Adding Data Sources

Data sources are the foundation of Grafana. They provide the connection between Grafana and your data, whether it’s metrics, logs, traces, or other time-series data. This guide covers how to add, configure, and manage data sources in Grafana.

Prerequisites

Before you begin:

Grafana is installed and running
You have Organization Admin permissions
You have connection details for your data source (URL, credentials, etc.)
Network connectivity to your data source

Understanding Data Sources

A data source represents a connection to a backend system that stores data. Grafana supports:

Time-series databases: Prometheus, InfluxDB, Graphite
SQL databases: PostgreSQL, MySQL, Microsoft SQL Server
Logging systems: Loki, Elasticsearch
Tracing systems: Tempo, Jaeger, Zipkin
Cloud monitoring: CloudWatch, Azure Monitor, Google Cloud Monitoring
Many more: See the full list

Only users with the Organization Admin role can add or modify data sources.

Built-in Data Sources

Grafana includes these core data sources:

Prometheus

Time-series metrics database

Loki

Log aggregation system

Tempo

Distributed tracing backend

Elasticsearch

Search and analytics engine

PostgreSQL

Relational database

MySQL

Relational database

CloudWatch

AWS monitoring service

Azure Monitor

Azure monitoring service

TestData

Built-in test data for demos

Adding Your First Data Source

Step 1: Access Data Source Management

Click Connections in the left sidebar
Click Data sources under “Your connections”
Click Add data source

You’ll see a list of available data sources.

Step 2: Select a Data Source Type

Let’s add a Prometheus data source as an example.

Search for Prometheus in the search box
Click on Prometheus to select it

You can filter by data source type (Metrics, Logs, Tracing) or by provider.

Step 3: Configure Basic Settings

Each data source has specific configuration requirements.

Name and Default

Name: Prometheus-Production
Default: Toggle ON to make this the default data source

The default data source is automatically selected when creating new panels.

Connection Settings

URL: http://prometheus:9090
Access: Server (default) - Grafana backend accesses the data source

Server vs Browser Access

Server (Recommended)

Grafana backend makes requests to the data source
Works with data sources not accessible from browsers
Better security (credentials stay on server)
Supports alerting

Browser

User’s browser makes requests directly
Useful for publicly accessible data sources
Subject to CORS restrictions
Does not support alerting

Step 4: Configure Authentication

Depending on your data source, you may need to configure authentication.

Basic Authentication

Basic auth: ON
User: admin
Password: your-secure-password

Custom HTTP Headers

Header: Authorization
Value: Bearer your-api-token

TLS Client Authentication

With CA Cert: ON
CA Cert: [Paste CA certificate]
Client Cert: [Paste client certificate]
Client Key: [Paste client key]

Step 5: Configure Additional Settings

Timeout

HTTP method: POST (recommended for Prometheus)
Timeout: 60 seconds

Query Settings (Prometheus-specific)

Query timeout: 60s
Default editor: Builder (or Code)
PromQL format: Use Prometheus labels

Step 6: Test the Connection

Scroll to the bottom of the page
Click Save & Test
You should see: “Data source is working”

If the test fails, check:

Network connectivity
URL correctness
Authentication credentials
Firewall rules
Data source service status

Configuring Specific Data Sources

Prometheus

Name: Prometheus-Production
URL: http://prometheus:9090
Access: Server
Scrape interval: 15s
Query timeout: 60s
HTTP Method: POST

Additional settings:

Scrape interval: Match your Prometheus scrape interval (default: 15s)
Query timeout: Maximum time for query execution
Custom query parameters: Add custom parameters to all queries

Loki (Logs)

Loki Config

Name: Loki-Logs
URL: http://loki:3100
Access: Server
Max lines: 1000

Configuration options:

Max lines: Limit number of log lines returned (default: 1000)
Derived fields: Extract values from logs for linking
Timeout: Query timeout in seconds

{app="frontend", env="production"}

PostgreSQL

PostgreSQL Config

Name: PostgreSQL-Analytics
Host: postgres.example.com:5432
Database: analytics
User: grafana
Password: ********
SSL Mode: require
Version: 14.x

TLS/SSL Settings:

SSL Mode: disable, require, verify-ca, verify-full
SSL Root Certificate: Path to CA certificate
SSL Client Certificate: Path to client certificate
SSL Client Key: Path to client key

SELECT
  time_column as time,
  metric_name as metric,
  value
FROM metrics
WHERE $__timeFilter(time_column)
ORDER BY time

MySQL

MySQL Config

Name: MySQL-Database
Host: mysql.example.com:3306
Database: metrics
User: grafana_reader
Password: ********
Max open connections: 100
Max idle connections: 100
Max connection lifetime: 14400

Connection pooling:

Max open connections: Maximum concurrent connections
Max idle connections: Maximum idle connections in pool
Connection lifetime: Maximum time a connection can be reused (seconds)

Elasticsearch

Elasticsearch Config

Name: Elasticsearch-Logs
URL: https://elasticsearch.example.com:9200
Access: Server
Index name: logs-*
Time field name: @timestamp
Version: 8.x
Min time interval: 10s

