ecip-observability-stack 1.0.0

package/dashboards/query-latency.json

@@ -0,0 +1,160 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": "-- Grafana --",
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "ECIP Query Service (M04) — p50/p95/p99 latency per mode (lsp/vector/hybrid)",
+  "editable": true,
+  "gnetId": null,
+  "graphTooltip": 1,
+  "id": null,
+  "links": [],
+  "panels": [
+    {
+      "title": "Query Latency Overview",
+      "type": "row",
+      "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 },
+      "collapsed": false
+    },
+    {
+      "title": "Query Duration p50 / p95 / p99",
+      "type": "timeseries",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "ms",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              { "color": "green", "value": null },
+              { "color": "yellow", "value": 1000 },
+              { "color": "red", "value": 1500 }
+            ]
+          }
+        }
+      },
+      "targets": [
+        {
+          "expr": "histogram_quantile(0.50, sum(rate(query_duration_ms_bucket{job=\"ecip-query-service\"}[5m])) by (le))",
+          "legendFormat": "p50"
+        },
+        {
+          "expr": "histogram_quantile(0.95, sum(rate(query_duration_ms_bucket{job=\"ecip-query-service\"}[5m])) by (le))",
+          "legendFormat": "p95"
+        },
+        {
+          "expr": "histogram_quantile(0.99, sum(rate(query_duration_ms_bucket{job=\"ecip-query-service\"}[5m])) by (le))",
+          "legendFormat": "p99"
+        }
+      ]
+    },
+    {
+      "title": "Query Duration by Mode",
+      "type": "timeseries",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 1 },
+      "fieldConfig": {
+        "defaults": { "unit": "ms" }
+      },
+      "targets": [
+        {
+          "expr": "histogram_quantile(0.95, sum(rate(query_duration_ms_bucket{job=\"ecip-query-service\"}[5m])) by (le, mode))",
+          "legendFormat": "p95 — {{mode}}"
+        }
+      ]
+    },
+    {
+      "title": "Query Rate (requests/sec)",
+      "type": "timeseries",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 9 },
+      "fieldConfig": {
+        "defaults": { "unit": "reqps" }
+      },
+      "targets": [
+        {
+          "expr": "sum(rate(query_duration_ms_count{job=\"ecip-query-service\"}[5m])) by (mode)",
+          "legendFormat": "{{mode}}"
+        }
+      ]
+    },
+    {
+      "title": "Query Error Rate",
+      "type": "timeseries",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 9 },
+      "fieldConfig": {
+        "defaults": { "unit": "percentunit" }
+      },
+      "targets": [
+        {
+          "expr": "sum(rate(query_duration_ms_count{job=\"ecip-query-service\",status_code=~\"5..\"}[5m])) / sum(rate(query_duration_ms_count{job=\"ecip-query-service\"}[5m]))",
+          "legendFormat": "Error Rate"
+        }
+      ]
+    },
+    {
+      "title": "Query Latency by Repo (p95)",
+      "type": "table",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 24, "x": 0, "y": 17 },
+      "targets": [
+        {
+          "expr": "histogram_quantile(0.95, sum(rate(query_duration_ms_bucket{job=\"ecip-query-service\"}[5m])) by (le, repo))",
+          "legendFormat": "{{repo}}",
+          "format": "table",
+          "instant": true
+        }
+      ]
+    },
+    {
+      "title": "Cached vs Uncached Query Latency (p95)",
+      "type": "timeseries",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 24, "x": 0, "y": 25 },
+      "fieldConfig": {
+        "defaults": { "unit": "ms" }
+      },
+      "targets": [
+        {
+          "expr": "histogram_quantile(0.95, sum(rate(query_duration_ms_bucket{job=\"ecip-query-service\",cached=\"true\"}[5m])) by (le))",
+          "legendFormat": "p95 — cached"
+        },
+        {
+          "expr": "histogram_quantile(0.95, sum(rate(query_duration_ms_bucket{job=\"ecip-query-service\",cached=\"false\"}[5m])) by (le))",
+          "legendFormat": "p95 — uncached"
+        }
+      ]
+    }
+  ],
+  "refresh": "30s",
+  "schemaVersion": 39,
+  "tags": ["ecip", "m04", "query-service", "latency"],
+  "templating": {
+    "list": [
+      {
+        "name": "repo",
+        "type": "query",
+        "datasource": "Prometheus",
+        "query": "label_values(query_duration_ms_bucket, repo)",
+        "refresh": 2,
+        "includeAll": true,
+        "multi": true
+      }
+    ]
+  },
+  "time": { "from": "now-1h", "to": "now" },
+  "title": "ECIP — Query Latency",
+  "uid": "ecip-query-latency",
+  "version": 1
+}

