Reference
Look-up facts for Grafana: versions and support windows, editions and pricing, requirements, ports, configuration keys, APIs, roles, metrics, limits, and deprecations. For how the pieces fit together see Explanation; for step-by-step tasks see How-to Guides.
Scope
This page covers the Grafana server (OSS/Enterprise/Cloud) and its collector (Alloy). Loki, Tempo, Mimir and Pyroscope internals, limits and benchmarks live in the LGTM Stack topic.
Versions and Support
Current Release Lines (as of 2026-09-25)
Dates come from the upstream CHANGELOG.md. End-of-support dates are computed from the published policy (each minor is supported 9 months; the last minor of a major gets 15 months) and are approximate.
| Line |
First release |
Latest patch (date) |
Approx. end of support |
Notes |
| 13.2 |
2026-08-18 |
13.2.2 (2026-09-15) |
~2027-05 |
Current minor. Saved queries GA, Git Sync for GitHub Enterprise, GitLab/Bitbucket webhooks |
| 13.1 |
2026-06-23 |
13.1.6 (2026-09-15) |
~2027-03 |
Quick filters and grouping GA, Git Sync verified commits, Assistant pre-installed in Enterprise |
| 13.0 |
2026-04-17 (13.0.1) |
13.0.9 (2026-09-15) |
~2027-01 |
13.0.0 (2026-04-14) was withdrawn over a Git Sync migration bug; start from 13.0.1 |
| 12.4 |
2026-02-24 |
12.4.11 (2026-09-15) |
~2027-05 (extended) |
Last 12.x minor, so it gets the 15-month window |
| 12.3 |
2025-11-19 |
12.3.11 (2026-08-18) |
Ended ~2026-08 |
Out of support |
| 12.2 |
2025-09-23 |
12.2.10 (2026-06-23) |
Ended ~2026-06 |
Out of support |
| 12.1 |
2025-07-23 |
12.1.10 (2026-03-25) |
Ended ~2026-04 |
Out of support |
| 12.0 |
2025-05-05 |
12.0.10 (2026-02-12) |
Ended |
Angular removed, schema v2 and Git Sync experimental |
| 11.6 |
2025-03-25 |
11.6.16 (2026-06-23) |
Ended ~2026-06 |
Last 11.x minor (extended window) |
Release Cadence
| Release type |
Cadence |
Content |
Major (X.0) |
Once a year, around April–May (GrafanaCON) |
Breaking changes allowed |
Minor (X.Y) |
Every other month |
Features, fixes, security |
Patch (X.Y.Z) |
At least monthly for every supported minor |
Bug and security fixes only |
Security (X.Y.Z+security-NN) |
As needed |
Out-of-band CVE fixes, published for all supported lines |
Source: Grafana upgrade strategy docs, cross-checked against the CHANGELOG release dates (for example 12.3 last patched 2026-08-18, exactly 9 months after 12.3.0).
The chart below shows the support windows of the current lines (computed, approximate).