Index settings:

Index name: Pattern for log indices (supports wildcards)
Time field name: Field containing timestamps
Max concurrent shard requests: Limit concurrent requests
Log message field: Field containing log messages
Log level field: Field containing log levels

CloudWatch (AWS)

CloudWatch Config

Name: AWS-CloudWatch
Authentication Provider: AWS SDK Default
Default Region: us-east-1
Namespaces: AWS/EC2, AWS/RDS, AWS/Lambda

Authentication options:

AWS SDK Default: Uses IAM role or environment credentials
Access & Secret Key: Manual credential entry
Credentials file: Path to AWS credentials file

IAM Policy Requirements:

IAM Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:DescribeAlarmsForMetric",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "ec2:DescribeInstances",
        "ec2:DescribeRegions",
        "logs:DescribeLogGroups",
        "logs:GetLogEvents",
        "logs:StartQuery",
        "logs:StopQuery",
        "logs:GetQueryResults"
      ],
      "Resource": "*"
    }
  ]
}

Tempo (Tracing)

Tempo Config

Name: Tempo-Tracing
URL: http://tempo:3200
Access: Server
Trace to logs: Loki-Logs
Trace to metrics: Prometheus-Production

Integration settings:

Trace to logs: Link traces to log data source
Trace to metrics: Link traces to metrics data source
Search: Configure TraceQL query editor
Service graph: Enable service graph visualization

Data Source Permissions

Data source permissions are available in Grafana Enterprise and Grafana Cloud.

By default, any organization member can query any data source. You can restrict access to specific users, teams, or service accounts.

Permission Levels

Query: Can query the data source
Edit: Can query and modify data source configuration
Admin: Full control including permissions management

Assigning Permissions

Navigate to Connections → Data sources
Click on the data source
Go to the Permissions tab
Click Add a permission
Select:
- User, Service Account, Team, or Role
- The entity to grant permission
- Permission level (Query, Edit, or Admin)
Click Save

Type: Team
Team: DevOps
Permission: Query

Query Caching

Query caching is available in Grafana Enterprise and Grafana Cloud.

Caching reduces load on your data sources and speeds up dashboard loading.

Enable Caching

Navigate to the data source settings
Go to the Cache tab
Click Enable
Configure cache settings:

Cache Settings

Default TTL (queries): 300 seconds
Default TTL (resources): 3600 seconds

Cache backends:

In-memory: Simple but limited by available RAM
Redis: Recommended for production
Memcached: Alternative distributed cache

Per-Panel Cache Override

Override cache TTL for specific panels:

Edit the panel
Expand Query options
Set Cache timeout in milliseconds

Default cache: 300000ms (5 minutes)
Panel override: 60000ms (1 minute)

Data Source Variables

Create dashboard variables that allow users to switch between data sources.

In dashboard settings, click Variables
Click Add variable
Configure:

Variable Config

Name: datasource
Type: Data source
Type: Prometheus
Instance name filter: .*-production$
Multi-value: No

Use in queries by selecting ${datasource} as the data source.

Provisioning Data Sources

Automate data source configuration using YAML files. Create /etc/grafana/provisioning/datasources/datasources.yaml:

datasources.yaml

apiVersion: 1

datasources:
  - name: Prometheus
    type: prometheus
    access: proxy
    url: http://prometheus:9090
    isDefault: true
    editable: false
    jsonData:
      httpMethod: POST
      timeInterval: 15s
    secureJsonData:
      basicAuthPassword: ${PROMETHEUS_PASSWORD}

  - name: Loki
    type: loki
    access: proxy
    url: http://loki:3100
    jsonData:
      maxLines: 1000
      derivedFields:
        - name: traceID
          matcherRegex: "traceID=(\\w+)"
          url: "http://localhost:3000/explore?left=[\"now-1h\",\"now\",\"Tempo\",{\"query\":\"${__value.raw}\"}]"
          datasourceUid: tempo

  - name: PostgreSQL
    type: postgres
    url: postgres:5432
    database: grafana
    user: grafana
    secureJsonData:
      password: ${POSTGRES_PASSWORD}
    jsonData:
      sslmode: require
      maxOpenConns: 100
      maxIdleConns: 100
      connMaxLifetime: 14400

Store sensitive credentials in environment variables, not in plain text.

Managing Data Sources

Edit Data Source

Navigate to Connections → Data sources
Click on the data source name
Modify settings
Click Save & Test

Delete Data Source

Navigate to Connections → Data sources
Click on the data source
Scroll to the bottom
Click Delete
Confirm deletion

Deleting a data source will break any dashboards, alerts, or panels using it.

