Docs / Observability and data
Grafana
Connect your own Grafana instance to browse dashboards and alerts, explore Loki logs and Tempo traces.
Pangea connects to your Grafana instance with a service account token. Every request goes through Pangea's backend proxy, so the agent reads your dashboards, alert rules, datasources, logs and traces without ever holding the token.
Connect
1. Create a service account token
In Grafana, open Administration → Service accounts. Create a service account and add a token to it. Copy the token now, because Grafana shows it only once. Recent Grafana versions prefix it with glsa_.
Give the service account the smallest role that covers what you want the agent to do. A Viewer role is enough to read.
2. Bind it in Pangea
As a team Administrator, open Connectors → Connect → Grafana and fill in:
| Field | Notes |
|---|---|
| Name | A short label, for example prod or staging |
| Grafana URL | The base URL, for example https://grafana.example.com, with no trailing path |
| Service account token | The token you created |
Click Bind.
Your Grafana instance must be reachable from Pangea over the internet. Pangea refuses localhost, .local and in-cluster .svc hosts, and any URL that resolves to a private, loopback or reserved IP address. Don't put credentials in the URL.
Pangea doesn't test the connection when you bind it. A wrong URL or token fails the first time someone uses it, so check both.
In the Pangea app
A bound instance gets its own pages:
- Dashboards: browse and read the instance's dashboards.
- Alerts: the alert rules configured in Grafana.
- Datasources: the datasources on the instance.
- Log Explorer: query Loki with LogQL without leaving Pangea.
- Trace Explorer: search Tempo, walk a trace's span tree and inspect single spans.
Grafana's alert rules also feed the Monitoring overview. It shows what is set to fire and what is firing now across your observability connectors, with links back to Grafana.
What the agent can do for you
The agent can work with dashboards, folders, datasources, queries and alerting, and can pull Loki logs and Prometheus metrics. During an incident you can ask:
- "Which alerts are firing right now, and since when?"
- "Pull the latency panel for
checkoutover the last 6 hours and tell me when it degraded." - "Follow the slow trace for this request." The agent walks the trace and correlates it with logs and deploys from your other connectors.
The agent can also create or update alert rules. Review the target datasource, the rule and the notification destination before it changes alerting.
Permissions
Team Administrators bind and remove instances. They can limit who uses each one with a member allow-list. Team members with the Viewer role can only read through the proxy. Changes need the Administrator or Editor role. The service account's role in Grafana stays the outer limit.
Individual actions follow Auto Mode and Full Access. Significant infrastructure work goes through plans.
Good to know
- You can bind several instances side by side, such as prod and staging. The name tells them apart in the app and in conversations.
- To rotate the token, remove the instance and bind it again with the new token.