gantt
title Grafana support windows (approximate)
dateFormat YYYY-MM-DD
axisFormat %Y-%m
section 12.x
12.3 :done, 2025-11-19, 2026-08-19
12.4 extended :active, 2026-02-24, 2027-05-24
section 13.x
13.0 :active, 2026-04-14, 2027-01-14
13.1 :active, 2026-06-23, 2027-03-23
13.2 :active, 2026-08-18, 2027-05-18
| Component |
Latest version (date) |
License |
Source |
| Grafana |
13.2.2 (2026-09-15) |
AGPL-3.0-only |
CHANGELOG |
| Grafana Alloy |
1.20.0 (2026-09-25) |
Apache-2.0 |
Alloy CHANGELOG |
@grafana/data (npm) |
13.2.2 |
Apache-2.0 |
registry.npmjs.org |
@grafana/scenes (npm) |
8.19.0 (2026-09-24) |
Apache-2.0 |
registry.npmjs.org |
@grafana/create-plugin (npm) |
7.11.0 |
Apache-2.0 |
registry.npmjs.org |
Grafana Helm chart (grafana-community/grafana) |
13.2.5 (appVersion 13.2.2) |
Apache-2.0 |
grafana-community/helm-charts |
gcx CLI |
GA (version TBD — not checked) |
Apache-2.0 |
grafana/gcx |
| Grafana Agent (Static/Flow/Operator) |
EOL 2025-11-01 |
Apache-2.0 |
grafana/agent README |
Editions and Pricing
Editions
| Edition |
Hosting |
License |
Adds over OSS |
| Grafana OSS |
Self-managed |
AGPL-3.0-only |
— |
| Grafana Enterprise |
Self-managed |
Commercial |
Enterprise data-source plugins, fine-grained RBAC with custom roles, SAML, team sync, data source permissions, reporting, auditing, request security, Vault/secrets keepers, usage insights, query caching, SCIM; Grafana Assistant pre-installed (13.1+) |
| Grafana Cloud |
Grafana Labs SaaS |
Commercial |
Hosted Grafana plus Mimir/Loki/Tempo/Pyroscope backends, k6, Synthetic Monitoring, IRM, Frontend/App Observability, Grafana Assistant |
| Amazon Managed Grafana |
AWS |
Commercial (AWS) |
AWS IAM Identity Center / SAML auth, AWS data-source integrations; per-user pricing |
| Azure Managed Grafana |
Azure |
Commercial (Azure) |
Entra ID integration; Grafana 13 with Git Sync became available on Azure in 2026 (per third-party coverage) |
Grafana Cloud Plans (2026)
Prices change
grafana.com/pricing could not be fetched directly during this review; the figures below match several independent 2026 pricing trackers (for example MonitoringCost, CubeAPM). Confirm on grafana.com/pricing before budgeting.
| Plan |
Platform fee |
Included / usage |
Retention |
Support |
| Free |
$0 |
10k metrics series, 50 GB logs, 50 GB traces, 50 GB profiles, 500 k6 VUh, 3 active users |
14 days |
Community |
| Pro |
$19/month |
Free allowances, then pay-as-you-go |
13 months metrics, 30 days logs/traces/profiles |
8x5 email |
| Enterprise |
Custom, from ~$25,000/year commitment |
Volume discounts, enterprise plugins |
Custom |
Enterprise SLAs |
| Pro usage item |
List price (2026) |
| Metrics |
~$6.50 per 1,000 billable active series above 10k |
| Logs |
~$0.45 per GB ingested above 50 GB (lower-cost tiers exist for longer retention) |
| Traces |
~$0.45 per GB above 50 GB |
| Profiles |
~$0.45 per GB above 50 GB |
| Visualization users |
~$8 per active user above 3 |
| Grafana Assistant |
Billed per token consumed (per gcx docs); rate TBD |
| k6 / Synthetics / IRM |
Per VU-hour, per test execution, per monthly active user respectively |
Old figure corrected
Earlier versions of this note said metrics cost "~$8 per active series". The unit is per 1,000 series, and the 2026 list price is about $6.50 per 1,000.
Licensing
| Scope |
License |
Since |
grafana/grafana (default) |
AGPL-3.0-only |
Grafana 8.0 (April 2021); Apache-2.0 before |
packages/grafana-data, grafana-ui, grafana-runtime, grafana-e2e-selectors, kinds/, pkg/kindsys, grafana-mixin, packaging/ |
Apache-2.0 |
Per LICENSING.md |
| Loki, Tempo, Mimir, Pyroscope |
AGPL-3.0 |
2021 relicensing (Mimir and Pyroscope launched as AGPL) |
Alloy, Beyla, Helm charts, Terraform provider, plugin SDKs, gcx |
Apache-2.0 |
— |
| Grafana Enterprise |
Proprietary (Enterprise build is free to run without a license; features unlock with a license key) |
— |
System Requirements
Supported Databases
| Database |
Supported versions |
Production use |
| SQLite 3 |
Embedded default |
Dev and small evaluation only; not for HA |
| MySQL |
8.0+ |
Yes (read-only replicas and Aurora failover can cause errors, issue #13399) |
| PostgreSQL |
12+ (avoid 10.9, 11.4, 12-beta2 because of bug #15865) |
Yes |
Source: Install Grafana — supported databases.
