Notebook
A Notebook is a Datadog document feature for investigation that stacks graphs and explanatory text top to bottom in a single document and lets multiple people edit it at the same time. You use it when you want to keep the numbers you looked at and the judgments you made at the time together in one place, as in the interim record of an incident investigation or a postmortem.
Overview
A Notebook is a feature for arranging metric and log graphs and prose in order from the top, and preserving the investigation process itself as a single document. If a dashboard is "a permanent monitoring surface where the same indicators line up whenever you look," a Notebook corresponds to a record you can read back later of "what we looked at and what we suspected during that incident." On the day of incident response it serves as a co-edited work log, and after things settle it becomes the draft of the postmortem as is, so the effort of recreating information between investigation and reporting shrinks.
A Notebook is an investigation document that stacks prose and graphs
A Notebook is a feature that lets you embed the same graphs as a dashboard, as they are, inside a document you write on the Datadog screen. A single Notebook is built by stacking elements such as graphs / images / headings / bulleted lists / code blocks / quotations from the top, and typing / in the input field opens a list of elements you can insert. Text formatting can be done either through rich-text operations or by entering Markdown syntax (as of September 2026; Source: Notebooks). Because a table of contents is assembled automatically from the headings and embedded graphs, a later reader can jump directly to the part they want to know about even in a long investigation. One thing to be careful about is the save behavior: while prose is saved automatically, changes to the settings of an embedded graph require a save operation on the graph editor side.
The difference from a dashboard is lifespan, not features
Dashboards and Notebooks can carry almost the same graphs, so it is easy to be unsure which to use. The dividing line is lifespan. A dashboard is a permanent surface you tend as long as operations continue; a Notebook is a record you write out in a single investigation and close, and its value lies in preserving "what we looked at and what we suspected at the time" in the order of the prose and graphs. All graphs in a Notebook are linked to the global time frame in the header by default, and you can also unlink specific graphs from it and fix their time range (as of September 2026). You can create a way of reading in which the graphs for the time period when the incident occurred are fixed, while only the comparison graphs are left variable.
| Perspective | Dashboard | Notebook |
|---|---|---|
| Main role | Watch the same indicators in the same layout every day | Preserve what was seen and judged in a single investigation |
| Arrangement | Widgets placed in free positions | A single-column document read from top to bottom |
| Role of prose | Supporting (annotations and notes on procedures) | Leading (graphs are the evidence for the claims) |
| Time frame | Switched across the whole surface for viewing | Linked to the global time frame / individual graphs can also be fixed |
| End of use | Updated as long as operations continue | Kept as reading material once the investigation ends |
Where it pays off is in handling information that can no longer be reproduced as time passes
The first case is the middle of incident response. If you paste log extraction results and graphs and add notes in the order you notice things, that becomes a chronological work log as is. It also shows its strength in the postmortem after things settle; the template gallery provides a postmortem template for Incident Response, so you do not have to devise a format from a blank page. It also suits regular reporting. A Notebook has a type tag of Postmortem / Runbook / Investigation / Documentation / Report, and team tags that can be attached for up to 5 teams. Both serve as clues for finding it later by purpose (as of September 2026; Source: Notebooks). In an operation without this place to put things, investigation records scatter across chat streams and pasted images, and when a similar incident occurs six months later nobody can reproduce the judgments made at the time. The practical benefit of a Notebook lies in "not taking the time to re-investigate away from the next person in charge."
Cell types, graph sizes, and the default time frame
The cell types are prose and headings, bulleted lists, code blocks, quotations, images, and graphs. For graphs, the widgets that handle metrics and logs can be used as they are, and Quick Edit lets you rewrite the conditions on the spot. The display size comes in 5 steps, XS / S / M (default) / L / XL, and at XS and S the legend is automatically disabled. Template variables are also supported, and a variable whose tag key is team is rendered as a team selection field (as of September 2026). A frequently used period can be saved as the default with Set Default Time, so the effort of whoever opens it re-aligning the time frame every time disappears.
Sharing and preservation - who can rewrite it, and how long can it be read
The same Notebook can be opened and written by multiple people at the same time. Icons of the people viewing it line up at the top, and the cursor positions of others are visible on the spot. However, editing of embedded graphs works by keeping whatever was saved last, so if two people touch the same graph, one person's changes disappear. You can check earlier states from the version history in the gear menu and restore or duplicate them, so it can be undone. One more thing worth knowing is how long it remains readable: graphs with a fixed time range automatically have a snapshot (a static image) taken without any configuration, and it can be viewed or downloaded from the menu next to the graph. This image remains even after the retention period has passed (as of September 2026). The design makes it unlikely that you open the record of an incident from six months ago and find the graphs empty.
What happens when you get the division of use wrong
The first stumbling point is running day-to-day monitoring in a Notebook. Because a document is structured to be read from the top, it cannot beat monitors and dashboards for the purpose of finding anomalies quickly. Moving established indicators to a dashboard and confining the Notebook to the record of what was investigated makes both last longer. The other is the assumption that a work in progress is yours alone. Permissions default to full access for all users, so your interim guesses are visible to others as they are (as of September 2026). If thinking with sharing as the premise feels constraining, it is a good idea to keep a separate Notebook for drafts and paste only the verified progress into the main one.