{
  "title": "SocketX WebSocket Proxy",
  "description": "SocketX WebSocket Proxy Server - MTE Encryption Metrics. All panels query SocketX structured logs; see observability/README.md in the socketx-server repository for the event catalog. Works with v1 and v2 server logs.",
  "layout_type": "ordered",
  "reflow_type": "auto",
  "template_variables": [],
  "widgets": [
    {
      "definition": {
        "title": "Global Health",
        "type": "group",
        "layout_type": "ordered",
        "widgets": [
          {
            "definition": {
              "title": "Total Connections",
              "type": "query_value",
              "autoscale": true,
              "precision": 0,
              "requests": [
                {
                  "response_format": "scalar",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "query1",
                      "indexes": ["*"],
                      "compute": { "aggregation": "count" },
                      "group_by": [],
                      "search": { "query": "\"New websocket connection\"" }
                    }
                  ],
                  "formulas": [{ "formula": "query1" }]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Total MTE Operations",
              "type": "query_value",
              "autoscale": true,
              "precision": 0,
              "requests": [
                {
                  "response_format": "scalar",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "query1",
                      "indexes": ["*"],
                      "compute": { "aggregation": "count" },
                      "group_by": [],
                      "search": { "query": "(\"MTE encryption event\" OR \"MTE decryption event\")" }
                    }
                  ],
                  "formulas": [{ "formula": "query1" }]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Total Bytes Processed",
              "type": "query_value",
              "autoscale": true,
              "precision": 1,
              "custom_unit": "B",
              "requests": [
                {
                  "response_format": "scalar",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "query1",
                      "indexes": ["*"],
                      "compute": { "aggregation": "sum", "metric": "@payload_size_bytes" },
                      "group_by": [],
                      "search": { "query": "(\"MTE encryption event\" OR \"MTE decryption event\")" }
                    }
                  ],
                  "formulas": [{ "formula": "query1" }]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Avg Encrypt Time",
              "type": "query_value",
              "autoscale": false,
              "precision": 2,
              "custom_unit": "ms",
              "requests": [
                {
                  "response_format": "scalar",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "query1",
                      "indexes": ["*"],
                      "compute": { "aggregation": "avg", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE encryption event\"" }
                    }
                  ],
                  "formulas": [{ "formula": "query1" }]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Avg Decrypt Time",
              "type": "query_value",
              "autoscale": false,
              "precision": 2,
              "custom_unit": "ms",
              "requests": [
                {
                  "response_format": "scalar",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "query1",
                      "indexes": ["*"],
                      "compute": { "aggregation": "avg", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE decryption event\"" }
                    }
                  ],
                  "formulas": [{ "formula": "query1" }]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Avg Session Duration",
              "type": "query_value",
              "autoscale": false,
              "precision": 1,
              "custom_unit": "s",
              "requests": [
                {
                  "response_format": "scalar",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "query1",
                      "indexes": ["*"],
                      "compute": { "aggregation": "avg", "metric": "@audit.duration_seconds" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    }
                  ],
                  "formulas": [{ "formula": "query1" }]
                }
              ]
            }
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Connection Metrics",
        "type": "group",
        "layout_type": "ordered",
        "widgets": [
          {
            "definition": {
              "title": "New Connections",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "bars",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "query1",
                      "indexes": ["*"],
                      "compute": { "aggregation": "count" },
                      "group_by": [],
                      "search": { "query": "\"New websocket connection\"" }
                    }
                  ],
                  "formulas": [{ "alias": "new connections", "formula": "query1" }]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Session Duration",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "avgdur",
                      "indexes": ["*"],
                      "compute": { "aggregation": "avg", "metric": "@audit.duration_seconds" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "maxdur",
                      "indexes": ["*"],
                      "compute": { "aggregation": "max", "metric": "@audit.duration_seconds" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "mindur",
                      "indexes": ["*"],
                      "compute": { "aggregation": "min", "metric": "@audit.duration_seconds" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    }
                  ],
                  "formulas": [
                    { "alias": "avg (s)", "formula": "avgdur" },
                    { "alias": "max (s)", "formula": "maxdur" },
                    { "alias": "min (s)", "formula": "mindur" }
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    {
      "definition": {
        "title": "MTE Performance",
        "type": "group",
        "layout_type": "ordered",
        "widgets": [
          {
            "definition": {
              "title": "Encryption Latency",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "avgms",
                      "indexes": ["*"],
                      "compute": { "aggregation": "avg", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE encryption event\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "p95ms",
                      "indexes": ["*"],
                      "compute": { "aggregation": "pc95", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE encryption event\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "p99ms",
                      "indexes": ["*"],
                      "compute": { "aggregation": "pc99", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE encryption event\"" }
                    }
                  ],
                  "formulas": [
                    { "alias": "avg (ms)", "formula": "avgms" },
                    { "alias": "p95 (ms)", "formula": "p95ms" },
                    { "alias": "p99 (ms)", "formula": "p99ms" }
                  ]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Decryption Latency",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "avgms",
                      "indexes": ["*"],