Sizing Tiers (official guidance)
| Tier |
Concurrent users |
Alert rules |
Data sources |
Dashboards |
CPU |
Memory |
Instances |
| Small |
< 25 |
< 100 |
< 5 |
< 200 |
2 cores |
2–4 GB |
1 |
| Medium |
25–200 |
100–1,000 |
5–25 |
200–2,000 |
4–8 cores |
8–16 GB |
2 (load-balanced) |
| Large |
200+ |
1,000+ |
25+ |
2,000+ |
8–16+ cores each |
16–32+ GB each |
3+ (load-balanced) |
Image Renderer workers use about 1 GB of memory each. Supported OS: Debian/Ubuntu, RHEL/Fedora, SUSE/openSUSE, macOS, Windows. Supported browsers: current Chrome/Chromium, Firefox, Safari, Edge. The Ubuntu-based Docker image variant moved from Ubuntu 22.04 to 24.04 in Grafana 13.0 (the default image tags are Alpine-based).
Container Images
| Image |
Contents |
Status |
grafana/grafana |
Grafana OSS |
Current OSS image |
grafana/grafana-oss |
Same OSS image |
No longer updated from 12.4.0 — switch to grafana/grafana |
grafana/grafana-enterprise |
Enterprise build |
Current |
grafana/grafana-image-renderer |
Headless-Chromium renderer service |
Required as a separate service since 13.0 |
grafana/alloy |
Alloy collector |
Current |
grafana/otel-lgtm |
All-in-one OTel + LGTM dev image |
Dev and demo only |
Ports
| Port |
Component |
Purpose |
| 3000 |
Grafana server |
HTTP UI and API ([server] http_port) |
| 9094 |
Grafana alerting |
HA gossip/memberlist ([unified_alerting] ha_listen_address) |
| 8081 |
Image Renderer |
Renderer service port used in the official examples |
| 12345 |
Alloy |
HTTP server, debug UI, /metrics |
| 4317 / 4318 |
Alloy, Tempo, otel-lgtm |
OTLP gRPC / OTLP HTTP |
| 3100 / 3200 / 9009 |
Loki / Tempo / Mimir |
Default HTTP ports used in the dev compose example |
Configuration Keys (grafana.ini)
Defaults are from conf/defaults.ini on main (2026-09). Every key can be set with GF_<SECTION>_<KEY> (dots and dashes become underscores, for example GF_AUTH_GENERIC_OAUTH_ENABLED).
