Glossary
Datadog’s vocabulary spans several layers at once: an Agent that collects (core Agent, Trace Agent, checks, DogStatsD, the aggregator and forwarder), a tagging model (env, service, version) that lets metrics, logs and traces join, APM with two stacked sampling layers, a logs pipeline that separates ingestion from indexing, monitors and SLOs that turn telemetry into alerts, and the Terraform and API-client layer that turns all of it into reviewable code. When a lesson uses a term you are unsure about, or you suspect an AI answer is using a stale name (CSPM, LLM Observability, log_injection), look it up here. Every definition below is sourced from a lesson that proved it against a real Agent, tracer or model, or quotes the docs URL the lesson cites; nothing here comes from memory or from a live Datadog account.
| Term | Meaning | Lesson |
|---|---|---|
| Agent | The small program you run on a host, container or as a Kubernetes DaemonSet. It collects data locally and ships it to the Datadog backend over HTTPS; it does not render dashboards, evaluate monitors or store history. It is a family of cooperating processes (core Agent, Trace Agent, Process Agent, optional Security Agent, and on Kubernetes a Cluster Agent), not one binary. | What Is Datadog?, The Datadog Agent and Integrations, Agent Architecture |
| agent analyze-logs | Runs a logs: config file against a running Agent and prints what would be sent, so exclude_at_match, mask_sequences and multi_line rules can be checked before deploy. Trap: with the default -t 1s the last multi-line event can be missing, because a group is emitted only when the next start line or the timeout closes it. | Log Pipeline Processors |
| agent configcheck / agent status | The two Agent CLI commands the course uses as ground truth. configcheck shows which check configs were actually loaded (and the real error for a malformed one, such as instances: written as a mapping); status is a section-by-section dump of the pipeline (Collector, Aggregator, DogStatsD, Forwarder, Logs Agent, OTLP). Trap: a config file existing on disk proves nothing until configcheck lists it. | The Datadog Agent and Integrations, Agent Architecture, The AI bug catalog |
| agent dogstatsd-stats | The Agent command that lists the DogStatsD contexts and counts it has seen. It needs DD_DOGSTATSD_METRICS_STATS_ENABLE=true; the lessons use it to show that h and d datagrams are received identically (20 each) and that each unique name-plus-tags pair is one context. | DogStatsD and Aggregation, Verification tools |
| Agent Observability | The current product name for what older material (and older AI output) calls LLM Observability: monitoring, troubleshooting and evaluating LLM-powered applications. Same product under a renamed umbrella, not a separate one. | What Is Datadog? |
| agent tagger-list | Command that dumps every tag the Agent’s tagger resolved per entity; the way to prove a container really got env / service / version. | Unified Service Tagging in Practice, Production Rollout Checklist |
| aggregator | The stage inside the core Agent where check samples and DogStatsD samples land before being flushed to the serializer and forwarder. It flushes on a roughly 15-second tick (11 flushes in 180 seconds on the measured container), which is one reason a value never appears in Datadog the instant it is submitted. | Agent Architecture, DogStatsD and Aggregation |
| AI bug catalog | The 27 recurring mistakes AI-generated Datadog config produces (Agent, dd-trace, ddtrace, RUM, metrics, Terraform, monitors), each with the real captured output and the fix. Some, such as a missing init_config:, are phantom bugs that a real Agent tolerates. | The AI bug catalog |
| allowedTracingUrls | The RUM SDK option listing the first-party origins the browser app calls; for those URLs the SDK attaches trace-context headers so the backend span links back to the RUM view. It still requires an explicitly configured service. Trap: omitting it (or using the retired allowedTracingOrigins) leaves RUM and APM as two unlinked views. | RUM and Real User Context, The AI bug catalog |
| API key vs. Application key | An API key authorizes submitting data (what the Agent holds) and is scoped to the organization. An Application key authorizes acting as a user through the read/management APIs (queries, dashboards, monitors, Terraform) and inherits that user’s permissions. Trap: a Terraform provider needs both, and losing the user loses the Application key’s access. | What Is Datadog?, Datadog as Code with Terraform |
| API test | A Synthetics test that makes a single HTTP, TCP, DNS or ICMP request and asserts on the status code, response time or body. It cannot catch a page that returns 200 yet renders broken; that is what a Browser test is for. | Synthetics and Uptime Checks |
| assertion (Synthetics) | A type / operator / target triple a Synthetics test checks on each run. The real operator vocabulary comes from the client enum (is, isNot, contains, matches, lessThan, moreThan, and more), so invented operators are worth checking against the model. | Synthetics and Uptime Checks |
| Autodiscovery | The Agent watches containers and pods and matches them against config templates attached as Kubernetes annotations or Docker labels, generating and tearing down check configs as workloads come and go. Traps: the annotation belongs on .spec.template.metadata, not on the Deployment; and the annotation key uses the check name (redisdb), so a label that says redis is discovered but never runs. | The Datadog Agent and Integrations, The AI bug catalog |
| auto-instrumentation | The tracing library hooking your framework, HTTP client and database driver to create spans without any tracing code. It stops at the boundary of your own business logic, where you add manual spans; the two combine into the same tree. | Traces, Spans, and the Service Map |
| Term | Meaning | Lesson |
|---|---|---|
| Browser test | A Synthetics test that runs a full scripted multi-step browser journey (load, click, assert) to test a real user flow end to end. It needs a message and steps in the model; it probes on a schedule, unlike RUM which observes real visitors. | Synthetics and Uptime Checks, RUM and Real User Context |
