From 728e1beb6ace17d008bc87eb7687c377c427d34a Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive.local>
Date: Sun, 1 Nov 2026 12:49:42 +0100
Subject: [PATCH] egress board: the host tables merge their frames, so they are
 tables and not a series dropdown

A grouped stats query is one frame per group. Labels become columns,
then the frames merge into rows.
---
 .../swarm-grafana/dashboards/egress.json      | 42 +++++++++++++++++++
 nix/module-eval/grafana.nix                   | 10 +++++
 2 files changed, 52 insertions(+)

diff --git a/nix/host-modules/swarm-grafana/dashboards/egress.json b/nix/host-modules/swarm-grafana/dashboards/egress.json
index b4a95281..e21f9e46 100644
--- a/nix/host-modules/swarm-grafana/dashboards/egress.json
+++ b/nix/host-modules/swarm-grafana/dashboards/egress.json
@@ -797,6 +797,20 @@
                 }
               ],
               "transformations": [
+                {
+                  "kind": "labelsToFields",
+                  "spec": {
+                    "id": "labelsToFields",
+                    "options": {}
+                  }
+                },
+                {
+                  "kind": "merge",
+                  "spec": {
+                    "id": "merge",
+                    "options": {}
+                  }
+                },
                 {
                   "kind": "organize",
                   "spec": {
@@ -1023,6 +1037,20 @@
                 }
               ],
               "transformations": [
+                {
+                  "kind": "labelsToFields",
+                  "spec": {
+                    "id": "labelsToFields",
+                    "options": {}
+                  }
+                },
+                {
+                  "kind": "merge",
+                  "spec": {
+                    "id": "merge",
+                    "options": {}
+                  }
+                },
                 {
                   "kind": "organize",
                   "spec": {
@@ -1378,6 +1406,20 @@
                 }
               ],
               "transformations": [
+                {
+                  "kind": "labelsToFields",
+                  "spec": {
+                    "id": "labelsToFields",
+                    "options": {}
+                  }
+                },
+                {
+                  "kind": "merge",
+                  "spec": {
+                    "id": "merge",
+                    "options": {}
+                  }
+                },
                 {
                   "kind": "organize",
                   "spec": {
diff --git a/nix/module-eval/grafana.nix b/nix/module-eval/grafana.nix
index 7f766cf4..ada37531 100644
--- a/nix/module-eval/grafana.nix
+++ b/nix/module-eval/grafana.nix
@@ -496,6 +496,16 @@ let
         && lib.all (e: lib.hasInfix "\"TCP_\"*" e) (
           lib.filter (e: lib.hasInfix access e) (exprs ++ [ agentVar.spec.query.spec.query ])
         )
+        # A grouped stats query is one frame per group, which a table panel shows as
+        # a dropdown of series; labels to columns, then a merge, makes the rows.
+        && lib.all (
+          e:
+          map (t: t.spec.id) e.spec.data.spec.transformations == [
+            "labelsToFields"
+            "merge"
+            "organize"
+          ]
+        ) (lib.filter (e: e.spec.vizConfig.group == "table") (lib.attrValues board.spec.elements))
         && lib.hasInfix "logformat would_deny would_deny user=%[un method=%rm host=%>rd port=%>rP result=" squid
         && lib.hasInfix "access_log syslog:daemon.info squid !manager" squid;
     }