惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

爱范儿
爱范儿
P
Palo Alto Networks Blog
月光博客
月光博客
H
Hackread – Cybersecurity News, Data Breaches, AI and More
I
InfoQ
aimingoo的专栏
aimingoo的专栏
腾讯CDC
T
Threatpost
D
DataBreaches.Net
Vercel News
Vercel News
F
Fortinet All Blogs
Engineering at Meta
Engineering at Meta
C
Cybersecurity and Infrastructure Security Agency CISA
Forbes - Security
Forbes - Security
U
Unit 42
C
Check Point Blog
Blog — PlanetScale
Blog — PlanetScale
O
OpenAI News
量子位
TaoSecurity Blog
TaoSecurity Blog
Microsoft Azure Blog
Microsoft Azure Blog
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
V
Visual Studio Blog
Recorded Future
Recorded Future
云风的 BLOG
云风的 BLOG
Security Archives - TechRepublic
Security Archives - TechRepublic
The Last Watchdog
The Last Watchdog
S
Security Affairs
Attack and Defense Labs
Attack and Defense Labs
罗磊的独立博客
Stack Overflow Blog
Stack Overflow Blog
Microsoft Security Blog
Microsoft Security Blog
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
V
V2EX
小众软件
小众软件
S
SegmentFault 最新的问题
www.infosecurity-magazine.com
www.infosecurity-magazine.com
W
WeLiveSecurity
AI
AI
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
博客园 - 聂微东
I
Intezer
Know Your Adversary
Know Your Adversary
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
P
Proofpoint News Feed
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
The Cloudflare Blog
博客园_首页
NISL@THU
NISL@THU
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO

Datadog | The Monitor blog

Introducing our open source AI-native SAST Instrument and monitor Boomi integration flows with OpenTelemetry and Datadog Not all index scans are equal: How we cut query latency by over 99% Platform engineering metrics: What to measure and what to ignore Integrate Recorded Future threat intelligence with Datadog Cloud SIEM CI/CD security: threat modeling using a MITRE-style threat matrix CI/CD security: How to secure your GitHub ecosystem Ingress NGINX is EOL: A practical guide for migrating to Kubernetes Gateway API Operating agentic AI with Amazon Bedrock AgentCore and Datadog LLM Observability: Lessons from NTT DATA Introducing the Datadog Code Security MCP Capture and analyze custom heatmaps in Session Replay Understand session replays faster with AI summaries and smart chapters Monitor ClickHouse query performance with Datadog Database Monitoring How we designed empathetic alert sounds for on-call engineers Search and act across Datadog to resolve issues faster with Bits Assistant Measure the business impact of every product change with Datadog Experiments Analyzing round trip query latency Configuring JavaScript caches for better performance Introducing Bits AI Dev Agent for Code Security Datadog achieves ISO 42001 certification for responsible AI Monitor Nutanix clusters, hosts, and VMs with Datadog Monitor Juniper Mist in Datadog A new Host Map for modern infrastructure Annotate traces to improve LLM quality with Datadog LLM Observability What’s new in Cloud SIEM: AI-powered investigations, enhanced threat intelligence, and scalable security operations Explore Kubernetes with native OpenTelemetry data Monitor Oracle Fusion Cloud Applications with Datadog Announcing the Datadog Terraform provider v4.0.0 Scaling Kubernetes workloads on custom metrics How to design cloud environments for AI-powered threat analysis Monitor Aruba Central in Datadog How we centralize and remediate risks with Datadog Case Management Accelerate incident response with Datadog and ServiceNow Monitor your application and network load balancer logs Understanding Karpenter architecture for Kubernetes autoscaling Tools for collecting metrics and logs from Karpenter Monitor Karpenter with Datadog What your product data is actually saying Key metrics for monitoring Karpenter Securing Datadog’s platform in the AI age: The role of observability data Four ways engineering teams use the Datadog MCP Server to power AI agents Approaching your observability migration with the right mindset Meet the new Bits AI SRE: Deeper reasoning, twice as fast Key learnings from the 2026 State of DevSecOps study Use plain English to query your multi-cloud infrastructure in Resource Catalog Simplifying troubleshooting across the user journey with Datadog Synthetic Monitoring Protect your OCI resources with Datadog Cloud Security This Month in Datadog - February 2026 Amazon EC2 security: How misconfigured and public AMIs expand your cloud attack surface Enable end-to-end visibility into your Java apps with a single command Measure and improve mobile app startup performance with Datadog RUM Evaluating our AI Guard application to improve quality and control cost Identify untested code across every level of your codebase Make use of guardrail metrics and stop babysitting your releases Monitor Versa Networks SD-WAN performance in Datadog Improve performance and reliability with APM Recommendations Remediate transitive vulnerabilities faster with Datadog Software Composition Analysis Generate audit-ready vulnerability and compliance reports with Datadog Sheets Monitor Fortinet FortiManager performance in Datadog Improve test coverage across codebases with Datadog Code Coverage Move fast, don’t break things: Consistent testing standards at scale Enrich logs with ServiceNow CMDB context before routing to any SIEM or logging tool Monitor Lustre with Datadog Make faster, better product decisions with Datadog Product Analytics Surface and remediate runtime posture issues with Workload Protection Findings Protect agentic AI applications with Datadog AI Guard How to optimize JavaScript code with CSS Trace Google Pub/Sub workloads in Cloud Run with Datadog Detect human names in logs with ML in Sensitive Data Scanner How we cut our NLQ agent debugging time from hours to minutes with LLM Observability Debug PostgreSQL query latency faster with EXPLAIN ANALYZE in Datadog Database Monitoring Datadog acquires Propolis Unify and correlate frontend and backend data with retention filters Scale compliance across global frameworks with Datadog Cloud Security Monitor Arista VeloCloud SD-WAN performance with Datadog Building reliable dashboard agents with Datadog LLM Observability Simplify log collection and aggregation for MSSPs with Datadog Observability Pipelines Mitigation for Node.js denial-of-service vulnerability affecting Datadog APM Automate flaky test fixes with the Bits AI Dev Agent and Test Optimization How we built an AI SRE agent that investigates like a team of engineers Datadog integrations 2025 recap: Observability for AI, security, and hybrid cloud Design effective executive dashboards with Datadog Implement dbt data quality checks with dbt-expectations Bring faster visibility into AWS Lambda functions with remote instrumentation Troubleshoot faster with the GitLab Source Code integration in Datadog How Cambia Health Solutions saved $30,000 monthly with Cloud Cost Management and the Datadog Resource Catalog Normalize any logs for Cloud SIEM with Datadog's OCSF processor Optimizing Datadog at scale: Cost-efficient observability at Zendesk Detect, diagnose, and resolve network issues easily with CNM Network Health Connect engineering errors to user impact in early-stage products Cilium configuration for Kubernetes operations at scale Designing feedback loops for progressive delivery Ship features faster and safer with Datadog Feature Flags Choosing the right OpenTelemetry Collector distribution Route your monitor alerts with Datadog monitor notification rules Automate Cloud SIEM investigations with Bits AI Security Analyst Cloud threat detection: How to identify risky activity across control and data planes Collecting Kafka performance metrics Monitoring Kafka with Datadog Monitoring Kafka performance metrics
Unlock advanced query functionality with distribution metrics
2025-01-10 · via Datadog | The Monitor blog
Kathy Lin