| burn rate | How fast the error budget is being consumed relative to the pace that would use it up exactly at the end of the SLO window. Docs formula: SLO target length in hours times percent of budget consumed, divided by long window in hours times 100. Trap: a burn rate of 1 is on schedule; 14.4 over a 1-hour long window is 2% of a 30-day budget. | SLOs, Error Budgets, and Burn Rate Alerts |
| burn_rate() query | The monitor query shape for a burn-rate alert: burn_rate("<slo_id>").over("30d").long_window("6h").short_window("30m") > 10. It needs all three pieces; .over() is the SLO’s own 7d, 30d or 90d target, not an alerting window, and the short window is about 1/12 of the long one. | SLOs, Error Budgets, and Burn Rate Alerts, The AI bug catalog |
| Term | Meaning | Lesson |
|---|---|---|
| cardinality | The number of distinct tag-value combinations on a metric (or facet values on logs). A custom metric is identified by name plus tag values including the host tag, so cardinality, not raw point volume, drives custom-metric cost. Trap: a per-request tag such as request_id creates a permanent new time series per call (30 calls gave 30 rows in dogstatsd-stats). | Tags and Unified Service Tagging, Custom Metrics with DogStatsD, Metrics without Limits and Tag Cardinality |
| Category Processor | A log pipeline processor that assigns a value to a new attribute by matching the log against ordered queries. The lesson’s fix for surprising level names (Java SEVERE mapping to OK, one-letter E mapping to info) is to normalise the level with a category processor before the Status Remapper. | Log Pipeline Processors |
| check | A small piece of Python bundled with the Agent that talks to one service (Postgres, Redis, NGINX, and so on) and turns its state into metrics, configured under conf.d/<name>.d/conf.yaml. Core checks (cpu, memory, disk, network) are compiled into the Agent’s Go binary instead. | The Datadog Agent and Integrations, Agent-Collected Metrics and Checks |
| check API (gauge, count, monotonic_count, rate, histogram) | The five submission verbs of an Agent check. gauge, count and histogram emit on the very first run; rate and monotonic_count need a second run to compute a delta, so a single agent check looks as if they are broken (use --check-rate). One histogram call fans out into five derived metrics. | Agent-Collected Metrics and Checks |
| check scheduler / runner | The scheduler queues check instances by interval (collector-queue-15s, -60s, -900s) and hands them to a fixed pool of runner workers; check_runners defaults to 4. A slow check occupies one worker for its whole run, and the default interval is about 15 seconds unless min_collection_interval says otherwise. | Agent Architecture, Agent-Collected Metrics and Checks |
| CI Visibility | The product for pipeline and test-run observability, correlating flaky tests and slow builds back to the same services. Named here as part of the product map only. | What Is Datadog? |
| Cloud Cost Management | Brings your cloud bill into Datadog as metrics you can query and monitor (for example aws.cost.amortized versus aws.cost.unblended, which is the one that matches the invoice). Trap: two cost monitors on different metrics disagree by design; pick the metric for the question. AWS data can take 48 to 72 hours to populate, per the docs. | Cost Governance and Cloud Cost Management |
| Cloud Security (CSM, CSPM) | The security product family: Misconfigurations, Identity Risks and Vulnerabilities, with runtime detection under Workload Protection. Cloud Security Management (CSM) is the umbrella name still seen in the wild; CSPM names only the posture half and is a stale term in older tutorials and AI output. | Security and Compliance Basics, What Is Datadog?, The Datadog Agent and Integrations |
| Cluster Agent | A separate image (datadog/cluster-agent) deployed once per cluster, not per node. It runs cluster-scoped work (Kubernetes State Metrics core check, External Metrics Provider for HPA, Admission Controller, cluster-check coordination) so node Agents do not each hit the API server. | The Datadog Agent and Integrations, Agent Architecture |
| collected fence / @expect-error | A code fence whose first line is a path comment (# datadog.yaml, // monitors/<name>.json, # terraform/<name>.tf, …) is collected and checked by the course harness. A first line containing @expect-error marks a deliberate failure and is skipped; any other fence is a fragment the strict modes never touch. | Verification tools, The AI bug catalog |
| Collector status (OTLP) | The OTLP section line of agent status that says whether the receiver pipeline is alive: Running is working, Closed means the pipeline died on startup. It is separate from Status: Enabled, which only means the setting is present; a misspelled protocol for protocols showed Enabled and Closed together. | OTLP and Open Standards |
| composite monitor | A monitor that combines the IDs of existing monitors with AND (&&), OR and NOT (!) to alert on a combination of states, for example the error-rate monitor alerting while the upstream monitor is not. Trap: the formula takes monitor IDs; placeholder names are not IDs. | Composite Monitors and Notification Workflows, The AI bug catalog |
| conf.d | The Agent directory holding one folder per integration (conf.d/<check>.d/conf.yaml). The folder is named after the check (redisdb, not redis), instances: must be a list even for one instance, and init_config: is conventional but tolerated when absent. | The Datadog Agent and Integrations, Agent-Collected Metrics and Checks, The AI bug catalog |
| core check | A check compiled into the Agent’s Go binary (cpu, memory, disk, network, io) that runs with no configuration and produces system.* metrics. Unlike integrations it cannot be installed or upgraded on its own, only by upgrading the Agent. | Agent-Collected Metrics and Checks |
| COUNT | A DogStatsD type (c) and check verb: increments a counter by the given value, answering “how many times did X happen”. In the Agent flush a counter becomes a per-second rate over the 10-second bucket (5 increments become 0.5). | Custom Metrics with DogStatsD, DogStatsD and Aggregation |
