Datadog Fundamentals cheat sheet

The Datadog Agent runs on hosts and in containers; its default integration check collection interval is 15 seconds.

Metric submission types: COUNT reports occurrences per flush interval, RATE reports a per-second value, GAUGE reports the last value seen.

Distribution metrics aggregate raw values across all hosts before computing percentiles; histogram percentiles are computed per host.

Unified service tagging applies the reserved env, service, and version tags so metrics, traces, and logs join across products.

Autodiscovery templates read container labels or Kubernetes annotations to configure integration checks per container without editing Agent config files.

DogStatsD is bundled with the Agent and accepts custom metrics, events, and service checks over UDP.

Downtimes mute monitors by tag scope and can be one-time or recurring; they suppress notifications, not data collection.

The Agent forwarder buffers and sends telemetry to Datadog over HTTPS port 443 and requires a valid API key.

Metric data is retained for 15 months, with progressively coarser rollup granularity as data ages.

A trace is a set of spans sharing one trace ID; each span carries a span ID, parent ID, service, resource, operation name, duration, and tags.

APM trace data is retained for 15 days.

Retention filters determine which spans are indexed and searchable in the Trace Explorer, which directly drives indexing cost.

APM metrics (requests, errors, latency) are computed from all ingested spans, independent of index retention filters.

Error rate equals spans marked error or returning 5xx divided by total requests for the same scope.

Apdex = (satisfied requests + 0.5 × tolerating requests) ÷ total requests, against a per-service target time T.

The Service page shows latency percentiles, error rate, throughput, and the upstream/downstream dependency map for the selected env.

Continuous Profiler attributes CPU, memory, and lock time to code lines and methods without additional instrumentation.

Deployment tracking overlays version changes on APM graphs by watching the version tag.

Log flow is ingest → pipelines with processors → indexes with exclusion filters → retention, archives, and log-based metrics.

Processors include grok parser, date remapper, status remapper, attribute remapper, category processor, and message remapper.

Reserved log attributes are host, service, source, status, and message.

Grok patterns use %{PATTERN:field} syntax, for example %{TIMESTAMP_ISO8601:timestamp}.

Each index sets its own retention period and daily quota; exclusion filters drop matching logs before indexing to reduce cost.

Log-based metrics are generated from all ingested logs, including logs excluded from indexes.

Archives forward logs to S3, GCS, or Azure Blob for long-term storage; rehydration replays archived logs back into indexes.

Log patterns mask variable tokens to group similar messages and surface new or anomalous log types.

The status remapper maps an attribute to the reserved status field so levels such as ERROR or WARN are recognized.

RUM collects browser and mobile events: views, actions, errors, resources, long tasks, and sessions.

RUM data is retained for 30 days.

RUM propagates the trace ID to backend requests so a front-end view can be linked to its APM traces.

Synthetic tests include API HTTP tests, browser tests, and uptime checks executed from managed or private locations.

Synthetic assertions verify status codes, headers, body content, response time, and SSL certificate validity.

Core Web Vitals: LCP measures loading, INP (formerly FID) measures interactivity, CLS measures visual stability.

Browser tests replay recorded scripted steps and can capture screenshots and waterfall detail per step.

Session replay records DOM mutations and interactions, with configurable masking for text and input fields.

Private locations run the synthetic worker inside your own network so tests can reach internal endpoints.

Cloud SIEM applies log detection rules to ingested logs and emits security signals for triage.

CSM Misconfigurations continuously evaluates cloud and host resources against frameworks such as CIS, PCI DSS, and SOC 2.

CSM Threats uses Agent probes to detect process, file, and network activity matching workload security rules.

CSM Vulnerabilities scans hosts and container images for known CVEs and ranks findings by severity.

Application Security Management detects attacks and code-level vulnerabilities from inside services using the tracing library.

Sensitive Data Scanner matches regex or library patterns to detect and optionally redact PII and secrets in logs, traces, RUM, and events.

Security signals carry severity, rule name, affected resources, and a timeline, and can trigger notification rules.

Identity risks flag over-privileged cloud users and roles that could enable lateral movement.

API keys identify the organization for data submission; application keys authorize read/write API calls and are scoped to a user or service account.

Monitor types include metric, log, APM, composite, anomaly, outlier, forecast, and integration monitors.

A composite monitor combines other monitors with &&, ||, and ! and triggers only when the full expression evaluates true.

Incident severity levels default to SEV-1 through SEV-5 and drive notification and escalation behavior.

On-call schedules define rotations; escalation policies route unacknowledged pages to the next responder after a timeout.

The Service Catalog stores ownership, metadata, and links to APM, dashboards, and on-call for each service.

Dashboards support template variables for scope switching; timeboards use a fixed grid with a set time range, screenboards a free-form layout.

Datadog sites include US1, US3, US5, EU1, AP1, and US1-FED; data does not cross site boundaries.

RBAC roles grant granular permissions, and Teams group users to act as owners of dashboards, monitors, and services.