How can an AI SRE see Vercel deploys just before Datadog monitors?

Tares puts Vercel log drain entries and Datadog monitor alerts on one timeline per project, so an AI SRE reads which came first. You connect Vercel with the vercel connector and Datadog through the webhook connector, and label both with the same project key. The agent compares the deploy’s time against the first alert and records the gap in its finding.

How it works

• Vercel reaches Tares through the vercel connector, a push source. A Vercel log drain posts JSON to the source’s ingest URL, one event per log entry, keyed by project. Each entry also carries environment, source, path, host, deployment and branch. Build output arrives with source set to build, so the deployment and its branch sit next to the project.
• Datadog reaches Tares through the webhook connector and a Datadog webhook setup. Tares has no connector of its own for Datadog today. A monitor calls the webhook and posts a JSON payload that you write from Datadog variables such as $ALERT_ID, $EVENT_MSG and $LINK. Tares stores the payload lossless and maps the fields you label into the envelope.
• One clock. Both sources carry the same project label, so their events merge into one timeline for that project, ordered by time. For the Datadog source you can set event_time_field to the payload field that holds an ISO-8601 timestamp.
• The agent reads the order. A trigger wakes an agent, or you ask a connected MCP client, and it reads the correlated timeline. It sees the deploy entries, then the first monitor alert, and can state the gap, as in “deploy landed 14:02, errors started 14:04”.
• The agent writes it down. The finding records what broke, since when, the likely cause tied to evidence lines and a next action. It lands on the project’s timeline, so the next investigation starts from that conclusion.

The Build an AI SRE guide shows this loop end to end, including a webhook source for deploys.

Set it up

1. Create the Vercel source. In the console go to Sources → Add source → vercel. There is no required config, and the project, environment and source labels are pre-filled. Copy the ingest endpoint from the source page. The Vercel connector page covers the details.

- name: web-logs
  connector: vercel
  config:
    labels:
      - { name: project, field: project, primary: true }
      - { name: environment, field: environment }
      - { name: source, field: source }

2. Add the drain in Vercel under Team Settings → Log Drains → Add Log Drain. Set the endpoint to the ingest URL and the delivery format to JSON. Vercel delivers from its cloud, so the endpoint must be publicly reachable. Use a deployed instance or a tunnel, because a bare localhost daemon will not receive drains. Tares echoes back the x-vercel-verify header for Vercel’s verification request.
3. Create the Datadog source as a webhook source. Use a primary label named project, so Datadog alerts land on the same entity as the Vercel entries. Point field at the payload field that carries the project name. Keep the payload flat, because event_type_field and text_template read top-level fields only. See the webhook connector page.

- name: datadog-monitors
  connector: webhook
  config:
    labels:
      - { name: project, field: project, primary: true }

4. In Datadog, open the Webhooks integration and add a webhook whose URL is the Tares ingest URL. Write the payload as JSON from Datadog variables. Put the webhook’s @webhook handle in the monitor message so the monitor calls it.
5. On a secured instance, send an ingest-scoped API key as an Authorization: Bearer header. For Datadog, add it in the webhook’s custom headers, written as JSON. For the Vercel drain, add it as a custom header. An instance without auth needs no header.
6. Check the result. POST a test payload to the Datadog source and look at Recent events.

curl -X POST http://localhost:8787/ingest/<ingest_key> \
  -H 'Content-Type: application/json' \
  -d '{"action": "deploy", "sender": "ci", "pipeline": "web"}'

Then open Fields on each source to confirm that project appears with good coverage.

What you get

• One timeline per project with Vercel entries and Datadog alerts in time order.
• An agent that states the order plainly: the last deploy entries for the project, then the first monitor alert, and the time between them.
• A finding on the timeline that records the gap and the evidence lines behind the likely cause, ready for the next investigation or a connected client to read.
• Datadog keeps owning alerting. Tares ingests what fired, correlates it with the deploy evidence and wakes the agent.

When something else fits

• If your deploys come from a CD pipeline instead of Vercel, post one JSON event per deploy to a webhook source, as the AI SRE guide shows.
• If the Datadog payload cannot carry a matching project name, the two sources will not share an entity. Add a field to the payload, or key both sources by a label they both have.

Related