Test Data Source

Regularly test data source connectivity:

Open the data source settings
Click Save & Test
Verify “Data source is working” message

Building Dashboards from Data Sources

After configuring a data source, quickly create a dashboard:

Navigate to Connections → Data sources
Click on the data source
Click Build a dashboard
Grafana creates a new dashboard with the data source pre-selected

Best Practices

Descriptive Names

Use clear names like Prometheus-Production instead of prom1

Default Data Source

Set your most-used data source as default

Test Connections

Always test data source connections after configuration

Secure Credentials

Use environment variables for sensitive data

Connection Pooling

Configure appropriate pool sizes for SQL databases

Query Timeouts

Set reasonable timeouts to prevent slow queries

Security Recommendations

Use Read-Only Credentials

Create dedicated database users with read-only permissions
Limit access to only necessary databases/tables
Avoid using admin or root credentials

PostgreSQL Example

CREATE USER grafana_reader WITH PASSWORD 'secure_password';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO grafana_reader;

Enable TLS/SSL

Always use encrypted connections in production
Verify certificate validity
Use certificate pinning when possible

SSL Mode: verify-full
CA Certificate: /path/to/ca.crt
Client Certificate: /path/to/client.crt
Client Key: /path/to/client.key

Network Isolation

Place Grafana and data sources in the same network
Use private IPs when possible
Implement firewall rules
Consider using VPN or SSH tunneling

Rotate Credentials

Regularly update data source passwords
Use secrets management (Vault, AWS Secrets Manager)
Implement credential rotation policies
Monitor for unauthorized access

Next Steps

Create Dashboards

Build visualizations with your data

User Management

Control access to data sources

Troubleshooting

Connection Timeout

Symptoms: “Connection timeout” or “Unable to connect”Solutions:

Verify network connectivity: ping data-source-host
Check firewall rules allow Grafana → Data source
Increase timeout settings
Verify data source service is running
Check DNS resolution: nslookup data-source-host

Authentication Failed

Symptoms: “401 Unauthorized” or “403 Forbidden”Solutions:

Verify credentials are correct
Check user has necessary permissions
Confirm authentication method (Basic, Token, etc.)
Review data source logs for errors
Test credentials using curl or similar tool

TLS/SSL Errors

Symptoms: “Certificate verify failed” or “SSL handshake failed”Solutions:

Verify CA certificate is correct
Check certificate expiration
Ensure certificate hostname matches URL
Add custom CA certificates to Grafana
Try disabling certificate verification (non-production only)

Slow Queries

Symptoms: Panels take long to load or timeoutSolutions:

Reduce time range in queries
Optimize data source queries
Enable query caching
Increase query timeout
Check data source performance
Use query result transformations

No Data Returned

Symptoms: Panel shows “No data”Solutions:

Verify time range includes data
Check query syntax
Confirm data exists in data source
Review data source permissions
Enable query inspector to see actual query
Check browser console for errors

Overview

Getting Started

Dashboards

Data Sources

Alerting

Explore

Visualization

​Adding Data Sources

​Prerequisites

​Understanding Data Sources

​Built-in Data Sources

Prometheus

Loki

Tempo

Elasticsearch

PostgreSQL

MySQL

CloudWatch

Azure Monitor

TestData

​Adding Your First Data Source

​Step 1: Access Data Source Management

​Step 2: Select a Data Source Type

​Step 3: Configure Basic Settings

​Name and Default

​Connection Settings

​Step 4: Configure Authentication

​Basic Authentication

​Custom HTTP Headers

​TLS Client Authentication

​Step 5: Configure Additional Settings

​Timeout

​Query Settings (Prometheus-specific)

​Step 6: Test the Connection

​Configuring Specific Data Sources

​Prometheus

​Loki (Logs)

​PostgreSQL

​MySQL

​Elasticsearch

​CloudWatch (AWS)

​Tempo (Tracing)

​Data Source Permissions

​Permission Levels

​Assigning Permissions

​Query Caching

​Enable Caching

​Per-Panel Cache Override

​Data Source Variables

​Provisioning Data Sources

​Managing Data Sources

​Edit Data Source

​Delete Data Source

​Test Data Source

​Building Dashboards from Data Sources

​Best Practices

Descriptive Names

Default Data Source

Test Connections

Secure Credentials

Connection Pooling

Query Timeouts

​Security Recommendations

​Next Steps

Create Dashboards

User Management

​Troubleshooting

Adding Data Sources

Prerequisites

Understanding Data Sources

Built-in Data Sources

Adding Your First Data Source

Step 1: Access Data Source Management

Step 2: Select a Data Source Type

Step 3: Configure Basic Settings

Name and Default

Connection Settings

Step 4: Configure Authentication

Basic Authentication

Custom HTTP Headers

TLS Client Authentication

Step 5: Configure Additional Settings

Timeout

Query Settings (Prometheus-specific)

Step 6: Test the Connection

Configuring Specific Data Sources

Prometheus

Loki (Logs)

PostgreSQL

MySQL

Elasticsearch

CloudWatch (AWS)

Tempo (Tracing)

Data Source Permissions

Permission Levels

Assigning Permissions

Query Caching

Enable Caching

Per-Panel Cache Override

Data Source Variables

Provisioning Data Sources

Managing Data Sources

Edit Data Source

Delete Data Source

Test Data Source

Building Dashboards from Data Sources

Best Practices

Security Recommendations

Next Steps

Troubleshooting