| critical / warning thresholds | The trigger lines in options.thresholds: crossing critical moves a metric alert to Alert, crossing the earlier warning to Warn. They answer only “when is it a problem”; recovery is a separate pair. | Monitor Types and Thresholds |
| custom check (checks.d) | A Python 3 file in checks.d/ extending AgentCheck, paired with a conf.d/<name>.d/conf.yaml. __NAMESPACE__ auto-prefixes every metric and service-check name, so a name that already carries the prefix gets it twice. | Agent-Collected Metrics and Checks |
| custom metric | Any metric you submit (DogStatsD, custom check, API) rather than one an integration ships. Billed per distinct name-plus-tag-values combination; the docs quote per-host allotments (100 Pro, 200 Enterprise), so estimate cardinality before go-live. | Custom Metrics with DogStatsD, Metrics without Limits and Tag Cardinality, Cost Governance and Cloud Cost Management |
| Term | Meaning | Lesson |
|---|---|---|
| Dashboard (ordered vs. free) | A saved collection of widgets. layout_type is a required field: ordered stacks widgets automatically (the sensible default), free places each with explicit x, y, width, height. Trap: JSON that shows only the widgets array raises a missing-argument error on layout_type. | Dashboards and the Datadog UI Tour, Building Dashboards and Notebooks |
| Datadog connector (trace metrics) | The OpenTelemetry Collector connector that turns spans into trace metrics. It is an exporter of the traces pipeline and a receiver of the metrics pipeline; if it is not wired to both, trace metrics vanish (Collector validate rejects the miswired file with exit 1). The docs’ newer recipe uses a span_metrics connector with the otlp_http exporter instead. | OTLP and Open Standards |
| datadog_dashboard vs. datadog_dashboard_json | Two distinct Terraform resources. datadog_dashboard uses HCL blocks, where a widget request needs query { metric_query { ... } } plus a formula block; writing name / data_source / query flat inside query is rejected by terraform validate. datadog_dashboard_json takes the whole dashboard body as a JSON string. | Datadog as Code with Terraform, Building Dashboards and Notebooks, The AI bug catalog |
| Datadog Exporter | The component in an OpenTelemetry Collector (otel/opentelemetry-collector-contrib) that forwards telemetry to Datadog intake without the Agent. Its key is nested (api.key); a flat apikey: is rejected by the Collector’s own validate. | What Is Datadog? |
| datadog_monitor / datadog_monitor_json | datadog_monitor models a monitor with typed attributes (monitor_thresholds, notify_no_data, no_data_timeframe); datadog_monitor_json takes the whole body as JSON. The query is raw API query syntax written by hand, not what the UI query builder shows. | Datadog as Code with Terraform, Monitor Types and Thresholds |
| Datadog Operator / DatadogAgent CRD | The recommended Kubernetes install: the Operator reconciles a DatadogAgent custom resource and reports health in its status, versus the Helm chart (datadog/datadog) that renders manifests. The CRD schema rejects a misspelled key that Helm values would carry silently. | The Datadog Agent and Integrations, Production Rollout Checklist |
| Date Remapper / Status Remapper / Message Remapper | Pipeline processors that promote a parsed attribute to the log’s official timestamp, its status severity, or its main message. They make severity-based queries and facets work across services that name these fields differently. Trap: a remapper placed before the parser that creates its attribute has nothing to remap. | Log Collection and Processing Pipelines, Structured Logging and Log Facets |
| date() matcher (Grok) | The Grok matcher date("pattern"[, "timezoneId"[, "localeId"]]). The pattern has no zone unless you pass one, so a log written in local time (for example Asia/Bangkok, UTC+7) is read as UTC and lands seven hours in the future, outside the documented two-hour future window. Always pass the zone. | Log Pipeline Processors |
| DD_CHECKS_TAG_CARDINALITY | The Agent dial for how many tags it attaches to check metrics: low (default: cluster, host, image), orchestrator (adds pod or task), high (adds individual containers, user IDs). Raising it is a deliberate cost decision. The DogStatsD sibling is DD_DOGSTATSD_TAG_CARDINALITY. | Tags and Unified Service Tagging |
| DD_ENV / DD_SERVICE / DD_VERSION | The environment variables that carry unified service tagging into the tracer (only required for APM) and, in containers, that the Agent turns into env: / service: / version: tags. Trap: a misspelled DD_SERVCE raises no error, and the container is simply half-tagged; values are not lowercased client-side, so DD_ENV=Prod is a different value from prod. | Unified Service Tagging in Practice, Production Rollout Checklist, The AI bug catalog |
| dd.* log fields | The injected identity in a log line: dd.trace_id and dd.span_id as pivot keys, plus dd.env, dd.service, dd.version. They let a log line jump to its exact trace in one click. | Connecting Logs and Traces, Structured Logging and Log Facets |
| DD_LOGS_INJECTION / logInjection | How a tracer stamps dd.* fields on log lines. Node uses the logInjection option; Python uses DD_LOGS_INJECTION with ddtrace-run or patch_all(). Trap: log_injection (snake_case) is silently ignored by dd-trace, and it only looked to work because the default is already true. | Connecting Logs and Traces, The AI bug catalog |
| DD_SITE | The Agent or tracer setting naming the Datadog site as a domain such as datadoghq.com, never a URL. Pointing at the wrong site’s intake authenticates against the wrong backend. | What Is Datadog?, The AI bug catalog |
| dd_url and per-writer URLs | dd_url (DD_DD_URL) moves only the core forwarder. The Trace Agent, Logs Agent and process writers keep their defaults and each has its own setting: apm_config.apm_dd_url, logs_config.logs_dd_url, process_config.process_dd_url. A fake-key Agent with only dd_url changed still reached the real intakes and got HTTP 403. | Agent Architecture |
| DDSketch | Datadog’s mergeable quantile sketch (Masson, Rim, Lee, VLDB 2019) with a relative-error guarantee. Merging three hosts’ sketches was off 0.5% at p99, while averaging their p99 values was off 46%. It backs trace latency percentiles and DISTRIBUTION metrics. | Trace Metrics and DDSketch, DogStatsD and Aggregation |
