-grade Datadog setup usually looks like this:<\/p>\n\n\n
flowchart<\/span> TD<\/span>\n    A<\/span>[EKS Cluster]<\/span> --<\/span>> B<\/span>[Datadog Agent DaemonSet]<\/span>\n    A<\/span> --<\/span>> C<\/span>[Datadog Cluster Agent]<\/span>\n    D<\/span>[Application Pods]<\/span> --<\/span>> B<\/span>\n    D<\/span> --<\/span>> E<\/span>[stdout\/stderr Logs]<\/span>\n    D<\/span> --<\/span>> F<\/span>[APM Traces]<\/span>\n    D<\/span> --<\/span>> G<\/span>[DogStatsD Metrics]<\/span>\n    B<\/span> --<\/span>> H<\/span>[Datadog Platform]<\/span>\n    C<\/span> --<\/span>> H<\/span>\n    H<\/span> --<\/span>> I<\/span>[Dashboards]<\/span>\n    H<\/span> --<\/span>> J<\/span>[Monitors]<\/span>\n    H<\/span> --<\/span>> K<\/span>[APM Service Map]<\/span>\n    H<\/span> --<\/span>> L<\/span>[Log Explorer]<\/span>\n    H<\/span> --<\/span>> M<\/span>[Security]<\/span>\n    H<\/span> --<\/span>> N<\/span>[Watchdog \/ Bits AI]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Recommended EKS telemetry:<\/p>\n\n\n
Infrastructure metrics\nKubernetes state metrics\nContainer metrics\nPod logs\nApplication traces\nDogStatsD custom metrics\nSynthetic tests\nSecurity logs\nCloud cost\nDeployment events\n<\/code><\/span><\/pre>\n\n\n
Recommended tags:<\/p>\n\n\n
env\nservice\nversion\nteam\ncluster_name\nnamespace<\/span>\nregion<\/span>\ncloud_provider<\/span>\naccount_id<\/span>\nproduct<\/span>\ncomponent<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
17. Datadog implementation roadmap<\/h1>\n\n\n\n
Phase 1: Foundation<\/h2>\n\n\n\n
Start with:<\/p>\n\n\n
Datadog account\nDatadog site selection\nAPI key and app key governance\nTeams and roles\nTagging standard\nCloud integration\nAgent installation\n<\/code><\/span><\/pre>\n\n\n
Do not skip tagging. Bad tags create bad dashboards, bad alerts, and expensive confusion. Tiny tagging chaos becomes observability spaghetti. Deliciously cursed, but still spaghetti.<\/p>\n\n\n\n
\n\n\n\n
Phase 2: Infrastructure and Kubernetes<\/h2>\n\n\n\n
Enable:<\/p>\n\n\n
Host metrics\nContainer metrics\nKubernetes metrics\nCloud provider metrics\nNode\/pod\/deployment dashboards\nCluster events\nResource utilization dashboards\n<\/code><\/span><\/pre>\n\n\n
Create dashboards for:<\/p>\n\n\n
Cluster health\nNode health\nNamespace<\/span> resource<\/span> usage<\/span>\nPod<\/span> restarts<\/span>\nOOMKilled<\/span>\nDeployment<\/span> health<\/span>\nCPU<\/span>\/memory<\/span> saturation<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
Phase 3: Logs<\/h2>\n\n\n\n
Enable:<\/p>\n\n\n
Container log collection\nApplication logs\nCloud logs\nAudit logs\nLog pipelines\nParsing\nIndexes\nArchives\nSensitive data scanning\n<\/code><\/span><\/pre>\n\n\n
Standardize log fields:<\/p>\n\n\n
timestamp<\/span>\nlevel<\/span>\nmessage<\/span>\nenv<\/span>\nservice<\/span>\nversion<\/span>\ntrace_id<\/span>\nspan_id<\/span>\nrequest_id<\/span>\nerror<\/span>.kind<\/span>\nerror<\/span>.message<\/span>\nerror<\/span>.stack<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
Phase 4: APM<\/h2>\n\n\n\n
Enable APM for critical services first:<\/p>\n\n\n
Gateway\/API service\nAuth service\nCheckout\/payment service\nNotification service\nDatabase-heavy services\nKafka consumers\n<\/code><\/span><\/pre>\n\n\n
Track:<\/p>\n\n\n
Request rate\nError<\/span> rate\nLatency\np95\/p99\nEndpoint health\nDependency map\nDeployment impact\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
Phase 5: Synthetics and RUM<\/h2>\n\n\n\n
Add Synthetics for:<\/p>\n\n\n
