{
  "__inputs": [
    {
      "name": "DS_LOKI",
      "label": "Loki",
      "description": "Loki data source receiving MTE Relay v5 logs",
      "type": "datasource",
      "pluginId": "loki",
      "pluginName": "Loki"
    }
  ],
  "title": "MTE Relay v5 (Loki)",
  "uid": "mte-relay-v5-loki",
  "description": "MTE Relay v5 (MRS/MAR) log-based dashboard over the structured event schema. Adjust the $container stream selector to match your Loki labels. Docs: https://relay.eclypses.com (Monitoring & Integrations).",
  "schemaVersion": 39,
  "version": 1,
  "editable": true,
  "time": { "from": "now-1h", "to": "now" },
  "refresh": "30s",
  "tags": ["mte-relay", "eclypses"],
  "templating": {
    "list": [
      {
        "name": "datasource",
        "type": "datasource",
        "query": "loki",
        "label": "Loki data source",
        "current": {}
      },
      {
        "name": "container",
        "type": "textbox",
        "label": "Container label regex",
        "query": "mte-relay.*",
        "current": { "text": "mte-relay.*", "value": "mte-relay.*" }
      }
    ]
  },
  "panels": [
    {
      "id": 1,
      "title": "Relayed requests / sec",
      "type": "timeseries",
      "datasource": { "type": "loki", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 0 },
      "targets": [
        {
          "refId": "A",
          "expr": "sum(count_over_time({container=~\"$container\"} | json | performance_event_event_type=\"request_timing\" [$__auto]))",
          "legendFormat": "requests"
        }
      ],
      "fieldConfig": { "defaults": { "unit": "reqps" }, "overrides": [] }
    },
    {
      "id": 2,
      "title": "Request latency p95 (ms)",
      "type": "timeseries",
      "datasource": { "type": "loki", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 0 },
      "targets": [
        {
          "refId": "A",
          "expr": "quantile_over_time(0.95, {container=~\"$container\"} | json | performance_event_event_type=\"request_timing\" | unwrap performance_event_total_time_ms [$__auto]) by ()",
          "legendFormat": "p95"
        },
        {
          "refId": "B",
          "expr": "quantile_over_time(0.50, {container=~\"$container\"} | json | performance_event_event_type=\"request_timing\" | unwrap performance_event_total_time_ms [$__auto]) by ()",
          "legendFormat": "p50"
        }
      ],
      "fieldConfig": { "defaults": { "unit": "ms" }, "overrides": [] }
    },
    {
      "id": 3,
      "title": "Phase breakdown (avg ms)",
      "type": "timeseries",
      "datasource": { "type": "loki", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
      "targets": [
        {
          "refId": "A",
          "expr": "avg_over_time({container=~\"$container\"} | json | performance_event_event_type=\"phase_breakdown\" | unwrap performance_event_decryption_ms [$__auto]) by ()",
          "legendFormat": "MTE decrypt"
        },
        {
          "refId": "B",
          "expr": "avg_over_time({container=~\"$container\"} | json | performance_event_event_type=\"phase_breakdown\" | unwrap performance_event_validation_ms [$__auto]) by ()",
          "legendFormat": "validate"
        },
        {
          "refId": "C",
          "expr": "avg_over_time({container=~\"$container\"} | json | performance_event_event_type=\"phase_breakdown\" | unwrap performance_event_proxy_ms [$__auto]) by ()",
          "legendFormat": "upstream proxy"
        },
        {
          "refId": "D",
          "expr": "avg_over_time({container=~\"$container\"} | json | performance_event_event_type=\"phase_breakdown\" | unwrap performance_event_encryption_ms [$__auto]) by ()",
          "legendFormat": "MTE encrypt"
        }
      ],
      "fieldConfig": { "defaults": { "unit": "ms" }, "overrides": [] }
    },
    {
      "id": 4,
      "title": "Responses by status code",
      "type": "timeseries",
      "datasource": { "type": "loki", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
      "targets": [
        {
          "refId": "A",
          "expr": "sum by (performance_event_status_code) (count_over_time({container=~\"$container\"} | json | performance_event_event_type=\"request_timing\" [$__auto]))",
          "legendFormat": "{{performance_event_status_code}}"
        }
      ],
      "fieldConfig": { "defaults": {}, "overrides": [] }
    },
    {
      "id": 5,
      "title": "Security events by type",
      "type": "timeseries",
      "datasource": { "type": "loki", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 16 },
      "targets": [
        {
          "refId": "A",
          "expr": "sum by (security_event_event_type) (count_over_time({container=~\"$container\"} | json | security_event_event_type!=\"\" [$__auto]))",
          "legendFormat": "{{security_event_event_type}}"
        }
      ],
      "fieldConfig": { "defaults": {}, "overrides": [] }
    },
    {
      "id": 6,
      "title": "High / critical security events (log stream)",
      "type": "logs",
      "datasource": { "type": "loki", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 16 },
      "targets": [
        {
          "refId": "A",
          "expr": "{container=~\"$container\"} | json | security_event_severity=~\"high|critical\""
        }
      ],
      "options": { "showTime": true, "wrapLogMessage": true, "enableLogDetails": true }
    },
    {
      "id": 7,
      "title": "Error events / panics (log stream)",
      "type": "logs",
      "datasource": { "type": "loki", "uid": "${datasource}" },
      "gridPos": { "h": 8, "w": 24, "x": 0, "y": 24 },
      "targets": [
        {
          "refId": "A",
          "expr": "{container=~\"$container\"} | json | error_event_event_type!=\"\""
        }
      ],
      "options": { "showTime": true, "wrapLogMessage": true, "enableLogDetails": true }
    }
  ]
}