| DD_SPAN_SAMPLING_RULES | Configures single-span sampling, which keeps chosen spans (for example a slow database call) even when the trace-level decision drops the whole trace. Its max_per_second cap stops a high-volume operation from defeating the ingestion sampler. | Ingestion Sampling vs. Retention Filters |
| DD_TAGS | The environment-variable form of the Agent’s tags: list. It is a space-separated list, so team:payments api silently becomes two tags (team:payments and a bare api), unlike a tags: YAML item which stays one string. | Tags and Unified Service Tagging |
| DD_TRACE_PROPAGATION_STYLE | Which trace-context formats a tracer injects and extracts: datadog, tracecontext (W3C), b3, b3multi, baggage, none. Trap: two services with no format in common silently split one trace into two at that hop, leaving a gap in the Service Map. | Traces, Spans, and the Service Map, Connecting Logs and Traces |
| DD_TRACE_RATE_LIMIT | The tracer’s cap on traces per second the head sampler may keep (100 when unset), applied after the sampling rate. A trace with _dd.rule_psr=1 next to priority -1 was dropped by this limiter, and _dd.limit_psr records its effective rate. | The Trace Sampling Pipeline, Ingestion Sampling vs. Retention Filters |
| DD_TRACE_SAMPLING_RULES / DD_TRACE_SAMPLE_RATE | Head-sampling controls in the tracer. Rules match by service, name, resource or tags; the global sample rate is implemented as a rule. Precedence is rule, then Agent-supplied rate, then default. Trap: DD_TRACE_SAMPLE_RATE is not deprecated - dd-trace (Node) honours it, but ddtrace (Python) 4.15.2 silently ignores it; use DD_TRACE_SAMPLING_RULES for cross-language behaviour. | The Trace Sampling Pipeline, Ingestion Sampling vs. Retention Filters, The AI bug catalog |
| decision mechanism (_dd.p.dm) | The _dd.p.dm tag records which sampling mechanism decided a trace: - plus a code. Tracer constants (dd-trace 6.17.0): 0 default, 1 Agent rate, 3 rule, 4 manual, 5 App and API Protection, 8 span rule, 11 remote user rule, 12 remote dynamic rule, 13 AI Guard. -9 is the Agent’s probabilistic sampler and is not among the tracer’s constants. Rejected traces carry no dm. | The Trace Sampling Pipeline |
| DISTRIBUTION | A DogStatsD type (d) that ships raw values so percentiles are computed globally on the backend. The Agent sends a DDSketch to /api/beta/sketches, not a series. Percentiles beyond count, min, max, sum, avg are opt-in (include_percentiles). Trap: it is not client-side pre-summable, unlike counters and gauges. | Custom Metrics with DogStatsD, DogStatsD and Aggregation, Metrics without Limits and Tag Cardinality |
| DogStatsD | The daemon bundled in the Agent that receives custom-metric datagrams over UDP (port 8125) or a Unix domain socket. Trap: agent dogstatsd-stats counts unique name-plus-tags contexts, the same unit custom metrics are billed against. | Custom Metrics with DogStatsD, DogStatsD and Aggregation |
| DogStatsD datagram | One text line: name:value then a type code (c, g, h, d, s, ms), an optional @ sample rate and #tag1,tag2. Buffering packs many lines into one packet; client-side aggregation collapses counters, gauges and sets first. | Custom Metrics with DogStatsD, DogStatsD and Aggregation |
| Downtime | A mute window that suppresses a monitor’s notifications for planned maintenance while evaluation and state history continue; notifications resume automatically when it ends. | Composite Monitors and Notification Workflows |
| Term | Meaning | Lesson |
|---|---|---|
| error budget | The allowance of bad time or events a target implies: 99.9% over 30 days is a 43.2-minute budget. At 0% the window has already fallen below target. | SLOs, Error Budgets, and Burn Rate Alerts |
| error budget alert | An SLO alert on the cumulative share of budget consumed (for example warn at 50%, alert at 75%). It says “we are running out”, useful for deciding whether to ship a risky change, not how fast it is happening. Contrast with a burn rate alert. | SLOs, Error Budgets, and Burn Rate Alerts |
| error sampler / rare sampler | Agent-side trace samplers that do enforce. The error sampler rescues erroring traces the head sampler rejected (default about 10 per second per Agent; 105 of 500 measured); a rejected trace without an error is dropped completely. The rare sampler is off by default. | The Trace Sampling Pipeline |
| Error Tracking | Groups repeated errors from traces and logs into one issue with a new, triaged, resolved lifecycle and links to example traces. It starts from a trace, so it tells you which deduplicated issue a failing span belongs to. | Continuous Profiler and Error Tracking |
| escalation_message | A different message for re-notification, set with renotify_interval. Trap: it belongs nested under options; at the top level the client constructor accepts it with no exception and it does nothing. | Composite Monitors and Notification Workflows |
| evaluation_delay | Seconds by which a monitor shifts its evaluation window later, so late-arriving data (cost metrics, slow pipelines) is complete before a decision is made. | Monitor Types and Thresholds |
| exclude_at_match | An Agent-side log_processing_rules type that drops a raw line matching a regex before it leaves the host. Cheapest place to filter, but final: never archived, never parsed, unrecoverable. | Indexes, Exclusion Filters, and Retention |
| Exclusion Filter | A Lucene-style query on a Log Index that samples out or drops matching logs from that index only. Logs can still reach another index, an Archive or a log-based metric. Trap: query: "*" with sample_rate: 1.0 drops everything and validates cleanly. | Indexes, Exclusion Filters, and Retention, The AI bug catalog |
| Term | Meaning | Lesson |
|---|---|---|
| Facet | A log attribute promoted to something the Logs Explorer can filter, group and chart. Creation is UI-only (no public API model), and Log Analytics over a facet only sees indexed logs. | Structured Logging and Log Facets |
