Migrating Datadog Alerts
KubeSense can recreate your existing Datadog monitors as native KubeSense alert rules using the AI alert assistant (the KubeSense alert skill) together with the MCP Server. The assistant reads a Datadog monitor, discovers the matching metric and field names from your live telemetry, maps the monitor to the equivalent KubeSense alert, and produces an importable JSON configuration that you review before anything is created.
Overview
Migration is a guided, three-step flow:
- Export one or more monitors from Datadog.
- Generate the equivalent KubeSense alert(s) by asking the AI assistant — it uses the MCP server to validate metric/field names against your real data, so the resulting rule actually evaluates.
- Import and review the generated JSON in the Alerts UI. Nothing is created until you confirm.
Because the assistant discovers names from your live data (Datadog and KubeSense rarely name metrics and fields identically) and you review every rule before saving, the result is a working KubeSense alert rather than a literal, possibly-broken copy.
Prerequisites
| Requirement | Notes |
|---|---|
| MCP server connected | Connect your AI client to the KubeSense MCP Server with an API key, so the assistant can discover metrics and fields. |
| KubeSense alert skill | Install it in your AI client (Claude Code, Codex, Cursor): npx skills add kubesense-ai/kubesense-mcp-skills --skill kubesense-alerts. |
| Datadog monitor definitions | The monitor JSON from the Datadog UI, the API (GET /api/v1/monitor), or a Terraform datadog_monitor export. |
Step 1 — Export your Datadog monitors
Get the monitor definitions out of Datadog in any form the assistant can read:
- A single monitor's query and options copied from the Datadog UI.
- The Datadog API:
GET /api/v1/monitor(all monitors) orGET /api/v1/monitor/{id}. - A Terraform export of your
datadog_monitorresources.
Step 2 — Generate the KubeSense alert
Ask the assistant to convert the monitor, for example:
Convert this Datadog monitor to a KubeSense alert:
avg(last_5m):p95:trace.http.request{service:checkout} > 0.5
The assistant will:
- Discover the real names — it queries your telemetry through the MCP server to find the KubeSense metric, log/trace fields, and group-by labels that correspond to the Datadog query.
- Map the condition — threshold and operator, evaluation window, no-data behavior, and severity.
- Emit importable JSON — a single rule object for one monitor, or a single JSON array when you convert several at once.
Step 3 — Import and review
In KubeSense, open Alerts → Alert Rules (or Alert Events) and click Import JSON. Paste the generated JSON, or upload a .json file.
- A single rule opens in the editor with the live condition chart, so you can confirm the rule fires as intended before clicking Create.
- An array of rules is validated in bulk and shown as a per-rule summary — each rule is marked valid or flagged with the reason it needs attention. You then create the valid rules in one action. Invalid rules are reported, never silently skipped.
Nothing is written to your account until you confirm.
What converts
| Datadog monitor type | KubeSense equivalent |
|---|---|
metric alert, query alert | Metrics rule (PromQL) |
log alert | Logs rule (count / aggregation with filters and group-by) |
APM error counts (e.g. trace…hits.by_http_status{…4xx/5xx}) | Traces rule — a count, often a formula summing 4xx and 5xx |
APM latency (p90/p95/p99 of request duration) | Traces rule — a latency percentile over duration |
slo alert (error-budget burn) | An error-rate (formula) alert, or a KubeSense Service Level — requires the SLO's underlying good/bad queries, not just the monitor |
anomaly, forecast, outlier | No direct equivalent — approximated with a static threshold or a change condition, and flagged for your review |
Conversion notes
- Trace latency is in nanoseconds. Datadog reports request latency in seconds or milliseconds; KubeSense trace
durationis nanoseconds. The assistant converts the threshold automatically (for example,500msbecomes500000000). Confirm the value on the condition chart after import. - Warning and critical thresholds. A KubeSense alert rule has a single threshold. A Datadog monitor with both a warning and a critical threshold is converted into two rules.
- Notification channels. Datadog
@-handles (Slack, PagerDuty, webhooks) map to KubeSense notification channels by name. Create the matching channels first, or leave them unset during import and add them while reviewing. - Field and metric names are discovered, not copied. Because naming differs between platforms, the assistant resolves each name against your live data instead of reusing the Datadog string verbatim.
Bulk migration
To migrate many monitors at once, ask the assistant to output a single JSON array of rules, then use the bulk import flow: paste the array into Import JSON, review the per-rule summary, and create the valid rules together. Up to 500 rules can be imported per request.
Always review before creating
Whether you import one rule or hundreds, review on the import screen first. The editor's condition chart replays the rule against your live data, and the bulk summary lists each rule's validation result — so you create only the alerts you have confirmed.