Public<\/span> API uptime\ngRPC health checks\nLogin\nCheckout\nNotification API\nSSL expiry\nDNS\nPrivate<\/span> endpoint checks\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Add RUM for:<\/p>\n\n\n
Web apps\nMobile apps\nUser journeys\nFrontend errors\nSession Replay\nFrontend\/backend correlation\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
Phase 6: Security<\/h2>\n\n\n\n
Enable based on maturity:<\/p>\n\n\n
Cloud SIEM\nCloud Security\nKubernetes audit logs\nWorkload Protection\nApp and API Protection\nSAST\nSCA\nIaC Security\nSecret Scanning\n<\/code><\/span><\/pre>\n\n\n
Start with detection and visibility before auto-remediation.<\/p>\n\n\n\n
\n\n\n\n
Phase 7: SLOs and incident response<\/h2>\n\n\n\n
Define SLOs for:<\/p>\n\n\n
API availability\nAPI latency\nCheckout success\nLogin success\nKafka processing freshness\nSynthetic uptime\nMobile crash-free sessions\n<\/code><\/span><\/pre>\n\n\n
Create incident workflows:<\/p>\n\n\n
Alert \u2192 Incident \u2192 Owner \u2192 Dashboard \u2192 Runbook \u2192 Remediation \u2192 Postmortem\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
Phase 8: AIOps and automation<\/h2>\n\n\n\n
Then add:<\/p>\n\n\n
Watchdog insights\nBits AI investigation\nWorkflow Automation\nAuto-ticket creation\nAuto-remediation for safe actions\nSecurity triage\nIncident summaries\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
18. Common Datadog dashboards<\/h1>\n\n\n\n
Infrastructure dashboard<\/h2>\n\n\n
Host count\nCPU by host\nMemory by host\nDisk usage\nNetwork throughput\nTop noisy hosts\nHost availability\n<\/code><\/span><\/pre>\n\n\n
Kubernetes dashboard<\/h2>\n\n\n
Cluster status\nNode CPU\/memory\nNamespace<\/span> usage<\/span>\nPod<\/span> restarts<\/span>\nOOMKilled<\/span> pods<\/span>\nPending<\/span> pods<\/span>\nDeployment<\/span> replica<\/span> health<\/span>\nContainer<\/span> CPU<\/span>\/memory<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Application dashboard<\/h2>\n\n\n
Request rate\nError<\/span> rate\np95 latency\nTop endpoints\nTop errors\nDependency latency\nDatabase latency\nDeployment comparison\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Logs dashboard<\/h2>\n\n\n
Error<\/span> logs by service\nLogs by level\nTop error messages\nLog volume by service\nLog ingestion by env\nSecurity-related logs\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Synthetics dashboard<\/h2>\n\n\n
Endpoint availability\nGlobal<\/span> latency\nFailures by location\ngRPC health\nSSL expiry\nPrivate<\/span> location status\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Security dashboard<\/h2>\n\n\n
Top security signals\nSignals by severity\nMITRE ATT&CK tactic\nCloud misconfigurations\nIdentity risks\nVulnerabilities\nPublic<\/span> exposure risks\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Cost dashboard<\/h2>\n\n\n
Cloud cost by account\/project\nCost by service\nCost by environment\nCost by Kubernetes namespace<\/span>\nCost<\/span> trend<\/span>\nCost<\/span> anomaly<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
19. Common Datadog monitors<\/h1>\n\n\n\n
Good starter monitors:<\/p>\n\n\n
High CPU\nHigh memory\nDisk full\nPod CrashLoopBackOff\nPod OOMKilled\nDeployment unavailable\nAPI high error rate\nAPI high p95 latency\nSynthetic test failure\nDatabase high connections\nKafka consumer lag\nLog error spike\nNew Error<\/span> Tracking issue\nCloud SIEM high severity signal\nSLO burn rate\nCloud cost anomaly\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Datadog monitors and alerts are core platform capabilities, alongside dashboards, metrics, Watchdog, notebooks, Fleet Automation, Governance Console, access control, workflow automation, and integrations. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
