How to Create Analysis Metric Dashboard
How to Create Analysis Metric Dashboard ¶
Summary ¶
- EMS store all the backend data in Postgres DB, so we can create analysis metric dashboard on Grafana and use the Postgres DB as datasource.
- Current we offer a Grafana site build by EMS team: metrics.ott.webex.com and datasource
dfw-keep-prod, Also the datasource is aviliable in LMA so we can create dashboard on metrics-o.webex.com.
Sample Dashboard: EMS Incoming Alerts Dashboards
Request for access (only needed for local Grafana metrics.ott.webex.com) ¶
- Contact Angela Shao(yeshao@cisco.com) or Jimmy Zhou(shengz@cisco.com) or mail to csg-hz-ems@cisco.com for get access.
Table Schema ¶
Since we use PG DB as datasource, here lists the main table schema for query when create the dashboard.
QA Sample DB ¶
postgresql://keepquery:{same_as_name}@10.250.242.84:5432/keep
This DB and account is for query only. We can use this DB to check how the data looks like.
Table: alert ¶
All the alert event records are stored in the this table.
| name | datatype | description |
|---|---|---|
| timestamp | timestamp | |
| event | json | all fields of this alert |
| id | uuid | |
| tenant_id | varchar | |
| provider_type | varchar | |
| provider_id | varchar | |
| fingerprint | varchar |
Table: alertaudit ¶
All the changes made to alerts are recorded in this table.
It will show in the alert detail page timeline section.
| name | datatype | description |
|---|---|---|
| id | uuid | |
| fingerprint | varchar | |
| tenant_id | varchar | |
| timestamp | timestamp | |
| user_id | varchar | |
| action | varchar | |
| description | text |
Table: alertenrichment ¶
All the enriched fields of alerts are stored in this table.
| name | datatype | description |
|---|---|---|
| enrichments | json | All enriched fields for one alert in this column as json |
| id | uuid | |
| tenant_id | varchar | |
| timestamp | timestamp | |
| alert_fingerprint | varchar |
Table: alertfield ¶
All the alert fields are stored in this table, it is used for column selection in page.
| name | datatype | description |
|---|---|---|
| id | uuid | |
| tenant_id | varchar | |
| field_name | varchar | |
| provider_id | varchar | |
| provider_type | varchar |
Table: alertraw ¶
Alert raw data is stored in this table.
| name | datatype | description |
|---|---|---|
| raw_alert | json | |
| id | uuid | |
| tenant_id | varchar | |
| timestamp | timestamp | |
| provider_type | varchar(255) | |
| error | bool | |
| error_message | varchar(2048) |
Table: extractionrule ¶
Extraction rules.
| name | datatype | description |
|---|---|---|
| updated_at | timestamptz | |
| id | serial4 | |
| tenant_id | varchar | |
| priority | int4 | |
| name | varchar(255) | |
| description | varchar(2048) | |
| created_by | varchar(255) | |
| created_at | timestamp | |
| updated_by | varchar(255) | |
| disabled | bool | |
| pre | bool | pre-formatting or not |
| condition | varchar(2000) | |
| attribute | varchar(255) | |
| regex | varchar(1024) |
Table: incident ¶
All the incident records are stored in this table.
| name | datatype | description |
|---|---|---|
| id | uuid | |
| tenant_id | varchar | |
| assignee | varchar | |
| creation_time | timestamp | |
| start_time | timestamp | |
| end_time | timestamp | |
| is_predicted | bool | |
| affected_services | json | |
| sources | json | |
| alerts_count | int4 | |
| user_summary | text | |
| generated_summary | text | |
| last_seen_time | timestamp | |
| rule_id | uuid | |
| rule_fingerprint | text | |
| severity | int4 | |
| user_generated_name | text | |
| ai_generated_name | text | |
| status | varchar | |
| same_incident_in_the_past_id | uuid | |
| merged_into_incident_id | uuid | |
| merged_at | timestamp | |
| merged_by | varchar | |
| fingerprint | text | |
| incident_type | varchar | |
| incident_application | uuid | |
| resolve_on | varchar | |
| forced_severity | bool | |
| running_number | int4 | |
| is_candidate | bool | |
| is_visible | bool |
Table: lastalert ¶
The mapping of alert_id and fingerprint of the lastest alert.