| Section / key |
Default |
Notes |
[server] http_port |
3000 |
|
[server] protocol |
http |
https, h2, socket; 13.0 adds HTTPS/HTTP2 over Unix sockets |
[server] enable_gzip |
true |
Default flipped to true in 13.0 |
[database] type |
sqlite3 |
mysql or postgres for HA |
[remote_cache] type |
database |
redis or memcached; connstr e.g. addr=127.0.0.1:6379,pool_size=100,db=0 |
[dataproxy] timeout |
30 (s) |
Also dialTimeout = 10, keep_alive_seconds = 30 |
[security] admin_user / admin_password |
admin / admin |
Change on first start |
[security] secret_key |
Static default |
Must be overridden; encrypts secrets in the DB |
[security] cookie_secure |
false |
Set true behind HTTPS |
[security] cookie_samesite |
lax |
lax, strict, none, disabled |
[security] allow_embedding |
false |
Needed for iframes |
[security] content_security_policy |
false |
Template uses $NONCE and 'strict-dynamic' |
[security] strict_transport_security |
false |
HSTS header |
[security] disable_brute_force_login_protection |
false |
Locks after brute_force_login_protection_max_attempts = 5 |
[auth] login_maximum_inactive_lifetime_duration |
empty (= 7d) |
Duration syntax; replaces the old _days keys |
[auth] login_maximum_lifetime_duration |
empty (= 30d) |
|
[auth] token_rotation_interval_minutes |
10 |
|
[auth] disable_login_form |
false |
Hide form when using SSO |
[auth.basic] password_policy |
false |
true enforces 12+ chars with upper, lower, digit, symbol |
[auth.anonymous] enabled |
false |
|
[users] allow_sign_up |
false |
Self sign-up |
[unified_alerting] enabled |
empty (on) |
Legacy alerting was removed in Grafana 11 |
[unified_alerting] ha_peers |
empty |
Memberlist peers for alerting HA (port 9094) |
[unified_alerting] ha_redis_address |
empty |
Redis alternative to memberlist |
[unified_alerting] ha_single_node_evaluation |
false |
13.0: evaluate rules on one node only |
[rendering] renderer_token |
- |
Must be set to a non-default value on 13.0+ (JWT render auth) |
[rendering] concurrent_render_request_limit |
30 |
|
[plugins] preinstall |
empty |
Replaces GF_INSTALL_PLUGINS (use GF_PLUGINS_PREINSTALL) |
[plugins] preinstall_auto_update |
true |
|
[provisioning] enabled |
true |
Git Sync / repository provisioning (on by default since 13.0) |
[provisioning] allowed_targets |
folder\|folderless |
Git Sync sync targets |
[provisioning] min_sync_interval |
10s |
|
[provisioning] max_repositories |
10 |
0 = unlimited (self-managed) |
[unified_storage] migration_cache_size_kb |
1000000 |
SQLite migration tuning (13.0) |
[unified_storage] migration_parquet_buffer |
false |
Avoids SQLite lock contention during migration |
[analytics] reporting_enabled |
true |
Anonymous usage stats |
[feature_toggles] <name> |
— |
Since 13.0 set toggles directly; enable = a,b list is deprecated |
CLI Reference
| Command |
Purpose |
grafana server |
Run the server (grafana-server binary removed in 13.0) |
grafana cli plugins install <id> [version] |
Install a plugin |
grafana cli plugins ls / list-remote / list-versions <id> |
List plugins |
grafana cli plugins update <id> / update-all |
Update (aliases upgrade, upgrade-all) |
grafana cli plugins uninstall <id> |
Remove (alias remove) |
grafana cli admin reset-admin-password [--password-from-stdin] |
Reset admin password |
grafana cli admin data-migration encrypt-datasource-passwords |
Move plaintext passwords to secure_json_data |
grafana cli admin secrets-migration re-encrypt / rollback / re-encrypt-data-keys |
Secrets encryption maintenance |
grafana cli admin db-migrate / resource-db-migrate |
Run SQL / unified storage schema migrations |
| Global flags |
--homepath, --config, --configOverrides, --pluginsDir, --repo, --pluginUrl, --insecure, --debug |
gcx |
Separate Apache-2.0 CLI for the /apis resource APIs (Grafana 12+); replaces grafanactl (archived 2026-06-01) |
Source: pkg/cmd/grafana-cli/commands/commands.go.
