> ## Documentation Index
> Fetch the complete documentation index at: https://opensre.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Grafana Log Sink

# Grafana Log Sink

This integration forwards OpenSRE investigation events into Grafana as:

* Loki log streams (push API)
* Grafana annotations (via /api/annotations)

## What it does

Investigation events are converted into a single low-cardinality Loki stream per
report and an optional Grafana annotation summarising the investigation.

## Configuration

Environment variables (used for Loki push, including Loki-only mode without a
Grafana integration):

* `GRAFANA_LOKI_PUSH_URL` — full Loki push endpoint (e.g. `https://<host>/loki/api/v1/push`)
* `GRAFANA_WRITE_TOKEN` — optional bearer token for pushing to Loki

When used via the integrations catalog the Grafana integration credentials
(`endpoint`, `api_key`, or `username`/`password`) are used to build a Grafana
client for annotation creation. Loki-only setups can set only the env vars above;
no Grafana integration record is required.

## Querying in Grafana Explore

Example LogQL queries for investigation logs:

* `{job="opensre", source="investigation"} | json | severity="critical"`
* `{job="opensre"} | json | alert_name=~".*payments.*"`

## Annotations

Annotations created by OpenSRE include the tags `opensre` and `investigation` plus
a severity tag (e.g. `critical`). Filter annotations in Grafana by tags to
discover OpenSRE investigations.

## Permissions

* Loki push endpoint must accept pushes from the service (push URL or write token)
* Creating annotations requires Grafana `Editor` role or higher