| flapping | A monitor bouncing between Alert and OK when a value oscillates at the threshold. Recovery thresholds set meaningfully below the trigger (for example 70 versus 90) create a dead zone that prevents it. | Monitor Types and Thresholds, Datadog as Code with Terraform |
| Flex Logs | A cheaper, longer-retention storage tier for indexed logs; its existence shows up as num_flex_logs_retention_days next to num_retention_days on the LogsIndex model. Pricing is not stated in the course. | Indexes, Exclusion Filters, and Retention |
| forwarder | The core Agent stage that owns every HTTP request and retry. Failed payloads are requeued in memory with backoff (RetryQueueSize). The Trace Agent and Logs Agent bypass it and have their own writers and endpoint settings. | Agent Architecture |
| Term | Meaning | Lesson |
|---|---|---|
| GAUGE | A DogStatsD type (g) and check verb: the exact value at this instant, where only the last value in the interval matters (999 after 1,000 calls). | Custom Metrics with DogStatsD, Agent-Collected Metrics and Checks, DogStatsD and Aggregation |
| Grok Parser | A pipeline processor that applies a Grok pattern to pull attributes out of a free-text line. It is a bet on the format staying identical; structured JSON logs avoid the bet. | Log Collection and Processing Pipelines, Structured Logging and Log Facets |
| Term | Meaning | Lesson |
|---|---|---|
| harness modes (—options, —tf, —json, —agent) | The four ways npm run verify checks collected fences: --options (every tracer option, ddtrace.config attribute and DD_* name exists), --tf (terraform validate with the pinned provider), --json (datadog-api-client models and the Service Catalog schema), --agent (a real Agent starts with your YAML). Blind spot: --agent reported 0 failed for an instances: mapping that configcheck itself flagged. | Verification tools |
| head-based sampling | The keep-or-drop decision made once at the start of the root span and propagated to every downstream service in the trace. It is Gate 1 of the pipeline; the rate can come from a rule, the Agent or the default. | The Trace Sampling Pipeline, Ingestion Sampling vs. Retention Filters |
| HISTOGRAM | A DogStatsD type (h) aggregated per host by the Agent into .avg, .max, .median, .95percentile and .count. Trap: those are per-host, so a global percentile needs DISTRIBUTION; and Metrics without Limits has no histogram metric type, only the derived series. | Custom Metrics with DogStatsD, Agent-Collected Metrics and Checks, The AI bug catalog |
| host tags | Tags attached to everything an Agent reports on a host: automatic ones (hostname, cloud metadata) and the tags: list in datadog.yaml. agent status shows them as configured; lowercasing and space handling happen server-side. | Tags and Unified Service Tagging, Unified Service Tagging in Practice |
| Term | Meaning | Lesson |
|---|---|---|
| ingestion (APM) | Layer 1 of trace sampling: how many traces are sent to Datadog at all. Anything not ingested is unrecoverable; it is independent of the retention filters that decide what stays searchable. A high ingestion rate does not guarantee retention. | Ingestion Sampling vs. Retention Filters, The Trace Sampling Pipeline |
| Ingestion Control page | Backend view of ingestion configuration per service, whose rate changes reach tracers via Remote Configuration (Agent 7.41.1 or newer, per the docs). Docs-sourced, not run in the course. | The Trace Sampling Pipeline |
| integration | A separately versioned Python wheel (datadog-redisdb, and so on) bundled in the Agent image and manageable with agent integration install without touching the Agent binary. It only runs once a conf.d file exists for it. | The Datadog Agent and Integrations, Agent-Collected Metrics and Checks |
| Intelligent Retention Filter | An always-on backend filter that keeps a representative share of ingested traces for general health, in addition to custom retention filters. Docs-sourced. | Ingestion Sampling vs. Retention Filters, The Trace Sampling Pipeline |
| Term | Meaning | Lesson |
|---|---|---|
| Log Analytics | Group-by, measures and aggregations over facets in the Logs Explorer. It operates only on indexed logs, so excluded logs need a relaxed filter, a log-based metric or Rehydration to be analyzed. | Structured Logging and Log Facets |
| Log Archive | Effectively the full log stream sent to storage you own (S3, GCS, Azure Blob) regardless of Exclusion Filters, for compliance and long-term retention. Not searchable as-is; Archive Search or Rehydration make it usable. | Log-Based Metrics and Logging without Limits |
| log-based metric | A COUNT or DISTRIBUTION metric computed from the full ingest stream, including logs no index keeps. 10-second granularity and 15-month retention per the lesson. aggregation_type is count or distribution only. | Log-Based Metrics and Logging without Limits |
| log_processing_rules | The Agent-side rules inside a logs: block (exclude_at_match, mask_sequences, multi_line). They run on the host before the line is sent and nothing downstream can undo them, so data you must never store belongs here rather than in a backend pipeline. | Log Pipeline Processors |
| Logging without Limits | Datadog’s name for decoupling log ingestion from indexing, so metrics and Archives draw from everything ingested while indexes hold only what you choose to pay for. | Log-Based Metrics and Logging without Limits |
| Log Index | Where full-price searchable log retention happens. Properties: num_retention_days (not retention_days), daily_limit, filter and Exclusion Filters. With several indexes the first matching one wins (LogsIndexesOrder). | Indexes, Exclusion Filters, and Retention |
| log injection | A tracer hooks the logging library, reads the active span from request-scoped context, and adds its trace_id and span_id to every record, so a log line can be pivoted to its exact trace instead of correlated by timestamp. | Connecting Logs and Traces |
| Term | Meaning | Lesson |
|---|---|---|
| Metrics without Limits | Decouples the tags submitted from the tags indexed and queryable, per custom metric, non-destructively and reversibly, with no redeploy. Ingested and indexed volumes bill separately. metric_type accepts gauge, rate, count, distribution. | Metrics without Limits and Tag Cardinality |
