What does an event from Datadog monitors look like once it reaches Tares?

Tares stores a Datadog monitor alert as one event that holds the JSON payload you define in Datadog, with labels, event type and text mapped from its top-level fields. Datadog reaches Tares through the webhook connector and a vendor setup, because Tares has no connector of its own for Datadog today. You write the payload in Datadog’s webhook Payload field, so the shape of the event is yours.

How it works

Each time a monitor calls your Datadog webhook, Datadog POSTs the JSON you wrote to a Tares ingest URL. The webhook connector receives it and turns it into one event.

• Payload. The full JSON is stored lossless. Nothing you send is dropped, even fields you do not map.
• Labels. You declare a label for each payload field you want to correlate on and mark one as primary. Labels carry those payload values into the event envelope.
• Event type. It is a fixed value (webhook_event by default) or is read from a payload field you name with event_type_field.
• Text. text_template renders a line of text from payload fields.
• Time. event_time_field names a payload field that holds an ISO-8601 timestamp, if you send one.

Datadog gives you variables such as $ALERT_ID, $EVENT_MSG and $LINK to build the payload. Keep the payload flat. event_type_field and text_template read top-level fields only, so a nested field cannot drive the event type or the text.

Tares does not add Datadog-specific fields. If your payload carries a monitor name, a priority or a link, those arrive as payload fields, and you promote the ones you care about to labels.

Set it up

1. In Tares, open Sources, Add source, webhook. Declare one label per payload field you want to correlate on and mark one primary. Save, then copy the ingest endpoint from the source page. You can also ask a connected agent to create the webhook source and give you the URL.

- name: ci-events
  connector: webhook
  config:
    event_type_field: action
    text_template: '{action} by {sender}'
    labels:
      - { name: pipeline, field: pipeline, primary: true }

Replace the field names with the top-level fields your Datadog payload carries.

2. In Datadog, open the Webhooks integration and add a webhook whose URL is the Tares ingest URL.
3. In the webhook Payload field, write the payload as flat JSON from Datadog variables.
4. If Tares has auth on, add custom headers as JSON in Datadog with an Authorization Bearer header that holds an ingest-scoped API key. That header is the credential. If auth is off, you do not need it.
5. Put @webhook- followed by your webhook name in the monitor message, so the monitor calls the webhook.
6. Check the mapping. POST a sample payload to the ingest URL, then read Recent events and Fields on the source page. Fields shows which payload fields arrive and how often, which helps you pick a reliable primary label.

curl -X POST http://localhost:8787/ingest/<ingest_key> \
  -H 'Content-Type: application/json' \
  -d '{"action": "deploy", "sender": "ci", "pipeline": "web"}'

The test payload above is the generic webhook example. Once Datadog sends a real alert, Recent events shows it in the same form, with your own fields.

What you get

• One event per monitor notification, with the exact JSON Datadog sent kept in the payload.
• Labels you chose, so Tares can correlate the Datadog alert with events from your other sources on the same entity.
• A readable text line and an event type that you control through text_template and event_type_field.
• A source page where Recent events and Fields show what arrived, so you can adjust the labels without guessing.

For a wider view of how alert events feed investigation, see AI SRE.

When something else fits

• If your alerts come from Prometheus rules, the Alertmanager connector splits each batch into one event per alert and tracks firing and resolved states for you. Datadog has no equivalent mapping, so you shape the payload yourself.
• If you want a ready-made field layout for the event, define it in the Datadog Payload field before you create labels, because Tares maps only what you send.

Related