{
  "__inputs": [
    {
      "name": "DS_CLOUDWATCH",
      "label": "CloudWatch",
      "description": "CloudWatch data source with Logs Insights access to the MTE Relay log group",
      "type": "datasource",
      "pluginId": "cloudwatch",
      "pluginName": "CloudWatch"
    }
  ],
  "title": "MTE Relay v5 (CloudWatch Logs)",
  "uid": "mte-relay-v5-cloudwatch",
  "description": "MTE Relay v5 (MRS/MAR) dashboard over CloudWatch Logs Insights queries against the structured event schema. Set the $loggroup variable to the relay's log group. Docs: https://relay.eclypses.com (Monitoring & Integrations).",
  "schemaVersion": 39,
  "version": 1,
  "editable": true,
  "time": { "from": "now-1h", "to": "now" },
  "refresh": "1m",
  "tags": ["mte-relay", "eclypses"],
  "templating": {
    "list": [
      {
        "name": "datasource",
        "type": "datasource",
        "query": "cloudwatch",
        "label": "CloudWatch data source",
        "current": {}
      },
      {
        "name": "region",
        "type": "textbox",
        "label": "AWS region",
        "query": "us-east-1",
        "current": { "text": "us-east-1", "value": "us-east-1" }
      },
      {
        "name": "loggroup",
        "type": "textbox",
        "label": "Relay log group",
        "query": "/ecs/mte-relay",
        "current": { "text": "/ecs/mte-relay", "value": "/ecs/mte-relay" }
      }
    ]
  },
  "panels": [
    {
      "id": 1,
      "title": "Relayed requests / sec",
      "type": "timeseries",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter performance_event.event_type = \"request_timing\" | stats count(*) as requests by bin(1s)"
        }
      ]
    },
    {
      "id": 2,
      "title": "Request latency (ms): avg / p95 / p99",
      "type": "timeseries",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter performance_event.event_type = \"request_timing\" | stats avg(performance_event.total_time_ms) as avg_ms, pct(performance_event.total_time_ms, 95) as p95_ms, pct(performance_event.total_time_ms, 99) as p99_ms by bin(30s)"
        }
      ],
      "fieldConfig": { "defaults": { "unit": "ms" }, "overrides": [] }
    },
    {
      "id": 3,
      "title": "Phase breakdown (avg ms)",
      "type": "timeseries",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter performance_event.event_type = \"phase_breakdown\" | stats avg(performance_event.decryption_ms) as mte_decrypt_ms, avg(performance_event.validation_ms) as validate_ms, avg(performance_event.proxy_ms) as upstream_proxy_ms, avg(performance_event.encryption_ms) as mte_encrypt_ms by bin(30s)"
        }
      ],
      "fieldConfig": { "defaults": { "unit": "ms" }, "overrides": [] }
    },
    {
      "id": 4,
      "title": "Responses by status code",
      "type": "timeseries",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter performance_event.event_type = \"request_timing\" | stats count(*) by performance_event.status_code, bin(1m)"
        }
      ]
    },
    {
      "id": 5,
      "title": "Security events by type",
      "type": "timeseries",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 16 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter ispresent(security_event.event_type) | stats count(*) by security_event.event_type, bin(1m)"
        }
      ]
    },
    {
      "id": 6,
      "title": "Recent high / critical security events",
      "type": "table",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 16 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter security_event.severity in [\"high\", \"critical\"] | fields @timestamp, security_event.event_type, security_event.origin, security_event.reason, correlation_id | sort @timestamp desc | limit 50"
        }
      ]
    },
    {
      "id": 7,
      "title": "MTE encode/decode time (avg ms, audit events)",
      "type": "timeseries",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 24 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter ispresent(encryption_event.event_type) | stats avg(encryption_event.decryption_time_ms) as decrypt_ms, avg(encryption_event.encryption_time_ms) as encrypt_ms by bin(30s)"
        }
      ],
      "fieldConfig": { "defaults": { "unit": "ms" }, "overrides": [] }
    },
    {
      "id": 8,
      "title": "Error events / panics",
      "type": "table",
      "datasource": { "type": "cloudwatch", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 24 },
      "targets": [
        {
          "refId": "A",
          "queryMode": "Logs",
          "region": "$region",
          "logGroups": [{ "name": "$loggroup" }],
          "expression": "filter ispresent(error_event.event_type) | fields @timestamp, error_event.event_type, error_event.message, error_event.reason, correlation_id | sort @timestamp desc | limit 50"
        }
      ]
    }
  ]
}