                      "compute": { "aggregation": "avg", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE decryption event\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "p95ms",
                      "indexes": ["*"],
                      "compute": { "aggregation": "pc95", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE decryption event\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "p99ms",
                      "indexes": ["*"],
                      "compute": { "aggregation": "pc99", "metric": "@duration_ms" },
                      "group_by": [],
                      "search": { "query": "\"MTE decryption event\"" }
                    }
                  ],
                  "formulas": [
                    { "alias": "avg (ms)", "formula": "avgms" },
                    { "alias": "p95 (ms)", "formula": "p95ms" },
                    { "alias": "p99 (ms)", "formula": "p99ms" }
                  ]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "MTE Operations Over Time",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "encs",
                      "indexes": ["*"],
                      "compute": { "aggregation": "count" },
                      "group_by": [],
                      "search": { "query": "\"MTE encryption event\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "decs",
                      "indexes": ["*"],
                      "compute": { "aggregation": "count" },
                      "group_by": [],
                      "search": { "query": "\"MTE decryption event\"" }
                    }
                  ],
                  "formulas": [
                    { "alias": "encryptions", "formula": "encs" },
                    { "alias": "decryptions", "formula": "decs" }
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Traffic & Throughput",
        "type": "group",
        "layout_type": "ordered",
        "widgets": [
          {
            "definition": {
              "title": "Bytes Processed Over Time",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "encbytes",
                      "indexes": ["*"],
                      "compute": { "aggregation": "sum", "metric": "@payload_size_bytes" },
                      "group_by": [],
                      "search": { "query": "\"MTE encryption event\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "decbytes",
                      "indexes": ["*"],
                      "compute": { "aggregation": "sum", "metric": "@payload_size_bytes" },
                      "group_by": [],
                      "search": { "query": "\"MTE decryption event\"" }
                    }
                  ],
                  "formulas": [
                    { "alias": "encrypted bytes", "formula": "encbytes" },
                    { "alias": "decrypted bytes", "formula": "decbytes" }
                  ]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Payload Size Statistics",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "avgp",
                      "indexes": ["*"],
                      "compute": { "aggregation": "avg", "metric": "@payload_size_bytes" },
                      "group_by": [],
                      "search": { "query": "(\"MTE encryption event\" OR \"MTE decryption event\")" }
                    },
                    {
                      "data_source": "logs",
                      "name": "maxp",
                      "indexes": ["*"],
                      "compute": { "aggregation": "max", "metric": "@payload_size_bytes" },
                      "group_by": [],
                      "search": { "query": "(\"MTE encryption event\" OR \"MTE decryption event\")" }
                    },
                    {
                      "data_source": "logs",
                      "name": "minp",
                      "indexes": ["*"],
                      "compute": { "aggregation": "min", "metric": "@payload_size_bytes" },
                      "group_by": [],
                      "search": { "query": "(\"MTE encryption event\" OR \"MTE decryption event\")" }
                    }
                  ],
                  "formulas": [
                    { "alias": "avg (bytes)", "formula": "avgp" },
                    { "alias": "max (bytes)", "formula": "maxp" },
                    { "alias": "min (bytes)", "formula": "minp" }
                  ]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Messages by Direction",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "toclient",
                      "indexes": ["*"],
                      "compute": { "aggregation": "sum", "metric": "@audit.messages_to_client" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "toupstream",
                      "indexes": ["*"],
                      "compute": { "aggregation": "sum", "metric": "@audit.messages_to_upstream" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    }
                  ],
                  "formulas": [
                    { "alias": "to client", "formula": "toclient" },
                    { "alias": "to upstream", "formula": "toupstream" }
                  ]
                }
              ]
            }
          },
          {
            "definition": {
              "title": "Bytes by Direction",
              "type": "timeseries",
              "show_legend": true,
              "legend_layout": "auto",
              "requests": [
                {
                  "response_format": "timeseries",
                  "display_type": "line",
                  "queries": [
                    {
                      "data_source": "logs",
                      "name": "toclient",
                      "indexes": ["*"],
                      "compute": { "aggregation": "sum", "metric": "@audit.bytes_to_client" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    },
                    {
                      "data_source": "logs",
                      "name": "toupstream",
                      "indexes": ["*"],
                      "compute": { "aggregation": "sum", "metric": "@audit.bytes_to_upstream" },
                      "group_by": [],
                      "search": { "query": "\"Websocket connection closed\"" }
                    }
                  ],
                  "formulas": [
                    { "alias": "to client (bytes)", "formula": "toclient" },
                    { "alias": "to upstream (bytes)", "formula": "toupstream" }
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    {
      "definition": {
        "title": "Session Audit",
        "type": "group",
        "layout_type": "ordered",
        "widgets": [
          {
            "definition": {
              "title": "Recent Session Audits",
              "type": "log_stream",
              "indexes": [],
              "query": "\"Websocket connection closed\"",
              "columns": ["host", "service"],
              "show_date_column": true,
              "show_message_column": true,
              "message_display": "expanded-md",
              "sort": { "column": "time", "order": "desc" }
            }
          },
          {
            "definition": {
              "title": "Recent MTE and Recovery Events",
              "type": "log_stream",
              "indexes": [],
              "query": "(\"MTE encryption event\" OR \"MTE decryption event\" OR @event_type:socketx_recovery)",
              "columns": ["host", "service"],
              "show_date_column": true,
              "show_message_column": true,
              "message_display": "inline",
              "sort": { "column": "time", "order": "desc" }
            }
          }
        ]
      }
    }
  ]
}