| name | datatype | description |
|---|---|---|
| tenant_id | varchar | |
| fingerprint | varchar | |
| alert_id | uuid | same as table alert.id |
| timestamp | timestamp | |
| first_timestamp | timestamp | |
| status | varchar | |
| severity | varchar | |
| service | varchar | |
| name | varchar | |
| description | varchar | |
| ticket_number | varchar | |
| provider_type | varchar | |
| pcc | varchar |
Table: lastalerttoincident ¶
The mapping of alert fingerprint and incident id of the incident.
| name | datatype | description |
|---|---|---|
| incident_id | uuid | |
| tenant_id | varchar | |
| timestamp | timestamp | |
| fingerprint | varchar | |
| is_created_by_ai | bool | |
| deleted_at | timestamp |
Table: mappingrule ¶
Mapping rules.
| name | datatype | description |
|---|---|---|
| matchers | json | |
| rows | json | |
| id | serial4 | |
| tenant_id | varchar | |
| priority | int4 | |
| name | varchar(255) | |
| description | varchar(2048) | |
| file_name | varchar(255) | |
| created_by | varchar(255) | |
| created_at | timestamp | |
| disabled | bool | |
| override | bool | |
| condition | varchar(2000) | |
| updated_by | varchar(255) | |
| last_updated_at | timestamp | |
| type | varchar | |
| is_multi_level | bool | |
| new_property_name | varchar(255) | |
| prefix_to_remove | varchar(255) |
Table: preset ¶
Preset list.
| name | datatype | description |
|---|---|---|
| options | json | |
| id | uuid | |
| tenant_id | varchar | |
| created_by | varchar | |
| is_private | bool | |
| is_noisy | bool | |
| name | varchar |
Table: provider ¶
Installed Provider list.
| name | datatype | description |
|---|---|---|
| validatedScopes | json | |
| id | varchar | |
| tenant_id | varchar | |
| name | varchar | |
| description | varchar | |
| type | varchar | |
| installed_by | varchar | |
| installation_time | timestamp | |
| configuration_key | varchar | |
| consumer | bool | |
| last_pull_time | timestamp | |
| provisioned | bool | |
| pulling_enabled | bool | |
| provider_metadata | json |
Table: workflow ¶
Workflow List.
| name | datatype | description |
|---|---|---|
| name | text | |
| created_by | text | |
| workflow_raw | text | |
| id | varchar | |
| tenant_id | varchar | |
| description | varchar | |
| updated_by | varchar | |
| creation_time | timestamp | |
| interval | int4 | |
| is_deleted | bool | |
| revision | int4 | |
| last_updated | timestamp | |
| is_disabled | bool | |
| provisioned | bool | |
| provisioned_file | varchar | |
| is_test | bool |
Table: workflowexecution ¶
Workflow execution records.
| name | datatype | description |
|---|---|---|
| triggered_by | text | |
| status | text | |
| results | json | |
| id | varchar | |
| workflow_id | varchar | |
| tenant_id | varchar | |
| started | timestamp | |
| is_running | int4 | |
| timeslot | int4 | |
| execution_number | int4 | |
| error | varchar | |
| execution_time | int4 | |
| workflow_revision | int4 | |
| is_test_run | bool |
Table: workflowtoalertexecution ¶
Alert triggered workflow execution records.
| name | datatype | description |
|---|---|---|
| id | serial4 | |
| workflow_execution_id | varchar | |
| alert_fingerprint | varchar | |
| event_id | varchar |
Table: workflowtoincidentexecution ¶
Incident triggered workflow execution records.
| name | datatype | description |
|---|---|---|
| id | serial4 | |
| workflow_execution_id | varchar | |
| incident_id | varchar |