\n\n\n\n
20. Datadog best practices<\/h1>\n\n\n\n
20.1 Tagging<\/h2>\n\n\n\n
Use a mandatory tagging standard:<\/p>\n\n\n
env\nservice\nversion\nteam\nowner\nproduct\nregion\ncluster\nnamespace<\/span>\ncloud<\/span>\naccount<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
Avoid high-cardinality tags in metrics:<\/p>\n\n\n
user_id\nrequest_id\nsession_id\nfull_url\norder_id\nemail\ntoken\n<\/code><\/span><\/pre>\n\n\n
Those belong in logs\/traces with proper controls, not metric tags.<\/p>\n\n\n\n
\n\n\n\n
20.2 Alert design<\/h2>\n\n\n\n
Bad alert:<\/p>\n\n\n
CPU > 80%\n<\/code><\/span><\/pre>\n\n\n
Better alert:<\/p>\n\n\n
CPU > 85% for 15 minutes AND service latency\/error rate is impacted.\n<\/code><\/span><\/pre>\n\n\n
Best alerting strategy:<\/p>\n\n\n
Alert on user impact first.\nAlert on saturation second.\nAlert on symptoms before causes.\nUse<\/span> burn<\/span>-rate<\/span> alerts<\/span> for<\/span> SLOs<\/span>.\nAvoid<\/span> alerting<\/span> every<\/span> team<\/span> for<\/span> every<\/span> noisy<\/span> metric<\/span>.\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
20.3 Dashboard design<\/h2>\n\n\n\n
Bad dashboard:<\/p>\n\n\n
Everything on one giant screen.\n<\/code><\/span><\/pre>\n\n\n
Good dashboard:<\/p>\n\n\n
One dashboard per purpose.\n<\/code><\/span><\/pre>\n\n\n
Recommended dashboard categories:<\/p>\n\n\n
Executive overview\nService health\nKubernetes operations\nIncident troubleshooting\nSecurity operations\nCost management\nSLO overview\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
20.4 Logging<\/h2>\n\n\n\n
Good:<\/p>\n\n\n
Structured JSON<\/span> logs\nConsistent fields\nTrace correlation\nNo secrets\nProper retention\nUseful error stack traces\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Bad:<\/p>\n\n\n
Raw multiline logs with<\/span> no service\/env\/version\nSensitive data in<\/span> logs\nEverything indexed forever\nNo ownership\nNo parsing\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
20.5 APM rollout<\/h2>\n\n\n\n
Start with business-critical paths:<\/p>\n\n\n
Login\nCheckout\nPayment\nNotifications\nVehicle command\nTelematics ingestion\nKafka consumers\nExternal partner APIs\n<\/code><\/span><\/pre>\n\n\n
Then expand.<\/p>\n\n\n\n
\n\n\n\n
21. Datadog vs common alternatives<\/h1>\n\n\n\n
Tool<\/th>Strong area<\/th>Notes<\/th><\/tr><\/thead>
Datadog<\/td>Unified observability + security + DevOps + AIOps<\/td>Very broad, SaaS-first, powerful, can become expensive without governance<\/td><\/tr>
Prometheus + Grafana<\/td>Metrics and dashboards<\/td>Great open-source stack, less complete for logs\/APM\/SIEM unless extended<\/td><\/tr>
ELK\/OpenSearch<\/td>Logs and search<\/td>Strong log analytics, needs more engineering ownership<\/td><\/tr>
New Relic<\/td>Observability\/APM<\/td>Strong app observability<\/td><\/tr>
Dynatrace<\/td>APM\/AIOps automation<\/td>Strong enterprise full-stack monitoring<\/td><\/tr>
Splunk<\/td>Logs\/SIEM<\/td>Strong security\/log analytics, traditionally heavy\/costly<\/td><\/tr>
CloudWatch<\/td>AWS-native monitoring<\/td>Good for AWS, less unified across multi-cloud\/app\/security<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
Datadog\u2019s sweet spot is teams that want one integrated SaaS platform<\/strong> across infrastructure, apps, logs, traces, RUM, synthetics, security, incidents, and cloud cost.<\/p>\n\n\n\n
\n\n\n\n
22. Example real-world incident flow<\/h1>\n\n\n\n
Scenario:<\/p>\n\n\n
