Datadog has a lot of products. Dashboards, Monitors, Logs Explorer, Notebooks, On-call, Service Map, Bits AI SRE Agent… the list goes on.
For many users, it’s hard to keep all of these straight in their heads.
This post introduces a mental model that makes it easier to navigate Datadog.
I call this idea Lenses.
What’s a Lens?
A Lens is not about a whole product, but about the part of its functionality that plays a certain role.
I define three Lenses that are sufficient to cover all of Datadog’s features:
- Presentation Lens → the part that presents data or evaluations back to users.
- Collection Lens → the part that gathers data — either from users’ systems (logs, traces, metrics...) or from users directly.
- Execution Lens → the part that takes action and has an effect on your systems.
For example:
- If we apply the Presentation Lens to Synthetics, we see the alerts it shows to users.
- If we apply the Collection Lens to Synthetics, we see how it proactively sends crafted requests to your systems and gathers responses to verify they behave as expected.
Another example is the tracing library:
- Through the Collection Lens, it gathers spans from your application and sends them to Datadog.
- Through the Execution Lens, features like In-App WAF come into view, because they actively change your application’s behavior by blocking traffic at runtime.
By switching Lenses, you don’t need to think of each product as a giant box with dozens of features. Instead, you can decide what to use based on what you want to accomplish. Lenses reveal what options you have to achieve your goal, rather than forcing you to start from product names.
The Presentation Lens
Let’s zoom in on one Lens: Presentation.
When this Lens is applied, many Datadog products expose functionality that gives something back to users. These may feel like very different products, but they all share this common role:
- Dashboards
- Logs Explorer
- Monitors
- Notebooks
- Service Map
- On-call
- Bits AI SRE Agent
- Product-specific pages (like Kubernetes Overview, Watchdog)
This exposed Presentation functionality can be grouped by two key properties.
Property 1: Delivery Mode (Push vs Pull)
Who initiates the transfer of information?
- Pull → You open a Dashboard or Logs Explorer to fetch the data yourself.
- Push → Datadog notifies you via Monitors when conditions are violated, or sends scheduled reports from Dashboards.
Property 2: Usage Mode (Predefined vs Exploratory)
How do you interact with the data?
- Predefined → Dashboards, Monitors, Watchdog, product overview pages. Once defined, they rarely change.
- Exploratory → Logs Explorer, Traces Explorer, Product Analytics. Users issue new queries almost every time.
Why This Model Helps
Instead of memorizing product names, you can ask yourself two simple questions:
- Do I want Datadog to push results to me, or do I want to pull the data myself?
- Do I need a predefined view, or do I want to run exploratory queries?
The answers point you to the right capability:
| Predefined | Exploratory | |
|---|---|---|
| Pull | Dashboards | Logs Explorer, Traces Explorer |
| Push | Monitors, Dashboard reports | (rare, but possible in custom setups) |
Examples:
- If you want to check a predefined set of business metrics whenever you have time → use a Dashboard.
- If you want Datadog to alert you in real time when an error pattern appears in logs → use a Log Monitor instead of relying on manual queries in Logs Explorer.
- If you want to dig into traces ad-hoc → use an Explorer.
This mental model reduces complexity and helps you reach for the right tool faster.
Closing Thoughts
This is an early attempt to reframe Datadog in a way that’s easier to understand.
I’d love to hear your feedback: does the Presentation Lens make Datadog clearer for you?
In future posts, I’ll explore the other Lenses — Collection (how data gets into Datadog) and Execution (how Datadog takes effect on your systems). Together, these three Lenses are enough to dissect the entire Datadog product family, and make it easier to understand which tool to use for which purpose.
Top comments (0)