about Datadog monitors aggregation

Checkout ref: “as_count() in Monitor Evaluations” https://docs.datadoghq.com/monitors/guide/as-count-in-monitor-evaluations/

In CloudWatch alarms and Grafana you typically have something like

evaluate the err rate over 5 minutes: if that’s greater than E for three times in a row fire an alert

On the other hand Datadog doesn’t have any notion of “x times in a row”. Instead it requires you to aggregate over time only once. How would you implement the same thing in Datadog then?

Note that

Queries with as_count metrics in the formula, use a different evaluation path. The evaluation applies any aggregation before the formula. https://docs.datadoghq.com/monitors/guide/history_and_evaluation_graphs/#as_count-metrics

That means you should NOT write

sum(last_15m):http.requests{code:5*} / http.requests > 3*E

but

sum(last_15m):http.requests{code:5*} / http.requests > E

to implement the check stated earlier, of an err rate greater than E three times in a row. Indeed all the error requests are summed up over 15 minutes, all the requests summed up over 15 minutes, and only then divided one by the other and checked against E.

Why you cannot use any aggregation other than sum when using as_count() in monitors? Because f(last_Nminutes) is implemented by applying f on the query over a rolling rollup window of N minutes. If you’d use avg(last_5m):... and use as_count() , the former would do an average over the rollup interval, the latter would sum over such interval. On the other hand if you avoid specifying as_count() you’re free to choose the aggregation function. Indeed, as_count() is likely not needed in monitors and removing it and choosing sum(last_Nminutes) as the aggregation function returns the same result.