Skip to main content

​
Grafana Log Sink

This integration forwards OpenSRE investigation events into Grafana as:
  • Loki log streams (push API)
  • Grafana annotations (via /api/annotations)

​
What it does

Investigation events are converted into a single low-cardinality Loki stream per report and an optional Grafana annotation summarising the investigation.

​
Configuration

Environment variables (used for Loki push, including Loki-only mode without a Grafana integration):
  • GRAFANA_LOKI_PUSH_URL — full Loki push endpoint (e.g. https://<host>/loki/api/v1/push)
  • GRAFANA_WRITE_TOKEN — optional bearer token for pushing to Loki
When used via the integrations catalog the Grafana integration credentials (endpoint, api_key, or username/password) are used to build a Grafana client for annotation creation. Loki-only setups can set only the env vars above; no Grafana integration record is required.

​
Querying in Grafana Explore

Example LogQL queries for investigation logs:
  • {job="opensre", source="investigation"} | json | severity="critical"
  • {job="opensre"} | json | alert_name=~".*payments.*"

​
Annotations

Annotations created by OpenSRE include the tags opensre and investigation plus a severity tag (e.g. critical). Filter annotations in Grafana by tags to discover OpenSRE investigations.

​
Permissions

  • Loki push endpoint must accept pushes from the service (push URL or write token)
  • Creating annotations requires Grafana Editor role or higher