Datadog monitor alerts

A Datadog webhook sends each monitor notification to Squasher. A trigger opens an incident, and the recovery resolves the same incident.

What you need

A Datadog account that can create webhooks and edit monitors.
The Squasher CLI, signed in with write access to the project. See Alert sources.

Connect Datadog

Create the connector

squasher alert-connectors create \
  --project "$SQUASHER_PROJECT_ID" \
  --provider datadog \
  --display-name "Datadog production monitors"

Save setup.endpoint and setup.secret from the output.

Create a webhook in Datadog

In Datadog, open the Webhooks integration and add a webhook. Name it, for example squasher, and set the URL to setup.endpoint.

Add the secret as a custom header

{ "Authorization": "Bearer sq_ac_..." }

Paste this payload

The words that start with $ are Datadog template variables. Keep the field names: Squasher reads these names.

{
  "alert_cycle_key": "$ALERT_CYCLE_KEY",
  "alert_id": "$ALERT_ID",
  "event_id": "$ID",
  "alert_transition": "$ALERT_TRANSITION",
  "title": "$ALERT_TITLE",
  "message": "$ALERT_STATUS",
  "date": "$DATE",
  "priority": "$ALERT_PRIORITY",
  "tags": "$TAGS",
  "link": "$LINK"
}

Notify the webhook from your monitors

Add @webhook-squasher to the message of each monitor that should open Squasher incidents. Use the name you gave the webhook. Then trigger a test notification and let it recover.

How Squasher reads a notification

Field	Squasher incident
`alert_cycle_key`	Alert key. The trigger and the recovery of one alert go to one incident.
`alert_id`	Alert key when `alert_cycle_key` is empty.
`event_id`	Event key. A retry of the same notification is applied once.
`alert_transition` (or `transition`)	State. See the next table. Required.
`title`	Title. Required.
`message`	Summary, and the message on the incident timeline.
`date`	Event time, in epoch seconds, epoch milliseconds, or ISO 8601.
`severity`	Severity. Optional; it wins over `priority`.
`priority`	Severity when `severity` is empty: `P1` and `P2` are `sev-1`, `P3` is `sev-2`, `P4` and `P5` are `sev-3`.
`tags`, `link`	Added to the message on the incident timeline. `link` is the Open in Datadog link of the incident.

Without a Datadog link, Open in Datadog opens the monitor (from alert_id) or, without a monitor ID, an event search for the alert key, on app.datadoghq.com. Send $LINK so the link uses your Datadog site.

`alert_transition`	Result
`Triggered`, `Re-Triggered`, `Warn`, `Re-Warn`, `No Data`, `Re-No Data`, `Renotify`	Opens or updates the incident.
`Recovered`, `Resolved`	Resolves the incident.
`Acknowledged`	Marks the incident as acknowledged.
Any other value	Ignored.

When there is no severity and no known priority, Squasher uses the connector’s default severity. Squasher ignores fields that are not in this table.

Limits

The payload must have title, a transition, and alert_cycle_key or alert_id. Without them, Squasher returns 422, and Datadog does not retry.
If the recovery opens a second incident, check that the payload has $ALERT_CYCLE_KEY. Without it, Squasher uses $ALERT_ID.
Each request carries one notification.

Get started

Guides

Datadog monitor alerts

What you need

Connect Datadog

How Squasher reads a notification

Limits

Next steps

Alert sources

Route incidents

​What you need

​Connect Datadog

​How Squasher reads a notification

​Limits

​Next steps

Alert sources

Route incidents

What you need

Connect Datadog

How Squasher reads a notification

Limits

Next steps