Grafana Integration

MTE Relay v5 emits structured JSON logs (see the Event Schema Reference). Two prebuilt Grafana dashboards are provided, one per common log backend.

v4 dashboards

The dashboards under /grafana/aws chart log fields that v5 does not emit. The /grafana/azure dashboard shows only Kubernetes resource metrics and a raw log tail. Use the v5 dashboards below for relay events.

Artifacts

File	Backend
mte-relay-v5-cloudwatch-dashboard.json	CloudWatch Logs Insights (AWS deployments)
mte-relay-v5-loki-dashboard.json	Grafana Loki (Kubernetes/on-prem deployments)

Both include: requests/sec, latency percentiles, the decrypt/validate/proxy/encrypt phase breakdown, status codes, security events by type, high/critical security event feeds, and error/panic feeds. The CloudWatch dashboard's MTE encode/decode time panel charts encryption_event timing fields that the relay does not emit, so it stays empty; the phase breakdown panel shows the same timings.

CloudWatch (AWS)

1. Ship relay container logs to CloudWatch (ECS awslogs driver or FireLens → CloudWatch).
2. In Grafana (e.g. Amazon Managed Grafana), add a CloudWatch data source with Logs Insights permissions (AWS instructions).
3. Dashboards → New → Import, upload mte-relay-v5-cloudwatch-dashboard.json.
4. Set the region and loggroup variables (defaults: us-east-1, /ecs/mte-relay).

Loki (Kubernetes / on-prem)

1. Ship container logs to Loki with Promtail, Grafana Alloy, or Fluent Bit.
2. Add the Loki data source in Grafana.
3. Dashboards → New → Import, upload mte-relay-v5-loki-dashboard.json.
4. Set the container variable to the label value your collector assigns the relay container (default regex mte-relay.*). If your setup labels streams differently (e.g. app or job instead of container), edit the stream selector in the panel queries once. Everything else is derived via | json.

Alerting

Grafana-managed alert rules can be built directly on the dashboard queries. Recommended starters (mirroring the Datadog/New Relic alert sets):

• Any security_event.severity in high|critical, 5 min window
• Any error_event.event_type = panic, 5 min window
• pair_not_found / state_restore_failed count > 5, 10 min window
• Avg performance_event.total_time_ms > 500, 10 min window (tune)
• client_pairs_exhausted count > 50, 15 min window (tune)

Cost control

Per request performance events dominate log volume, and the relay emits them for every request. Filter or sample request_timing events in your log pipeline if you need to, and keep security, error, and audit events.