Kathy Lin

Colten Woo

Colten Woo

As organizations break down monolithic applications in favor of a more distributed, microservices-based architecture, they need to collect increasing amounts of metric data. But how do you summarize this data to provide insights at scale? Averages are simple to calculate but can be misleading, especially for increasingly complex and distributed environments that contain outlier values that skew the average.

Meanwhile, the task of computing precise and accurate percentiles across millions of metric values is substantial. Typically, calculating percentiles accurately requires you to retain all the values (you can’t reaggregate values without sacrificing accuracy), sort them, and return the value whose rank matches the percentile. This process leads to impractically high computational costs from storing and processing percentiles when millions of values need to be summarized.

You can use distribution metrics to help solve these challenges. With distribution metrics, you can measure globally accurate percentiles and enable enhanced query functionality for your distributed systems and applications.

In this post, we’ll explain how to use distribution metrics to:

Calculate globally accurate percentiles to obtain the right insights

A simple illustration of how averages can provide misleading information is a customer satisfaction survey. Suppose you sent a survey to 10 customers to understand the likelihood of customer churn. Based on your domain expertise, you know that customers tend to churn when they give a rating of 4 or below.

Let’s say that half of the customers gave the worst rating of 1 while the other half gave the best rating of 10. If you relied on the average customer rating of 5.5, you would not worry about churn. You would then be surprised when five customers churned. The average is not a useful measure in this case because it fails to represent the happy customers’ ratings and the unhappy customers’ ratings.

Now assume that you’re tracking search request duration for a service to ensure that your customers have a fast search experience in your application. Consider the results from the following Datadog widget.

Widget that shows an average request duration of 98 ms, a p95 average of 280 ms, and a p99 average of 1,405 ms.
Widget.
Widget that shows an average request duration of 98 ms, a p95 average of 280 ms, and a p99 average of 1,405 ms.

If you were to rely on the average, you might think that your customer’s search experience is much faster than it is. An average duration of 98 ms seems reasonable. However, many datasets can be skewed by extreme outliers. In this case, failed searches, ones that fail quickly because of user or validation errors, are skewing the average lower.