HTTP APIs
API Families
| Family |
Path shape |
Status (13.x) |
| Legacy REST |
/api/... |
Deprecated in 13.0, not disabled; removal planned for a future major |
| App platform (Kubernetes-style) |
/apis/<group>/<version>/namespaces/<namespace>/<resource>[/<name>] |
Preferred; used by Git Sync, gcx, Terraform |
| Namespace values |
default (org 1), org-<id> (other orgs), stacks-<id> (Grafana Cloud) |
|
| Version levels |
v1alpha1 (off by default), v1beta1 (off by default), v1 (GA, on) |
Per New API structure |
Frequently Used Endpoints
| Endpoint |
Purpose |
GET /api/health |
Liveness and DB check (no auth) |
GET /api/search?type=dash-db |
Search dashboards |
GET /api/dashboards/uid/<uid> |
Get dashboard JSON (legacy) |
POST /api/dashboards/db |
Create/update dashboard (legacy; accepts folderUid) |
GET /apis/dashboard.grafana.app/v1/namespaces/default/dashboards/<name> |
Dashboard as a resource |
GET /api/datasources/uid/<uid> |
Data source by UID (numeric-ID variants disabled by default in 13.0; re-enable with datasourceLegacyIdApi) |
GET /api/datasources/uid/<uid>/health |
Data source health check |
ANY /api/datasources/proxy/uid/<uid>/<path> |
Proxy a call to the data source |
POST /api/serviceaccounts, POST /api/serviceaccounts/<id>/tokens |
Service accounts and tokens |
/api/v1/provisioning/alert-rules, /contact-points, /policies |
Alerting provisioning API (alert-rule endpoints deprecated in 13.0) |
/apis/notifications.alerting.grafana.app/v1beta1/namespaces/<ns>/receivers |
Contact points (also routingtrees, templategroups, timeintervals, inhibitionrules) |
GET /metrics |
Prometheus metrics for Grafana itself |
Roles and Permissions
Basic (Org) Roles
| Role |
Dashboards |
Data sources |
Admin capabilities |
No basic role (None) |
None by default |
None |
None; pure RBAC-driven access (since 10.2) |
| Viewer |
View |
Query (if permitted) |
None |
| Editor |
Create, edit, delete |
Query (if permitted) |
Create alert rules; manage own dashboards |
| Admin |
Full org management |
Full management |
Users, teams, org settings |
| Grafana Admin (server admin) |
All orgs |
All |
Server-wide settings, orgs, users |
Folder and Dashboard Permission Levels
| Level |
Value |
Grants |
| View |
1 |
Read-only |
| Edit |
2 |
Modify dashboard JSON, panels, settings |
| Admin |
4 |
Manage permissions, delete, move |
Org Admins always have full access; folder permissions cannot restrict them.
Example RBAC Actions (Enterprise/Cloud)
| Action |
Scope example |
Use |
datasources:read, datasources:query, datasources:write, datasources:delete |
datasources:uid:<uid> |
Data source permissions |
dashboards:create, dashboards:write |
folders:uid:<uid> |
Folder-scoped dashboard editing |
alert.notifications.system-status:read |
— |
Required for /api/alertmanager/grafana/api/v2/status since 13.0 |
Fixed roles such as fixed:datasources:reader, fixed:alerting.notifications:writer |
— |
Pre-defined bundles |
Alerting Reference
Alert Instance States
| State |
Meaning |
| Normal |
Condition false |
| Pending |
Condition true, pending period (for) not yet elapsed |
| Alerting (rule shows "Firing") |
Condition true for longer than the pending period |
| Recovering |
Condition false but keep_firing_for not yet elapsed (added in 12.0) |
| NoData |
Query returned no data (configurable: NoData, Alerting, Normal, KeepLast) |
| Error |
Evaluation failed (configurable: Error, Alerting, Normal, KeepLast) |
Rule health values: Ok, Error, No Data, {status}, KeepLast.
allowed_integrations accepts: prometheus-alertmanager, dingding, discord, email, googlechat, jira, kafka, mqtt, oncall, opsgenie, pagerduty, pushover, sensugo, slack, sns, teams, telegram, threema, victorops, webex, webhook, wecom.
Git Sync Limits
| Limit |
Cloud Free |
Cloud (other) |
Self-managed OSS |
Self-managed Enterprise |
| Repositories (connections) |
1 |
10 |
10 (default, max_repositories) |
10 (default) |
| Synced resources per repository |
20 |
1,000 |
Unlimited (max_resources_per_repository = 0) |
Unlimited |
Recommendation: stay at or below ~1,000 resources per connection; default polling interval is 60 s unless webhooks are configured. Providers: any Git server ("Pure Git"), plus enhanced GitHub, GitHub Enterprise (13.2), GitLab and Bitbucket integrations. Source: Git Sync usage limits.
Plugin Types
| Type |
Purpose |
Example |
| Data source |
Connect to external backends |
Prometheus, MySQL, Elasticsearch |
| Panel |
Visualizations |
Time series, Stat, Geomap, Flame graph, Gauge (new, GA in 13.0) |
| App |
Bundles pages, data sources, panels |
Drilldown apps, Grafana Advisor, Grafana IRM |
| Renderer |
Server-side image/PDF rendering |
grafana-image-renderer — must run as a separate service since 13.0 |
Grafana Self-Monitoring Metrics
Grafana exposes Prometheus metrics at /metrics (namespace grafana_).
| Metric |
What it tells you |
grafana_http_request_duration_seconds |
API/page request latency |
grafana_http_request_in_flight |
Concurrent requests |
grafana_api_dataproxy_request_all_milliseconds |
Data source proxy latency |
grafana_alerting_rule_evaluations_total |
Alert evaluation throughput |
grafana_alerting_rule_evaluation_failures_total |
Alert evaluation errors |
grafana_alerting_rule_evaluation_duration_seconds |
Evaluation latency |
grafana_alerting_scheduler_behind_seconds |
Scheduler lag (overloaded evaluator) |
grafana_stat_totals_dashboard, grafana_stat_total_users, grafana_stat_active_users |
Inventory and usage |
grafana_rendering_request_duration_milliseconds |
Image rendering latency |
grafana_unified_storage_migration_status |
Unified storage migration progress (13.0+) |
grafana_build_info |
Running version |
Source: pkg/infra/metrics/metrics.go and pkg/services/ngalert/metrics.
Helm Charts
| Component |
Chart |
Repository (2026) |
| Grafana |
grafana |
grafana-community/helm-charts (moved from grafana/helm-charts; updates only there after 2026-01-30) |
| Loki (OSS) |
loki |
grafana-community/helm-charts since 2026-03-16 (chart in grafana/loki now GEL-only) |
| Tempo |
tempo, tempo-distributed |
grafana-community/helm-charts |
| Mimir |
mimir-distributed |
grafana repo (https://grafana.github.io/helm-charts) |
| Alloy |
alloy |
grafana repo |
| Kubernetes Monitoring |
k8s-monitoring |
grafana repo |
loki-stack |
— |
Deprecated |
Chart versions and backend chart details are tracked in the LGTM Helm chart table. Typical production replica guidance: Grafana 2+ behind a load balancer with an external PostgreSQL/MySQL; Alloy as a DaemonSet; backend sizing in the LGTM Stack topic.
Deprecations and Removals
| Change |
Version / date |
| Relicensed Apache-2.0 → AGPL-3.0 |
Grafana 8.0, April 2021 |
| Legacy (dashboard) alerting removed |
11.0 |
| API keys auto-migrated to service accounts |
11.6.0 (2025-03-25) |
| AngularJS support removed |
12.0.0 (2025-05-05) |
viewers_can_edit, editors_can_admin settings removed |
12.0 |
| API key endpoints and API-key authentication removed |
12.1.0 (2025-07-23) |
grafana/grafana-oss image no longer updated |
12.4.0 |
| Grafana Agent (Static, Flow, Operator) end of life |
2025-11-01 |
| Grafana OnCall OSS: maintenance mode / archived |
2025-03-11 / 2026-03-24 (use Grafana Cloud IRM) |
grafana-cli and grafana-server binaries removed |
13.0 |
| Image Renderer as a plugin removed; JWT render auth default |
13.0 |
| Numeric-ID data source APIs disabled by default |
13.0 |
Legacy /api endpoints deprecated (not disabled) |
13.0 |
| Passwordless (magic link) auth removed |
13.0 |
| Legacy SQL tables for dashboards/folders deprecated (unified storage) |
13.0 |
grafanactl archived in favour of gcx |
2026-06-01 |
| Scripted dashboards deprecated and disabled by default |
13.2 |
Security Advisories of Note
| Advisory |
Affected |
Fixed |
Notes |
| CVE-2025-41115 (CVSS 10.0) |
Enterprise 12.0.0–12.2.1 with SCIM (enableSCIM + user_sync_enabled) |
12.3.0, 12.2.1+security-01, 12.1.3+security-01, 12.0.6+security-01 |
Numeric SCIM externalId could map onto internal user IDs, enabling impersonation (Grafana blog) |
| 13.0.0 withdrawn |
Self-managed 12.x with Git Sync flags |
13.0.1 (2026-04-17) |
Data-loss migration bug, not a CVE; restore from backup before upgrading |
Routine +security-NN releases |
All supported lines |
e.g. 13.0.1+security-01, 12.4.3+security-02 (2026-05-12) |
Track the CHANGELOG "Security" sections |
Hardening Checklist
| Area |
Setting |
Recommendation |
| Cookies |
cookie_secure = true |
HTTPS-only cookies |
| Cookies |
cookie_samesite = lax (or strict) |
CSRF protection; none only for cross-site embedding |
| CSP |
content_security_policy = true |
Mitigate XSS; review the template |
| HSTS |
strict_transport_security = true |
When served over HTTPS |
| Anonymous |
[auth.anonymous] enabled = false |
Enable only for a dedicated org |
| Sign-up |
[users] allow_sign_up = false |
Default; keep it |
| Passwords |
[auth.basic] password_policy = true or disable basic auth |
Prefer SSO |
| Embedding |
allow_embedding = false |
Enable only if iframes are required |
| Auth proxy |
enable_login_token = true + restrict network path |
Only the proxy may reach Grafana |
| Admin |
Change admin_password; set a unique secret_key |
Before first production start |
| TLS |
protocol = https or TLS at the proxy |
All traffic |
| Rendering |
Non-default renderer_token |
Required on 13.0+ |
| Plugins |
Avoid allow_loading_unsigned_plugins |
Allow-list specific IDs only |
| Audit |
[auditing] enabled = true |
Enterprise |
| Secrets |
Vault / secrets keepers, env vars |
Never commit secrets in grafana.ini |
| Outbound |
Request security / data_source_proxy_whitelist |
Mitigate SSRF (Enterprise request security) |
Grafana is rarely the bottleneck; query latency is dominated by the data source. These are community and SRE rules of thumb, not official limits.
| Metric |
Guideline |
Source |
| Panels per dashboard |
No hard limit; ~25–30 before browsers slow down |
Grafana best practices / community |
| Recommended panel count |
8–12 (overview), 15–20 (detailed) |
Community |
| Data points per panel |
Rendering degrades above ~10k points; cap with Max data points |
Grafana docs |
| Dashboard load target |
< 3 s at p95 |
SRE practice |
| Refresh interval vs load |
30 panels at 10 s refresh ≈ 6x the load of a 1 min refresh |
Install docs sizing notes |
| Query type |
Healthy p99 |
Investigate above |
| Simple PromQL (1 series) |
< 200 ms |
500 ms |
| Moderate PromQL (10–50 series) |
< 1 s |
2 s |
| Complex PromQL (100+ series, range) |
< 5 s |
10 s |
| LogQL (label-filtered) |
< 2 s |
5 s |
| LogQL (full scan, large window) |
< 30 s |
60 s |
| TraceQL (by trace ID) |
< 500 ms |
2 s |
| TraceQL (attribute search) |
< 10 s |
30 s |
For backend throughput and cost figures (Mimir, Loki, Tempo, Pyroscope) see the LGTM scale and performance figures.
Sources