| min_collection_interval | Per-instance check option setting the run interval (default about 15 seconds). The scheduler honors it: 30 gave three runs in about 90 seconds of uptime. | Agent-Collected Metrics and Checks |
| min_location_failed | Synthetics option: how many locations must fail before alerting. Default is 1, so a test on three locations alerts the instant any single one fails. Compose it with options.retry, which retries the same location first. | Synthetics and Uptime Checks |
| monitor | A saved query plus rules that turn its result into OK, Warn, Alert or No Data. Many types (metric, log, APM, composite, synthetics, SLO, RUM, service check) share one model and one notification pipeline; only the data source differs. | Monitor Types and Thresholds, Synthetics and Uptime Checks |
| Term | Meaning | Lesson |
|---|---|---|
| Notebook | A top-to-bottom document mixing graphs, log queries and markdown, suited to incident timelines and postmortems. Notebooks exist only in the v1 API client and share the widget definition shape with dashboards. | Dashboards and the Datadog UI Tour, Building Dashboards and Notebooks |
| notify_no_data | Alerts when a query stops returning data. Trap: the monitor must have evaluated data at least once, so a wrong metric name or tag that never reported never alerts. Default missing-data behaviour also varies by query type (default_zero(), for one). | Monitor Types and Thresholds, The AI bug catalog, Datadog as Code with Terraform |
| Term | Meaning | Lesson |
|---|---|---|
| origin detection | Tagging DogStatsD metrics with container metadata. It requires a Unix domain socket (a filesystem-scoped writer the Agent can vouch for) and host PID mode, so UDP cannot provide it. Docs-sourced in the lesson, not run live. | Custom Metrics with DogStatsD |
| OTel semantic convention mapping | OTel service.name maps to service, service.version to version, and deployment.environment.name to env (the old deployment.environment is deprecated). Needs Agent 7.58.0 or newer, Datadog Exporter v0.110.0 or newer, or direct OTLP intake. | What Is Datadog? |
| otelcol validate | The Collector’s own config check. Unlike the Agent’s configcheck, it builds the pipeline graph, so in otelcol-contrib 0.161.0 it rejected a miswired connector with exit 1 and a flat apikey: under the Datadog Exporter, while passing a correct file with exit 0. | OTLP and Open Standards |
| OTLP | The vendor-neutral OpenTelemetry protocol. The Agent becomes a receiver on 4317 (gRPC) and 4318 (HTTP) when otlp_config is enabled (agent status shows Status: Enabled); a Collector can instead export through the Datadog Exporter. | What Is Datadog?, Agent Architecture |
| OTLP metrics translation | How the Agent turns OTLP metrics into Datadog ones: cumulative_monotonic_mode: to_delta makes a cumulative counter’s first value a baseline that produces no point (the second export gave a delta of 15), and histograms.mode: distributions builds a DDSketch from the explicit buckets. Resource attributes such as service.name become unified-service tags. | OTLP and Open Standards |
| OTLP probabilistic sampler | The sampler that applies to OTLP traces (otlp_config.traces.probabilistic_sampler). No Datadog tracer is involved, so DD_TRACE_SAMPLING_RULES does not apply; 98 of 400 traces (24.5%) were kept at a 25% setting. | OTLP and Open Standards, The Trace Sampling Pipeline |
| otlp_config | The datadog.yaml section that turns on the Agent’s OTLP receiver. It is off by default; the endpoints live under receiver.protocols.grpc.endpoint / receiver.protocols.http.endpoint (DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_*_ENDPOINT, which must reach both the core Agent and the Trace Agent). Trap: localhost is unreachable from other containers; use 0.0.0.0 inside containers. One Agent per host is the supported topology. | OTLP and Open Standards |
| otlp_http exporter | The OpenTelemetry Collector exporter the docs now recommend for Datadog: it sends to Datadog’s OTLP intake (https://otlp.<YOUR_DD_SITE>), paired with a span_metrics connector and a Datadog extension. It has a different config shape from the older Datadog Exporter, so AI-written configs often mix the two. | OTLP and Open Standards |
| Term | Meaning | Lesson |
|---|---|---|
| phantom bug | A “bug” that AI or a reviewer reports but a real run disproves. The catalog’s example is the claim that a missing init_config: breaks a check: the Agent loaded it fine. Reviewing means proving a bug, not only suspecting one. | The AI bug catalog |
| pipeline filter (logs) | The query that decides which logs enter a log pipeline. It is evaluated before the pipeline’s processors, so you cannot filter on an attribute the pipeline itself extracts. The docs recommend at most 20 processors per pipeline and 10 parsing rules per Grok processor. | Log Pipeline Processors |
| Powerpack | A reusable, saveable group of dashboard widgets that can be dropped into many dashboards. | Building Dashboards and Notebooks |
| preprocessing (JSON logs) | The step that runs on JSON logs before any pipeline, using reserved attributes such as timestamp, status, host, service and message. A log already carrying level, severity, status or syslog.severity gets its status here, so a pipeline remapper may never see it as a choice. | Log Pipeline Processors |
| priority (monitor) | An integer 1 (high) to 5 (low) on the monitor payload; the message template uses the string form {{#is_priority 'P2'}}. Passing the P string into the payload field is a type error. | Composite Monitors and Notification Workflows |
| private location | A Synthetics location you host to test internal-facing applications and endpoints not reachable from Datadog’s public network. | Synthetics and Uptime Checks |
| probabilistic sampler (Agent) | The Agent-side sampler enabled with DD_APM_PROBABILISTIC_SAMPLER_ENABLED=true and ..._SAMPLING_PERCENTAGE. It keeps a fixed percentage by hashing (210 of 1,000 at 20%), tags kept traces _dd.p.dm=-9, and the Agent then returns an empty rate_by_service ({}) because it does the sampling itself. | The Trace Sampling Pipeline |
| Process Agent | Collects live process data for Live Processes. In Agent 7.83.3 on Linux it is no longer a separate running process: the core Agent starts a process component, and agent status reports it as a Process Component. | The Datadog Agent and Integrations, Agent Architecture |
| Process Component | The agent status section that lists the process checks running inside the core Agent (Enabled Checks: [process rtprocess]) and their submission errors. In Agent 7.83.3 it is where Live Processes collection is reported, while the Process Agent section reads Not running or unreachable; both are true at once. | Agent Architecture |
| Processing Pipeline | An ordered list of processors run after intake on every log matching its filter, before indexing. It parses and enriches; it does not decide what is kept. Source-specific built-in pipelines attach automatically from source: (for example java, nginx). | Log Collection and Processing Pipelines |
| profiler (Continuous Profiler) | Always-on, low-overhead profiling of CPU time, wall time and allocations at function level, tied to the service, endpoint and trace. Proven locally with DD_PROFILING_EXPORTERS=file (Node) and DD_PROFILING_OUTPUT_PPROF (Python). Trace says which span; the profiler says which function. | Continuous Profiler and Error Tracking |
| Term | Meaning | Lesson |
|---|---|---|
| rate_by_service | The map of sampling rates (per service:...,env:...) the Agent returns to tracers in each trace flush response. It is advice, not enforcement: with a target of 10 traces per second and 100 offered it converged on 0.1 after about 10 seconds, yet the Agent still forwarded all 720 priority-1 traces it was sent. | The Trace Sampling Pipeline |
| Rehydration | Temporarily re-indexes a time-scoped slice of a Log Archive so it is searchable in the Logs Explorer. Archives cap it with rehydration_max_scan_size_in_gb and rehydration_tags; Archive Search is the no-reindex alternative that charges for data scanned. | Log-Based Metrics and Logging without Limits |
| remote agent | A component that registers with the core Agent over its internal gRPC bus and reports in on agent status (2 remote agent(s) registered: Agent Data Plane and Security Agent in the measured container). It is how a separate process shows up as alive without being a check. | Agent Architecture |
| Remote Configuration | The channel by which backend changes (for example Ingestion Control sampling rates) reach tracers through the Agent. Requires Agent 7.41.1 or newer per the docs. | The Trace Sampling Pipeline |
| renotify_interval | Minutes between repeat notifications while a monitor stays triggered. Pair it with escalation_message for different text. | Monitor Types and Thresholds, Composite Monitors and Notification Workflows |
| restricted_roles / RBAC | Role IDs limiting who can edit a monitor (in Terraform a permission’s id is an ID, not its name). In Log Management, logs_modify_indexes is a global delegation right (create indexes, change routing and retention, grant exclusion-filter rights), so it is a cost control, not just an access one. | Composite Monitors and Notification Workflows, Security and Compliance Basics, The AI bug catalog |
| retention filter (APM) | Server-side rule (filter_type: spans-sampling-processor) with two independent knobs: rate for matching spans and trace_rate for whole traces containing one. Applied in order; kept for 15 days per the docs. The model class is not named like the spec (a real name correction). | Ingestion Sampling vs. Retention Filters, The Trace Sampling Pipeline |
| retry queue (forwarder) | The in-memory queue where the forwarder keeps failed payloads with backoff (forwarder_backoff_max, 64 s). It is bounded by forwarder_retry_queue_payloads_max_size (15 MiB); overflow is counted under Dropped, the number to watch for lost data, and with on-disk storage disabled a restart empties the queue. | Agent Architecture |
| review checklist | A one-page, seven-group set of yes/no questions for reviewing Datadog config and instrumentation code, each linked to a catalog entry and the tool that proves it, including what no offline tool can see. | Review checklist, The AI bug catalog |
| RUM (Real User Monitoring) | An SDK inside the browser or mobile app that emits session, view, action and error events from real visitors. sessionSampleRate defaults to 100. Contrast with Synthetics, which is a scripted probe. | RUM and Real User Context, What Is Datadog? |
| Term | Meaning | Lesson |
|---|---|---|
| s6-supervise | The container’s process supervisor, with one entry per Agent component (agent, trace, process, security, sysprobe, data-plane). s6-svstat shows each service, and down (exitcode 0) is a clean idle exit (the component found no work), not a crash. | Agent Architecture |
| sampling priority (_sampling_priority_v1) | The value on the root span that carries the head-sampling decision: -1 user reject, 0 auto reject, 1 auto keep, 2 user keep. A rejected trace (-1 or 0) is still sent to the Agent (40 of 40 arrived), so the tracer’s decision saves work only when the trace is also discarded. | The Trace Sampling Pipeline |
| Security Agent | Optional Agent process for Cloud Security (compliance and runtime security). It exits cleanly with code 0 when neither is enabled, which is idle, not a crash. | The Datadog Agent and Integrations, Agent Architecture |
| Sensitive Data Scanner | Finds patterns (card numbers, API keys, PII, custom regex) in logs, APM spans, RUM events and events. Terraform vocabulary differs from the UI: text_replacement.type is hash, replacement_string, and so on, with no redact. Unmask rights (data_scanner_unmask) matter as much as the rule. | Security and Compliance Basics |
| Service Catalog / Software Catalog | A definition you declare about a service, independent of telemetry: metadata.owner, spec.dependsOn, datadog.codeLocations. The docs and UI also say Software Catalog. Trap: apiVersion: v3 and the older v2.1 shape are structurally incompatible, and the pinned Terraform provider still expects v2.1. | The Service Catalog and Ownership, What Is Datadog?, The AI bug catalog |
| Service Map | The live graph of service-to-service edges, built from spans whose child has a different service than the parent. It updates itself from traffic. A declared spec.dependsOn edge can appear in the Catalog even when no span ever crosses it. | Traces, Spans, and the Service Map, The Service Catalog and Ownership |
