Architecture and Data Sources

Grafana owns no telemetry. Every panel on every dashboard is a live query sent to a backing store — Prometheus for metrics, Loki for logs, Tempo for traces — rendered in the browser and thrown away. Grafana's own database, SQLite by default, holds dashboards, users, and data source definitions; not one sample of Harborline's data lives inside it.

That makes Grafana the query-and-render layer of the stack, and the consequences cut both ways. Swap the storage underneath and the dashboards keep working; delete the Grafana container and no telemetry is lost. It also means every question about what a dashboard can show, and how fast, is really a question about the store behind it.

The Query-and-Render Layer

A dashboard refresh fans out one query per panel to its data source, written in that source's native language: PromQL to Prometheus, LogQL to Loki, TraceQL to Tempo. Grafana translates nothing and caches almost nothing, so a slow panel is a slow query, and the fix lives in the query, not in Grafana settings. The arithmetic matters: a 20-panel dashboard on a 30-second auto-refresh fires 40 queries per minute at Prometheus from a single open browser tab.

Grafana amplifies query load onto the store; it never absorbs it. When the checkout dashboard feels sluggish, Mara's first stop is the panel's query inspector, and her second is Prometheus itself — because that is where the work actually happens.

Panelone query each

→

Data sourcenamed connection

→

Query to storePromQL · LogQL · TraceQL

→

Renderbrowser · discarded

Data Sources

A data source is a named connection to one backend: a type, a URL, and credentials if the store wants them. Prometheus, Loki, and Tempo are the Harborline three, but the same panel model speaks to dozens of backends through core and plugin data sources — PostgreSQL, Elasticsearch, CloudWatch, MySQL, Jaeger, and the rest of the catalog.

One dashboard can mix sources panel by panel: a PromQL time series in the top row, a Loki log panel beside it, both on the same time axis. That is exactly how the checkout dashboard will end up — metrics saying something changed, logs two panels over saying what the service printed while it did.

Explore Mode

Explore is the scratchpad: pick a data source, iterate on a query, and see the result without building a panel around it. Split view puts two queries side by side on the same time range — a PromQL expression on the left, a Loki query on the right — which is the cheapest correlation tool in the stack. Queries get born in Explore and only then get pinned into dashboards; editing PromQL inside a half-built panel is the slow way to do both jobs.

Provisioning Data Sources from Files

Data sources clicked together in the UI live only in Grafana's database, which means a rebuilt container comes up empty. The alternative is file provisioning: one YAML file per source in /etc/grafana/provisioning/datasources/, read at startup, so the container image plus the files fully determine the running state. Here is Harborline's Prometheus entry.

# /etc/grafana/provisioning/datasources/harborline.yaml
apiVersion: 1
datasources:
  - name: Prometheus
    type: prometheus
    uid: prom
    url: http://prometheus:9090
    isDefault: true
    jsonData:
      timeInterval: 15s

Field by field: name is the label humans see in menus; type selects the plugin; uid is the identifier dashboards reference, and fixing it to prom means every dashboard JSON that points at it keeps working after any rebuild; url is where Grafana sends the queries; isDefault makes this the source every new panel and Explore session starts on; and timeInterval declares the real 15 s scrape interval so $__rate_interval — covered in the next topic — computes correct windows.

The Harborline Wiring

Grafana runs in the obs-01 Compose stack and reaches its sources by service name over the Compose network: http://prometheus:9090, http://loki:3100, http://tempo:3200. The browser talks only to Grafana on :3000; Grafana queries the stores server-side and ships rendered results back. With three provisioned sources and an empty dashboard list, Mara has the plumbing done — the next topic starts drawing on it.