package/dashboards/security-events.json

@@ -0,0 +1,131 @@
+{
+  "description": "ECIP Security Events — Auth failures, RBAC denials (from Elasticsearch)",
+  "editable": true,
+  "panels": [
+    {
+      "title": "Security Events",
+      "type": "row",
+      "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 },
+      "collapsed": false
+    },
+    {
+      "title": "Auth Failures (last 24h)",
+      "type": "stat",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 8, "x": 0, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              { "color": "green", "value": null },
+              { "color": "yellow", "value": 50 },
+              { "color": "red", "value": 100 }
+            ]
+          }
+        }
+      },
+      "targets": [
+        {
+          "expr": "sum(increase(auth_failure_total[24h]))",
+          "legendFormat": "Total Auth Failures"
+        }
+      ]
+    },
+    {
+      "title": "RBAC Denials (last 24h)",
+      "type": "stat",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 8, "x": 8, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "short",
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              { "color": "green", "value": null },
+              { "color": "yellow", "value": 50 },
+              { "color": "red", "value": 100 }
+            ]
+          }
+        }
+      },
+      "targets": [
+        {
+          "expr": "sum(increase(rbac_denial_total[24h]))",
+          "legendFormat": "Total RBAC Denials"
+        }
+      ]
+    },
+    {
+      "title": "Security Alert Status",
+      "type": "stat",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 8, "x": 16, "y": 1 },
+      "fieldConfig": {
+        "defaults": {
+          "mappings": [
+            { "type": "value", "options": { "0": { "text": "OK", "color": "green" }, "1": { "text": "FIRING", "color": "red" } } }
+          ]
+        }
+      },
+      "targets": [
+        {
+          "expr": "ALERTS{alertname=~\"SecurityAuth.*|SecurityRBAC.*\"}",
+          "legendFormat": "{{alertname}}"
+        }
+      ]
+    },
+    {
+      "title": "Auth Failures Over Time",
+      "type": "timeseries",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 9 },
+      "fieldConfig": {
+        "defaults": { "unit": "short" }
+      },
+      "targets": [
+        {
+          "expr": "sum(rate(auth_failure_total[5m])) by (reason)",
+          "legendFormat": "{{reason}}"
+        }
+      ]
+    },
+    {
+      "title": "RBAC Denials Over Time",
+      "type": "timeseries",
+      "datasource": "Prometheus",
+      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 9 },
+      "fieldConfig": {
+        "defaults": { "unit": "short" }
+      },
+      "targets": [
+        {
+          "expr": "sum(rate(rbac_denial_total[5m])) by (resource, action)",
+          "legendFormat": "{{resource}}/{{action}}"
+        }
+      ]
+    },
+    {
+      "title": "Security Events Log (Elasticsearch)",
+      "type": "logs",
+      "datasource": "Elasticsearch",
+      "gridPos": { "h": 12, "w": 24, "x": 0, "y": 17 },
+      "targets": [
+        {
+          "query": "event.category:authentication OR event.category:authorization",
+          "metrics": [{ "type": "logs", "id": "1" }],
+          "timeField": "@timestamp"
+        }
+      ]
+    }
+  ],
+  "refresh": "1m",
+  "schemaVersion": 39,
+  "tags": ["ecip", "security", "auth", "rbac"],
+  "time": { "from": "now-24h", "to": "now" },
+  "title": "ECIP — Security Events",
+  "uid": "ecip-security-events",
+  "version": 1
+}