Users report checkout failure.\n<\/code><\/span><\/pre>\n\n\n
Datadog investigation path:<\/p>\n\n\n
flowchart<\/span> TD<\/span>\n    A<\/span>[User reports checkout failure]<\/span> --<\/span>> B<\/span>[RUM shows checkout button errors]<\/span>\n    B<\/span> --<\/span>> C<\/span>[APM trace shows payment-service timeout]<\/span>\n    C<\/span> --<\/span>> D<\/span>[Logs show PaymentTimeoutException]<\/span>\n    D<\/span> --<\/span>> E<\/span>[Metrics show error spike after deployment]<\/span>\n    E<\/span> --<\/span>> F<\/span>[Watchdog highlights faulty deployment]<\/span>\n    F<\/span> --<\/span>> G<\/span>[Kubernetes view shows pods running version 1.8.4]<\/span>\n    G<\/span> --<\/span>> H<\/span>[Rollback deployment]<\/span>\n    H<\/span> --<\/span>> I<\/span>[SLO burn rate recovers]<\/span>\n    I<\/span> --<\/span>> J<\/span>[Incident resolved and postmortem created]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
This is the point of Datadog: not just charts, but connected evidence.<\/p>\n\n\n\n
\n\n\n\n
23. Example EKS service standard<\/h1>\n\n\n\n
For every production service, define:<\/p>\n\n\n
Service name\nOwner\/team\nRepository\nDashboard\nRunbook\nSLO\nAlerts\nAPM enabled?\nLogs enabled?\nError<\/span> Tracking enabled?\nSynthetic test?\nSecurity coverage?\nCost attribution?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
Example:<\/p>\n\n\n
service<\/span>: notification-service\nenv<\/span>: prod\nteam<\/span>: platform\nrepo<\/span>: github\/org\/notification-service\ndashboard<\/span>: notification-service-prod\nslo<\/span>: 99.9% successful notification API calls\nsynthetic<\/span>: gRPC health check every 1 minute\nlogs<\/span>: JSON logs with trace_id\napm<\/span>: enabled\nerror_tracking<\/span>: enabled\nsecurity<\/span>: Cloud SIEM + App\/API Protection\n<\/code><\/span>Code language:<\/span> HTTP<\/span> (<\/span>http<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n
24. Datadog learning path<\/h1>\n\n\n\n
For a DevOps\/SRE engineer, learn in this order:<\/p>\n\n\n
1. Datadog basics: metrics, logs, traces, tags\n2. Datadog Agent\n3. Dashboards and monitors\n4. Kubernetes\/EKS monitoring\n5. Log pipelines and Log Explorer\n6. APM and distributed tracing\n7. Synthetics\n8. RUM and Session Replay\n9. SLOs and Incident Response\n10. Cloud Cost Management\n11. Cloud SIEM and Cloud Security\n12. Watchdog and Bits AI\n13. Terraform\/API automation\n14. Governance and cost control\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n
25. Final mental model<\/h1>\n\n\n\n
Remember Datadog like this:<\/p>\n\n\n
Metrics tell you what changed.\nLogs tell you what happened.\nTraces tell you where it happened.\nProfiles tell you why code is expensive.\nRUM tells you who was impacted.\nSynthetics tell you what is broken from<\/span> the outside.\nSecurity signals tell you what is risky or suspicious.\nCloud cost tells you what it costs.\nSLOs tell you whether users are still getting acceptable service.\nWatchdog and Bits AI help you investigate faster.\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
A compact architecture view:<\/p>\n\n\n
