Log Monitor
A Log Monitor is a Datadog monitor type that aggregates the logs matching a log search query over a time window, compares the count or value against a threshold, and notifies you. Only logs that entered an index are evaluated; logs dropped by exclusion filters are not counted.
Overview
A Log Monitor uses the same search query as Log Explorer as its condition and compares the number of matching logs, the number of unique values of an attribute, or the aggregated value of a measure against a threshold. It can be grouped by tags or facets in up to 4 dimensions, and each group can notify independently. It matters when you decide how many occurrences of a specific error within a certain time should trigger an alert, and when you want to detect the fact that logs have stopped arriving. Because only indexed logs are covered, logs that did not enter an index due to exclusion filters or daily quotas are not counted no matter how many are flowing.
A monitor that compares log search query results against a threshold
A Log Monitor is a type of Monitor that aggregates the logs matching a log search query over a fixed time window, compares the result against a threshold, and notifies you. The official documentation describes it as a monitor that alerts you when a specified type of log exceeds a user-defined threshold over a given period. The maximum time window is 2 days, and the default creation limit is 1,000 per account (as of September 2026, Source: Log Monitor). The query is written the same way as a Log Explorer search, and the graph at the top of the page updates as you type, so you can visually confirm past counts while writing the condition. The requirement "alert when a specific error exceeds 10 occurrences in 5 minutes" is the most straightforward use of this monitor.
Counting three ways: count, number of distinct values, and magnitude
There are three things to count, and what you compare changes depending on which you select below the query (as of September 2026, Source: Log Monitor).
| Selection | Value compared against the threshold | Suitable question |
|---|---|---|
| Count (no attribute or measure selected) | The number of logs matched within the time window | Did error logs exceed 10 in 5 minutes? |
| Facet or attribute | The number of unique values of that attribute | How many users (user.email) encountered errors? |
| Measure | The aggregated value of a numeric facet. The aggregation is chosen from min / avg / sum / median / pc75 / pc90 / pc95 / pc98 / pc99 / max | Did the p95 of processing time exceed the threshold? |
Any attribute can be used, but only Facets appear in autocomplete. The difference between count and number of unique values is significant in practice: if the same user fails 100 times, the count is 100 and the unique count is 1. Choose an attribute if you want to see impact in number of people, and count if you want to see it in volume. Flex Logs are out of scope; only logs that entered a Standard index can be used.
Grouping determines the granularity of notifications - the top value limits
Query results can be grouped by tags, attributes, or up to 4 facets. The group limit changes with the number of dimensions: with 1 dimension the top 1,000 values, with 2 dimensions 30 values each (up to 900 combinations), with 3 dimensions 10 values each (up to 1,000 combinations), and with 4 dimensions 5 values each (up to 625 combinations). The default top value is 10 for each, except 5 for the fourth (as of September 2026, Source: Log Monitor). When there are multiple dimensions, the narrowing proceeds in order: the top values are decided for the first dimension, and within those the top values for the second. The choice between Multi Alert, which evaluates and notifies each group independently, and Simple Alert, which combines everything into one, is covered in the entry on Monitors. Groups beyond the limit are not evaluated, so if you want to watch a large number of services individually, it is more reliable to narrow the target with the query before splitting.
Only indexed logs are evaluated
A Log Monitor looks only at logs that entered an index (as of September 2026, Source: Log Monitor). Logs dropped by an Exclusion Filter after passing through a pipeline do not enter an index, so even if they are visible in Live Tail, they are not included in the monitor's count.
- A log arrives and is processed by pipelines
- It passes through index filters and exclusion filters. Dropped logs go out of scope here
- Only logs that entered an index enter the evaluation time window (up to 2 days)
- The count, number of unique values, or aggregated measure value is compared against the threshold
- Each group that meets the condition is notified, and log samples can be attached
Two cautions follow from this structure. One is that if you watch the count of logs being dropped at a 90% exclusion rate, you count only one tenth of the actual number. The other is that logs that stopped entering the index because the daily quota of the Log Index was reached are likewise not counted, for the same reason. Decide count thresholds after confirming the exclusion and quota settings.
How to handle zero - No Data and below 1
When there is not a single matching log in the time window, the Log Monitor enters the NO DATA state (as of September 2026, Source: Log Monitor). If you want to know about the fact that logs have stopped arriving, set the condition to below 1. When grouping is in use, the below condition triggers only when some group has logs and its count is under the threshold, or when all groups have 0 logs. The point that is easy to misread is that it does not trigger when logs stop for only a specific group. If you want to catch the silence of a particular service, create a separate below 1 monitor whose query is narrowed to that service. The handling of the missing-data state itself is covered in the entry on No Data.
Inserting log contents into notifications
Notifications can include the contents of the logs at the time the condition was met. A count monitor without grouping can attach up to 10 log samples. A Simple Alert with grouping can attach up to 10 facet values or measure values; what can be attached is determined for each configuration in this way (as of September 2026, Source: Log Monitor). The supported notification destinations are Slack, Jira, Webhook, Microsoft Teams, PagerDuty, and email, and recovery notifications do not include samples. Logs without a message are not included in samples. To insert log attribute values into the body, use template variables. Whether the recipient can grasp "which host, which error" from the notification alone is determined by this insertion. Together with the design of Alerts, decide "who looks at what and acts" before the thresholds of your Monitors.