| Session Replay | A pixel-level recreation of a RUM session. Opt-in (sessionReplaySampleRate defaults to 0) and defaultPrivacyLevel defaults to mask-user-input, though the DOM structure and non-input text are still recorded. | RUM and Real User Context |
| SET | A DogStatsD type (s) counting unique values submitted, for example unique users. Client-side aggregation collapses 1,000 samples over 7 distinct members into 7 lines. | Custom Metrics with DogStatsD, DogStatsD and Aggregation |
| setUser | RUM call attaching @usr context to later events. The current overload requires id; the id-less overload is deprecated. | RUM and Real User Context |
| SLO (metric, monitor, time slice) | A target such as 99.9% over 30 days in one of three types: metric-based (good over total), monitor-based (uptime of monitors), time slice (was the query within bounds in each slice). thresholds is required for every type. | SLOs, Error Budgets, and Burn Rate Alerts |
| Software Catalog | See Service Catalog. | The Service Catalog and Ownership |
| span | One unit of work with name, resource, start, duration, service and a parent_id. A span with no parent is the root span. meta holds string tags and metrics numbers. | Traces, Spans, and the Service Map |
| span evidence tags (_dd.rule_psr, _dd.limit_psr, _dd.agent_psr, _dd.p.dm) | Tags left on root spans by each sampling gate: _dd.rule_psr (rule rate), _dd.limit_psr (rate limiter), _dd.agent_psr (Agent rate), and _dd.p.dm (decision mechanism: -0 default, -1 Agent rate, -3 rule, -4 manual, -9 Agent probabilistic sampler). _sampling_priority_v1 holds the resulting priority. | The Trace Sampling Pipeline, Ingestion Sampling vs. Retention Filters |
| synthetic monitoring | Scripted, scheduled checks from Datadog’s location network (API tests and Browser tests). A failure raises a synthetics alert monitor that uses the same thresholds, mentions, escalation and Downtimes as any other monitor. | Synthetics and Uptime Checks, What Is Datadog? |
| Term | Meaning | Lesson |
|---|---|---|
| tag | A key:value label on metrics, logs and traces. Tags are limited to 200 characters, and lowercasing plus character replacement happen at Datadog’s backend, not in the Agent. Reserved keys are host, env, service, version. | Tags and Unified Service Tagging |
| target_traces_per_second | Agent setting (DD_APM_TARGET_TPS, default 10) that computes sampling rates and advises tracers via the rate_by_service response. It does not drop head-sampled traces: 720 in, 720 out. Use it instead of the deprecated max_traces_per_second. | The Trace Sampling Pipeline, Ingestion Sampling vs. Retention Filters |
template conditionals ({{#is_alert}}) | Monitor message blocks that vary text by state: {{#is_alert}}, {{#is_warning}}, {{#is_recovery}}, {{#is_no_data}}, {{#is_renotify}}, {{#is_priority 'P1'}}. Each needs a matching closing tag. | Composite Monitors and Notification Workflows |
| Terraform provider (datadog) | The DataDog/datadog provider pinned at 4.22.0 in this course, checked with terraform validate, fake keys and validate = false. Authentication differs per site, and the Application key ends up in state, so treat state as a secret. | Datadog as Code with Terraform |
| terraform validate | The check that catches wrong argument names, block types and value types against the pinned provider (Unsupported argument, Missing required argument). Run it with a fake key, validate = false on the provider block, and never plan or apply; it cannot tell whether a query string is a valid Datadog query. | Verification tools, Review checklist |
| TIMER | A DogStatsD type (ms), an alias of HISTOGRAM conventionally used for millisecond timings. | Custom Metrics with DogStatsD |
| trace | The end-to-end journey of one request as a tree of spans rooted at the span with no parent. A trace stays one trace across services only if both sides agree on a propagation format. | Traces, Spans, and the Service Map, Connecting Logs and Traces |
| Trace Agent | The Agent’s own binary that receives spans from tracers on TCP 8126 or a Unix socket, batches them and forwards them to APM intake. It also listens for OTLP, and its writer bypasses the core forwarder. | The Datadog Agent and Integrations, Agent Architecture |
| trace metrics | Hit count, error count and latency computed from every span reaching Datadog, so they are not affected by ingestion sampling or retention filters. Only opening one specific example trace depends on those layers. compute_stats_by_span_kind widens which spans feed the stats. | Trace Metrics and DDSketch |
| Term | Meaning | Lesson |
|---|---|---|
| UDS (Unix domain socket) | DogStatsD’s filesystem-scoped transport, tracked as separate Uds Packets next to Udp Packets. UDP is connectionless and unauthenticated and needs dogstatsd_non_local_traffic to be reached from outside. | Custom Metrics with DogStatsD |
| unified service tagging | Setting env, service and version identically on Agent metrics, tracer spans and log injection so the three products join on one identity. In Kubernetes use the tags.datadoghq.com/* labels on both workload and pod template; in Docker com.datadoghq.tags.*. Trap: case mismatches silently split the join. | Tags and Unified Service Tagging, Unified Service Tagging in Practice, Production Rollout Checklist |
| _unparsed (client models) | The datadog-api-client constructor does not enforce enum values, and Monitor(type="metrics alert") builds. The deserializer sets _unparsed = True for an enum or oneOf mismatch, a stronger signal the harness does not use. Trap: a green model check is not proof a payload is valid. | The AI bug catalog, Review checklist |
| Term | Meaning | Lesson |
|---|---|---|
| Watchdog | Zero-configuration anomaly detection on your existing telemetry. It is not a monitor you build. | Monitor Types and Thresholds |
| Workload Protection | The runtime side of Cloud Security: rules over process, file and network activity on hosts, containers and Kubernetes, catching things like a container spawning an unexpected shell. | Security and Compliance Basics |