To avoid this misleading conclusion, you can use distribution metrics to understand the percentiles of your dataset. By looking at the 95th percentile and 99th percentile, you can see that while 95 percent of your users have an experience that is less than 300 ms, the search experience is magnitudes slower for the bottom 5 percent. This slowness for the bottom 5 percent can cause lower customer engagement with your application that worsens as your customer base and business grow over time.

Many vendors calculate percentiles at an individual host or agent level, but summarizing percentile values across all hosts produces misleading results because it involves reaggregating individual hosts’ percentiles. However, Datadog’s distribution metric type collects all your raw data by using the DDSketch data structure and aggregates a metric’s values across all hosts server-side. DDSketches are memory efficient and enable Datadog to efficiently compute any user-defined percentile or standard deviation (in addition to minimum, maximum, sum, average, and count values).

Visualize large-scale data distributions by using heatmaps

Distribution metrics capture high-resolution data that you can visualize by using Datadog heatmaps. With heatmaps, you can get a full picture of what’s going on in your environment and identify seasonal patterns over time. For example, consider the following heatmap of latency of a service. The heatmap shows a strong mode at 20 ms, with daily pulses at higher latencies.

Heatmap of a service’s latency

After investigating further, we can source the mode back to a specific health check. When we filter out that check, we can better understand seasonal patterns in latency for the service. If these latencies were instead plotted as aggregated percentile changes over time, these low-latency calls would distort the overall interpretation of latency.

Heatmap that shows seasonal patterns of a service’s latency after health check data is filtered.

Set SLOs with threshold queries

After you use heatmaps to explore how your metric’s values are distributed over time, you can use threshold queries to create SLOs. SLOs set targets for a service’s performance to improve platform stability and the consistency of user experiences.

For example, you might want to ensure freshness of customer data by tracking the amount of time it takes your platform to ingest data before the data reaches your storage systems. To build these SLOs, you can define threshold queries to ensure that you’re within your error budget for the month. Threshold queries, available only for the distribution metric type, allow you to count the number of raw distribution metric values that are above or below a numerical threshold.

SLO that measures the time it takes your platform to ingest data and send it to your storage layer.
SLO that provides percentages for performance status and remaining error budget, in addition to graphs for error budget burndown, burn rate, and good and bad events.
SLO that measures the time it takes your platform to ingest data and send it to your storage layer.

Metric-based SLOs are calculated by dividing the sum of good events by the sum of total events over time. In this example, a good event is defined as a call that has latency of less than 30 seconds. You can use threshold queries to calculate by specifying 30 as the threshold. When the SLO is set up, you can track and set alerts for error budget and burn rate, and use them as widgets in dashboards.

Create precise, granular monitors

To ensure that you’re in compliance with your SLOs, you need monitors to proactively alert you about issues that might arise. As your business and services scale, you need more granular percentiles to monitor the customer experience and related performance service level agreements (SLAs).

For example, suppose that you maintain a payment service that handles a large number of orders every month. The payment service’s queue latency directly impacts your monthly reported revenue. In this case, you need to receive alerts about any high and unacceptable queue latency (even at the 99.99th percentile) and resolve that issue quickly.

Threshold metric monitor that alerts on p99.99 queue latency.
Threshold metric monitor.
Threshold metric monitor that alerts on p99.99 queue latency.

By using a distribution metric, you can set a percentile threshold within metric monitors to alert you when the payment service’s p99.99 queue latency exceeds that threshold. You can also set up metric-based change, anomaly, outlier, and forecast monitors. Alerts about the payment service’s queue latency help you proactively identify what’s blocking the queue, if your job pods are healthy, and whether you need to scale up.

Identify statistically calculated outliers with standard deviations

Additionally, for any timeseries data (for example, CPU usage, server response time, request rate), you might want to monitor and troubleshoot outlier values that represent a degraded user experience. Instead of guessing the static threshold value that identifies those outliers, you can use the standard deviation aggregator to set precise, statistically calculated threshold values for your metric-based SLOs and metric monitors.

Standard deviation of a distribution metric, as shown on the Metrics Explorer page.
Line graph of a standard deviation over time.
Standard deviation of a distribution metric, as shown on the Metrics Explorer page.

When you monitor resource consumption (for example, network traffic, CPU usage, memory usage), you need to be able to balance consumption across resources and provision the resources accordingly. With the standard deviation, you can view the historical variation in your resources’ consumption, relative to the average consumption over time. This information is useful for load balancing. You can receive alerts when resources are above or below a standard deviation from the mean and then investigate whether you’re properly load balancing.

Start using distribution metrics today

Datadog distribution metrics summarize your data by providing globally accurate percentiles across distributed systems and applications to unlock advanced analysis and monitoring. With distribution metrics, you can use heatmaps to visualize large-scale data distributions, set appropriate SLOs, create precise monitors, and identify outliers. If you don’t already have a Datadog account, you can sign up for a 14-day free trial to get started.