{
  "title": "MTE Relay v5",
  "description": "MTE Relay v5 (MRS/MAR) — log-based dashboard over the structured event schema. Requires the MTE Relay log pipeline and facets/measures documented at https://relay.eclypses.com (Monitoring & Integrations → Datadog).",
  "layout_type": "ordered",
  "reflow_type": "auto",
  "template_variables": [
    {
      "name": "product",
      "prefix": "@product",
      "available_values": ["mrs", "mar"],
      "default": "*"
    },
    {
      "name": "instance",
      "prefix": "@instance",
      "available_values": [],
      "default": "*"
    }
  ],
  "widgets": [
    {
      "definition": {
        "type": "note",
        "content": "# MTE Relay v5 — Traffic & MTE Performance\n\nAll widgets query **logs** (`service:mte-relay`). Filter by product (MRS/MAR) or instance with the template variables above. Latency and phase timings come from `performance_event`, audit data from `encryption_event`, threats from `security_event`.",
        "background_color": "white",
        "font_size": "14",
        "text_align": "left",
        "has_padding": true
      }
    },
    {
      "definition": {
        "title": "Relayed requests",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:request_timing $product $instance"
                },
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "group_by": []
              }
            ],
            "formulas": [{ "formula": "query1", "alias": "requests" }],
            "display_type": "bars"
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Request latency (ms) — p50 / p95 / p99",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "p50",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:request_timing $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "pc50",
                  "metric": "@performance_event.total_time_ms"
                },
                "group_by": []
              },
              {
                "data_source": "logs",
                "name": "p95",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:request_timing $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "pc95",
                  "metric": "@performance_event.total_time_ms"
                },
                "group_by": []
              },
              {
                "data_source": "logs",
                "name": "p99",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:request_timing $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "pc99",
                  "metric": "@performance_event.total_time_ms"
                },
                "group_by": []
              }
            ],
            "formulas": [
              { "formula": "p50", "alias": "p50" },
              { "formula": "p95", "alias": "p95" },
              { "formula": "p99", "alias": "p99" }
            ],
            "display_type": "line"
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Phase breakdown (avg ms): decrypt / validate / proxy / encrypt",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "decrypt",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:phase_breakdown $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "avg",
                  "metric": "@performance_event.decryption_ms"
                },
                "group_by": []
              },
              {
                "data_source": "logs",
                "name": "validate",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:phase_breakdown $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "avg",
                  "metric": "@performance_event.validation_ms"
                },
                "group_by": []
              },
              {
                "data_source": "logs",
                "name": "proxy",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:phase_breakdown $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "avg",
                  "metric": "@performance_event.proxy_ms"
                },
                "group_by": []
              },
              {
                "data_source": "logs",
                "name": "encrypt",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:phase_breakdown $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "avg",
                  "metric": "@performance_event.encryption_ms"
                },
                "group_by": []
              }
            ],
            "formulas": [
              { "formula": "decrypt", "alias": "MTE decrypt" },
              { "formula": "validate", "alias": "validate" },
              { "formula": "proxy", "alias": "upstream proxy" },
              { "formula": "encrypt", "alias": "MTE encrypt" }
            ],
            "display_type": "area"
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Responses by status code",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:request_timing $product $instance"
                },
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "group_by": [
                  {
                    "facet": "@performance_event.status_code",
                    "limit": 10,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ],
            "formulas": [{ "formula": "query1" }],
            "display_type": "bars"
          }
        ]
      }
    },
    {
      "definition": {
        "title": "MTE encode/decode time (avg ms, audit events)",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "dec",
                "search": {
                  "query": "service:mte-relay @encryption_event.event_type:decryption $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "avg",
                  "metric": "@encryption_event.decryption_time_ms"
                },
                "group_by": []
              },
              {
                "data_source": "logs",
                "name": "enc",
                "search": {
                  "query": "service:mte-relay @encryption_event.event_type:encryption $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "avg",
                  "metric": "@encryption_event.encryption_time_ms"
                },
                "group_by": []
              }
            ],
            "formulas": [
              { "formula": "dec", "alias": "decrypt (inbound request)" },
              { "formula": "enc", "alias": "encrypt (outbound response)" }
            ],
            "display_type": "line"
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Encrypted data volume (bytes)",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "encb",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:phase_breakdown $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "sum",
                  "metric": "@performance_event.encrypted_data_bytes"
                },
                "group_by": []
              },
              {
                "data_source": "logs",
                "name": "decb",
                "search": {
                  "query": "service:mte-relay @performance_event.event_type:phase_breakdown $product $instance"
                },
                "indexes": ["*"],
                "compute": {
                  "aggregation": "sum",
                  "metric": "@performance_event.decrypted_data_bytes"
                },
                "group_by": []
              }
            ],
            "formulas": [
              { "formula": "encb", "alias": "encrypted bytes" },
              { "formula": "decb", "alias": "plaintext bytes" }
            ],
            "display_type": "area"
          }
        ]
      }
    },
    {
      "definition": {
        "type": "note",
        "content": "# Security & Errors\n\n`security_event` types: `auth_invalid_token`, `keepalive_invalid_client_id`, `pair_invalid_client_id`, `invalid_client_id`, `client_pairs_exhausted`, `pair_not_found`, `state_restore_failed`, `state_not_found`, `state_save_failed`. High/critical severities log at `error` status. `error_event.event_type:panic` indicates a recovered handler panic.",
        "background_color": "white",
        "font_size": "14",
        "text_align": "left",
        "has_padding": true
      }
    },
    {
      "definition": {
        "title": "High / critical security events",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "search": {
                  "query": "service:mte-relay @security_event.severity:(high OR critical) $product $instance"
                },
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "group_by": [
                  {
                    "facet": "@security_event.event_type",
                    "limit": 10,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ],
            "formulas": [{ "formula": "query1" }],
            "display_type": "bars"
          }
        ],
        "custom_links": []
      }
    },
    {
      "definition": {
        "title": "Security events by type",
        "type": "toplist",
        "requests": [
          {
            "response_format": "scalar",
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "search": {
                  "query": "service:mte-relay @security_event.event_type:* $product $instance"
                },
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "group_by": [
                  {
                    "facet": "@security_event.event_type",
                    "limit": 10,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ],
            "formulas": [
              { "formula": "query1", "limit": { "count": 10, "order": "desc" } }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Security event origins (top 10)",
        "type": "toplist",
        "requests": [
          {
            "response_format": "scalar",
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "search": {
                  "query": "service:mte-relay @security_event.event_type:* $product $instance"
                },
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "group_by": [
                  {
                    "facet": "@security_event.origin",
                    "limit": 10,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ],
            "formulas": [
              { "formula": "query1", "limit": { "count": 10, "order": "desc" } }
            ]
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Error events (incl. panics)",
        "type": "timeseries",
        "requests": [
          {
            "response_format": "timeseries",
            "queries": [
              {
                "data_source": "logs",
                "name": "query1",
                "search": {
                  "query": "service:mte-relay @error_event.event_type:* $product $instance"
                },
                "indexes": ["*"],
                "compute": { "aggregation": "count" },
                "group_by": [
                  {
                    "facet": "@error_event.event_type",
                    "limit": 10,
                    "sort": { "aggregation": "count", "order": "desc" }
                  }
                ]
              }
            ],
            "formulas": [{ "formula": "query1" }],
            "display_type": "bars"
          }
        ]
      }
    }
  ]
}