diff --git a/docs/4-implementation/swarm/telemetry.md b/docs/4-implementation/swarm/telemetry.md index de6d3acba..2024624be 100644 --- a/docs/4-implementation/swarm/telemetry.md +++ b/docs/4-implementation/swarm/telemetry.md @@ -57,7 +57,7 @@ kept. - `attic`: the swarm binary cache. Agents whose latest closure this hive can pull, and why not; the builder's pushes and push failures; closures hive-c0re pulled and deploy steps it refused; the cache's size and store-path count. It reads the closure-pullable gauge, the `swarm-builder` and `hive-c0re` logs, and the `hyperhive.attic.cache_bytes` and `hyperhive.attic.cache_nars` gauges, which a timer in the `swarm-attic` container (`swarm-attic-cache-size`) reads from atticd's database every five minutes and pushes through the container's forwarder. atticd itself exports no metrics and its logs don't reach the log store, so the board has no cache request or hit panel. Filter by hive and agent. - `authelia`, `bao`, `queue`: the identity provider, the secret store and the NATS queue. - `claude-usage`: Claude use by model, effort, token type and source. Filter by hive, service (agents or the review classifier) and agent. The service filter separates the classifier's API-key spend from the agents. -- `egress`: what agents send through the egress proxy, in three tabs. **overview** has the totals (requests, agents active, refused, credential challenges, data transferred), requests over time by status, the busiest agents and destinations, and data transferred by domain over time (the top 10 domains plus an other line, summed from the proxy's access log in VictoriaLogs; the proxy logs a CONNECT tunnel when it closes, so a long-lived connection shows as one spike at close). **refused** lists the hosts the proxy refused for each agent. **would-deny** lists what agents in `log` mode reached that restricted mode would refuse. The host lists are tables, one row per host (and agent), with a count column you can sort. Filter by agent. +- `egress`: what agents send through the egress proxy, in three tabs. **overview** has the totals (requests, agents active, refused, credential challenges, data transferred), requests over time by status, the busiest agents and destinations, and data transferred by domain over time (the top 10 domains plus an other line, summed from the proxy's access log in VictoriaLogs; the proxy logs a CONNECT tunnel when it closes, so a long-lived connection shows as one spike at close). **refused** lists the hosts the proxy refused for each agent. **would-deny** lists what agents in `log` mode reached that restricted mode would refuse. The host lists are tables, one row per host (and agent), with a count column you can sort. Filter by agent and by domain, to see which agents queried a domain and when. - `builds`: the container builds hive-c0re ran on every hive, in two tabs. **builds** has the count, the failures and the longest, builds over time by outcome, and a table of each build with its id, agent, kind, outcome and runtime. **output** shows every line of the build picked in the **Build** filter, with its start and finish lines. It reads the lines hive-c0re logs for each build, so a hive-c0re that doesn't log them leaves it empty. Filter by agent. - `controller`: the swarm controller's job graph by state, and the push and commit rates it sees on the forge. - `review-classifier`: review requests by outcome, the verdict mix, results per check, retried asks, and run duration p50 and p95. diff --git a/nix/host-modules/swarm-grafana/dashboards/egress.json b/nix/host-modules/swarm-grafana/dashboards/egress.json index 5f073670d..e16e5bd06 100644 --- a/nix/host-modules/swarm-grafana/dashboards/egress.json +++ b/nix/host-modules/swarm-grafana/dashboards/egress.json @@ -6,7 +6,7 @@ }, "spec": { "title": "hyperhive ยท egress", - "description": "What agents send through the egress proxy: totals, refused requests, and what log mode would deny.", + "description": "What agents send through the egress proxy: totals, refused, would-deny. Filter by agent and domain.", "editable": true, "cursorSync": "Off", "liveNow": false, @@ -72,6 +72,41 @@ "includeAll": true, "allowCustomValue": true } + }, + { + "kind": "QueryVariable", + "spec": { + "name": "domain", + "current": { + "text": "All", + "value": "$__all" + }, + "label": "Domain", + "hide": "dontHide", + "refresh": "onTimeRangeChanged", + "skipUrlSync": false, + "query": { + "kind": "DataQuery", + "group": "victoriametrics-logs-datasource", + "version": "v0", + "datasource": { + "name": "@logsDatasourceUid@" + }, + "spec": { + "refId": "domain", + "type": "fieldValue", + "field": "dest", + "query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url", + "limit": 1000 + } + }, + "regex": "", + "sort": "alphabeticalAsc", + "options": [], + "multi": true, + "includeAll": true, + "allowCustomValue": true + } } ], "timeSettings": { @@ -117,7 +152,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats count() as requests", "queryType": "stats" } }, @@ -191,7 +226,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats count_uniq(agent) as agents", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats count_uniq(agent) as agents", "queryType": "stats" } }, @@ -265,7 +300,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count() as refused", "queryType": "stats" } }, @@ -339,7 +374,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:407 | stats count() as challenges", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:407 | stats count() as challenges", "queryType": "stats" } }, @@ -413,7 +448,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats sum(bytes) as bytes", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats sum(bytes) as bytes", "queryType": "stats" } }, @@ -487,7 +522,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | stats count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | filter dest:$domain | stats count() as requests", "queryType": "stats" } }, @@ -561,7 +596,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (status) count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (status) count() as requests", "queryType": "statsRange", "legendFormat": "{{status}}" } @@ -635,7 +670,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (agent) count() as requests | sort by (requests) desc | limit 15", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (agent) count() as requests | sort by (requests) desc | limit 15", "queryType": "stats", "legendFormat": "{{agent}}" } @@ -711,7 +746,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15", "queryType": "stats", "legendFormat": "{{agent}}" } @@ -787,7 +822,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25", "queryType": "stats" } }, @@ -875,7 +910,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count() as refused", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count() as refused", "queryType": "stats" } }, @@ -949,7 +984,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats count_uniq(agent) as agents", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count_uniq(agent) as agents", "queryType": "stats" } }, @@ -1023,7 +1058,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc", "queryType": "stats" } }, @@ -1110,7 +1145,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403 | stats by (agent) count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats by (agent) count() as requests", "queryType": "statsRange", "legendFormat": "{{agent}}" } @@ -1184,7 +1219,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter status:403", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403", "queryType": "instant" } }, @@ -1240,7 +1275,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | stats count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | filter dest:$domain | stats count() as requests", "queryType": "stats" } }, @@ -1314,7 +1349,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | stats count_uniq(agent) as agents", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | filter dest:$domain | stats count_uniq(agent) as agents", "queryType": "stats" } }, @@ -1388,7 +1423,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | stats by (agent, dest, port) count() as requests | sort by (requests) desc", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | filter dest:$domain | stats by (agent, dest, port) count() as requests | sort by (requests) desc", "queryType": "stats" } }, @@ -1476,7 +1511,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | stats by (agent) count() as requests", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | filter dest:$domain | stats by (agent) count() as requests", "queryType": "statsRange", "legendFormat": "{{agent}}" } @@ -1550,7 +1585,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user= method= host= port= result=\" | filter agent:$agent | filter dest:$domain", "queryType": "instant" } }, @@ -1606,7 +1641,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats by (dest) sum(bytes) as bytes", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter dest:in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats by (dest) sum(bytes) as bytes", "queryType": "statsRange", "legendFormat": "{{dest}}" } @@ -1626,7 +1661,7 @@ "name": "@logsDatasourceUid@" }, "spec": { - "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:!in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats sum(bytes) as bytes", + "expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter dest:!in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?PTCP_[A-Z_]+)/(?P[0-9]{3}) (?P[0-9]+) (?P[A-Z]+) (?P\\\\S+) (?P\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats sum(bytes) as bytes", "queryType": "statsRange", "legendFormat": "other" }