5

There are logs with "events" that have attributes such as names, statuses, etc as well as "amount" which corresponds to a dollar amount. I'm sending requests to datadog's timeseries api to get back data about these logs.

I'm starting with a base query: sum:events{event_name:reload,event_result:success,event_environment:main,event_market:gb}.as_count()

This query just returns the total number of these "reload" events that have occurred in the timeframe. Each of these events has an attribute "amount" which I want returned instead. I can't figure out how to format the syntax for the query to get it to return the sum of these amounts instead of the sum of the occurrences of events.

Here are some queries I have tried which do not work:

sum:events{event_name:reload,event_result:success,event_environment:main,event_market:gb}.amount.as_count()
sum:events{event_name:reload,event_result:success,event_environment:main,event_market:gb}.amount
sum:events.amount{event_name:reload,event_result:success,event_environment:main,event_market:gb}.as_count()
sum:events{event_name:reload,event_result:success,event_environment:main,event_market:gb} by {amount}.as_count()

I've had difficulty finding anything about this in the datadog documentation. If anyone understands how to perform this with datadog's query syntax I would very much appreciate the help.

Thanks

Improve this question

1 Answer 1

Reset to default
1

For anyone googling this type of thing later, I found out the answer from Datadog support: it's not possible from the metrics endpoint. The data ingestion app I was creating queries for that consumes the Datadog API only had support for the Metrics (timeseries) endpoint, and the Events endpoint (which is something completely different from these "event" logs).

In order to query these named logs and look at an attribute, there are essentially two options:

1: Use the Logs Analytics Aggregate API Endpoint (https://docs.datadoghq.com/api/latest/logs/), which allows you to query directly into logs and set aggregation type etc. The app I was using did not support this endpoint, but through personal curl requests I was able to verify that the data was accessible through this endpoint. The downside of this endpoint is it has as much lower rate limit than the metric timeseries endpoint (the rate limit is only 300 requests/hour, which we hit fairly fast).

2: Create a new metric representing this attribute in the logs of Datadog. This is the route we took. The downside of this method is that the new metric only begins storing data from the point in time in which it is created, so any historical data you wish to look at will not be available via this new metric.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.