flowchart<\/span> TD<\/span>\n    A<\/span>[Systems]<\/span> --<\/span>> B<\/span>[Telemetry]<\/span>\n    B<\/span> --<\/span>> C<\/span>[Metrics]<\/span>\n    B<\/span> --<\/span>> D<\/span>[Logs]<\/span>\n    B<\/span> --<\/span>> E<\/span>[Traces]<\/span>\n    B<\/span> --<\/span>> F<\/span>[Profiles]<\/span>\n    B<\/span> --<\/span>> G<\/span>[RUM]<\/span>\n    B<\/span> --<\/span>> H<\/span>[Synthetics]<\/span>\n    B<\/span> --<\/span>> I<\/span>[Security Signals]<\/span>\n    B<\/span> --<\/span>> J<\/span>[Cloud Cost]<\/span>\n\n    C<\/span> --<\/span>> K<\/span>[Datadog Platform]<\/span>\n    D<\/span> --<\/span>> K<\/span>\n    E<\/span> --<\/span>> K<\/span>\n    F<\/span> --<\/span>> K<\/span>\n    G<\/span> --<\/span>> K<\/span>\n    H<\/span> --<\/span>> K<\/span>\n    I<\/span> --<\/span>> K<\/span>\n    J<\/span> --<\/span>> K<\/span>\n\n    K<\/span> --<\/span>> L<\/span>[Dashboards]<\/span>\n    K<\/span> --<\/span>> M<\/span>[Alerts]<\/span>\n    K<\/span> --<\/span>> N<\/span>[APM]<\/span>\n    K<\/span> --<\/span>> O<\/span>[SIEM]<\/span>\n    K<\/span> --<\/span>> P<\/span>[SLOs]<\/span>\n    K<\/span> --<\/span>> Q<\/span>[Incidents]<\/span>\n    K<\/span> --<\/span>> R<\/span>[AIOps: Watchdog \/ Bits AI]<\/span>\n<\/code><\/span>Code language:<\/span> CSS<\/span> (<\/span>css<\/span>)<\/span><\/small><\/pre>\n\n\n
Final conclusion<\/h2>\n\n\n\n
Datadog is best understood as a unified observability, security, and operations platform<\/strong>. It starts with monitoring infrastructure and applications, but its real value comes when you connect everything:<\/p>\n\n\n
Infrastructure + Kubernetes + Logs + APM + RUM + Synthetics + SIEM + Cloud Security + SLOs + Incident Response + AIOps\n<\/code><\/span><\/pre>\n\n\n
For a modern DevOps\/SRE team, Datadog becomes the central place to answer:<\/p>\n\n\n
Is the system healthy?\nAre users impacted?\nWhat changed?\nWhere is the root cause?\nIs it secure?\nWho owns it?\nHow fast can we fix it?\nHow do<\/span> we prevent it next time?\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Datadog is a SaaS-based observability, monitoring, security, and service-management platform used by DevOps, SRE, platform, application, security, and business teams to understand the health, performance, reliability, cost,… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[25768],"tags":[],"class_list":["post-41301","post","type-post","status-publish","format-standard","hentry","category-datadog"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/41301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=41301"}],"version-history":[{"count":3,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/41301\/revisions"}],"predecessor-version":[{"id":77119,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/41301\/revisions\/77119"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=41301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=41301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=41301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Datadog\u2019s Service Management area is designed for integrated workflows and faster time-to-resolution, with SLOs, incident response, software catalog, case management, workflow automation, event management, and related collaboration features. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Datadog Cloud SIEM continuously analyzes incoming data to detect threats, generate actionable security signals, and correlate them across multiple sources. Its overview page includes signals, open cases, high-risk entities, content-pack health, geography\/ISP signal views, MITRE ATT&CK tactics, MTTD, and false-positive tracking. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n
Datadog Cloud SIEM is a security data analysis and correlation system that ingests telemetry from cloud and on-prem systems using the Agent and API integrations, continuously analyzes incoming data, detects threats, generates security signals, and helps teams investigate and respond. (Datadog Monitoring<\/a>)<\/p>\n\n\n\n