Datadog change report and spike monitors
log10x_datadog_change_reportGenerate a weekly Datadog change report listing new log statements per service with daily volume, estimated monthly indexing cost, and the rule that held them. Optionally render monitor definitions for tier down or offload.
Instructions
Weekly change report for a Datadog install, read from the per-pattern series the engine's Datadog metric output publishes (emitted_events_summaryVolume, tagged message_pattern, tenx_hash, k8s_container, tenx_user_service, routeState, and tenx_team once the team label ships). Lists the statements new in a service since since (a duration like 7d or a date; stateless, so pass the previous report's next_since to continue), each with lines a day, estimated Standard indexing cost a month at Datadog list price, whether a rule held it, and the rule that did (the container's row and action in caps.csv / actions.csv, read from the gitops repo or the policy ConfigMap). Ends with proposed per-service rows in the plan's form: ": any statement above N lines a day goes to Flex. Today that is these K statements, about $X a month." view: "monitors" instead renders two Datadog monitor definitions as JSON for the account owner to apply: a metric monitor that fires when a statement's route turns tier_down or offload, and an anomaly monitor with weekly seasonality that fires when a statement's volume rises above its weekly baseline. Read-only: Datadog's query API with DD_API_KEY / DD_APP_KEY / DD_SITE (GET only), and the engine files. Writes nothing.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| site | No | Datadog site (e.g. `us5.datadoghq.com`). Defaults to DD_SITE, then `datadoghq.com`. | |
| view | No | `markdown` (default): the weekly change report. `summary`: the same data without the rendered page. `monitors`: two Datadog monitor definitions as JSON (a statement turning tier_down or offload; a statement above its weekly baseline), for the account owner to apply. `monitors` reads nothing. | markdown |
| limit | No | Most new statements listed. Default 25. | |
| since | No | Start of the report: a duration back from now (`7d`, `36h`) or a date or ISO timestamp (`2026-10-06`). A statement is new when it had no line in its service in the `lookback` before this point. Pass the previous report's `next_since` to continue where it ended. Default `7d`. | 7d |
| action | No | Where a proposed row sends a statement: `tier_down` (Flex, the default) or `offload` (S3) for an account without Flex. | tier_down |
| notify | No | Notification handles for the monitors view (e.g. `@slack-log-cost`). | |
| headroom | No | Multiplier on the fleet's largest kept statement, for a service with no history of its own. Default 2. | |
| lookback | No | How far before `since` to look for earlier lines of a statement. Default `28d`, at most `90d`. | 28d |
| team_tag | No | Team tag key on the series (e.g. `tenx_team`). Omit to detect `tenx_team` on the series; the team is shown only when present. | |
| tenx_env | No | `tenx_env` tag value to scope the series to. Omit for every environment. | |
| environment | No | MCP environment nickname, used to find the gitops repo holding caps.csv and actions.csv. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |