Skip to main content
The Prometheus connector works with Prometheus and with anything that answers the same queries: Thanos Query, Grafana Mimir, Cortex and VictoriaMetrics.

​
Tools

​
Safety

  • Read-only. PromQL cannot write, and the connector only calls the query, alert, target and label endpoints. The admin endpoints (/api/v1/admin/tsdb/*) are never called.
  • Bounded range queries. The step defaults to about 500 points per series and is raised automatically so no series has more than 11,000 points. Results stop at 500 series (up to 5,000 with max_rows) and 1,000 points per series (max_points, keeping the most recent).
  • Limits on every call. 15 s timeout by default (up to 55 s with timeout_seconds), passed to Prometheus as the query timeout too. A cut result has truncated: true.
  • No redirects, no private hosts. A direct connection only reaches public addresses, is pinned to the address that was checked, and never follows a redirect.
  • No secrets in results. The bearer token or password is removed from every error message.

​
Put Prometheus behind authentication

Prometheus has no users of its own, so anything that can reach it can query it. Pick one of:
  • An authenticating reverse proxy in front of Prometheus (nginx, Caddy, oauth2-proxy), or Prometheus’ own --web.config.file with basic_auth_users. Store the username and password (or the bearer token) on the connection.
  • An SSH bastion or the data-plane agent, keeping Prometheus on a private address.
  • A managed service’s own credentials: Grafana Cloud Prometheus (the instance ID as username, a Cloud access policy token with metrics:read as password), or Mimir behind your gateway with a tenant ID.
Test Connection warns when a public server answers without authentication.

​
Connect

Open Prometheus in the dashboard’s tool catalog and click Connect, or let the agent call store_credential. Fill in the base URL (without /api/v1) and the authentication. For Mimir, Cortex or a multi-tenant setup, set Tenant ID; it is sent as X-Scope-OrgID.
A Prometheus behind an authenticating proxy, or a managed service, connects directly. Allow Danube’s egress addresses in the firewall: see Connect your production database safely. For a self-signed certificate, paste the CA bundle into CA certificate.
Run Test Connection after saving. It tells you which of these failed: the credentials (auth_required), the network (connection_error, destination_blocked) or TLS (tls_error).

​
Example prompts

  • “Which alerts are firing, and since when?”
  • “Which scrape targets are down, and what error do they report?”
  • “Chart p99 latency for the api job over the last 6 hours and tell me when it crossed 500 ms.”
  • “Which pods used the most memory in the last hour?”
  • “Find the metric that counts HTTP requests for the checkout service.”