##################### Grafana Configuration Defaults #####################

#

# Do not modify this file in grafana installs

#

# possible values : production, development

app_mode = production

# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty

instance_name = ${HOSTNAME}

#################################### Paths ###############################

[paths]

# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used)

data = /var/lib/grafana

# Temporary files in `data` directory older than given duration will be removed

temp_data_lifetime = 24h

# Directory where grafana can store logs

logs = /var/log/grafana

# Directory where grafana will automatically scan and look for plugins

plugins = /var/lib/grafana/plugins

# folder that contains provisioning config files that grafana will apply on startup and while running.

provisioning = /etc/grafana/provisioning

#################################### Server ##############################

[server]

# Protocol (http, https, h2, socket)

protocol = http

# The ip address to bind to, empty will bind to all interfaces

http_addr =

# The http port to use

http_port = 3000

# The public facing domain name used to access grafana from a browser

domain = localhost

# Redirect to correct domain if host header does not match domain

# Prevents DNS rebinding attacks

enforce_domain = false

# The full public facing url

root_url = %(protocol)s://%(domain)s:%(http_port)s/

# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.

serve_from_sub_path = false

# Log web requests

router_logging = false

# the path relative working path

static_root_path = public

# enable gzip

enable_gzip = false

# https certs & key file

cert_file =

cert_key =

# Unix socket path

socket = /tmp/grafana.sock

# CDN Url

cdn_url =

# Sets the maximum time in minutes before timing out read of an incoming request and closing idle connections. 

# `0` means there is no timeout for reading the request.

read_timeout = 0

#################################### Database ############################

[database]

# You can configure the database connection by specifying type, host, name, user and password

# as separate properties or as on string using the url property.

# Either "mysql", "postgres" or "sqlite3", it's your choice

type = sqlite3

host = 127.0.0.1:3306

name = grafana

user = root

# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""

password =

# Use either URL or the previous fields to configure the database

# Example: mysql://user:secret@host:port/database

url =

# Max idle conn setting default is 2

max_idle_conn = 2

# Max conn setting default is 0 (mean not set)

max_open_conn =

# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours)

conn_max_lifetime = 14400

# Set to true to log the sql calls and execution times.

log_queries =

# For "postgres", use either "disable", "require" or "verify-full"

# For "mysql", use either "true", "false", or "skip-verify".

ssl_mode = disable

# Database drivers may support different transaction isolation levels.

# Currently, only "mysql" driver supports isolation levels.

# If the value is empty - driver's default isolation level is applied.

# For "mysql" use "READ-UNCOMMITTED", "READ-COMMITTED", "REPEATABLE-READ" or "SERIALIZABLE".

isolation_level =

ca_cert_path =

client_key_path =

client_cert_path =

server_cert_name =

# For "sqlite3" only, path relative to data_path setting

path = grafana.db

# For "sqlite3" only. cache mode setting used for connecting to the database

cache_mode = private

#################################### Cache server #############################

[remote_cache]

# Either "redis", "memcached" or "database" default is "database"

type = database

# cache connectionstring options

# database: will use Grafana primary database.

# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'.

# memcache: 127.0.0.1:11211

connstr =

#################################### Data proxy ###########################

[dataproxy]

# This enables data proxy logging, default is false

logging = false

# How long the data proxy waits before timing out, default is 30 seconds.

# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set.

timeout = 30

# How many seconds the data proxy waits before sending a keepalive request.

keep_alive_seconds = 30

# How many seconds the data proxy waits for a successful TLS Handshake before timing out.

tls_handshake_timeout_seconds = 10

# How many seconds the data proxy will wait for a server's first response headers after

# fully writing the request headers if the request has an "Expect: 100-continue"

# header. A value of 0 will result in the body being sent immediately, without

# waiting for the server to approve.

expect_continue_timeout_seconds = 1

# The maximum number of idle connections that Grafana will keep alive.

max_idle_connections = 100

# How many seconds the data proxy keeps an idle connection open before timing out.

idle_conn_timeout_seconds = 90

# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request.

send_user_header = false

#################################### Analytics ###########################

[analytics]

# Server reporting, sends usage counters to stats.grafana.org every 24 hours.

# No ip addresses are being tracked, only simple counters to track

# running instances, dashboard and error counts. It is very helpful to us.

# Change this option to false to disable reporting.

reporting_enabled = false

# The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs

reporting_distributor = grafana-labs

# Set to false to disable all checks to https://grafana.com

# for new versions (grafana itself and plugins), check is used

# in some UI views to notify that grafana or plugin update exists

# This option does not cause any auto updates, nor send any information

# only a GET request to https://grafana.com to get latest versions

check_for_updates = false

# Google Analytics universal tracking code, only enabled if you specify an id here

google_analytics_ua_id =

# Google Tag Manager ID, only enabled if you specify an id here

google_tag_manager_id =

#################################### Security ############################

[security]

# disable creation of admin user on first start of grafana

disable_initial_admin_creation = false

# default admin user, created on startup

admin_user = admin

# default admin password, can be changed before first start of grafana, or in profile settings

admin_password = admin

# used for signing

secret_key = SW2YcwTIb9zpOOhoPsMm

# disable gravatar profile images

disable_gravatar = false

# data source proxy whitelist (ip_or_domain:port separated by spaces)

data_source_proxy_whitelist =

# disable protection against brute force login attempts

disable_brute_force_login_protection = false

# set to true if you host Grafana behind HTTPS. default is false.

cookie_secure = false

# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled"

cookie_samesite = lax

# set to true if you want to allow browsers to render Grafana in a <frame>, <iframe>, <embed> or <object>. default is false.

allow_embedding = false

# Set to true if you want to enable http strict transport security (HSTS) response header.

# This is only sent when HTTPS is enabled in this configuration.

# HSTS tells browsers that the site should only be accessed using HTTPS.

strict_transport_security = false

# Sets how long a browser should cache HSTS. Only applied if strict_transport_security is enabled.

strict_transport_security_max_age_seconds = 86400

# Set to true if to enable HSTS preloading option. Only applied if strict_transport_security is enabled.

strict_transport_security_preload = false

# Set to true if to enable the HSTS includeSubDomains option. Only applied if strict_transport_security is enabled.

strict_transport_security_subdomains = false

# Set to true to enable the X-Content-Type-Options response header.

# The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised

# in the Content-Type headers should not be changed and be followed.

x_content_type_options = true

# Set to true to enable the X-XSS-Protection header, which tells browsers to stop pages from loading

# when they detect reflected cross-site scripting (XSS) attacks.

x_xss_protection = true

# Enable adding the Content-Security-Policy header to your requests.

# CSP allows to control resources the user agent is allowed to load and helps prevent XSS attacks.

content_security_policy = false

# Set Content Security Policy template used when adding the Content-Security-Policy header to your requests.

# $NONCE in the template includes a random nonce.

content_security_policy_template = """script-src 'unsafe-eval' 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;base-uri 'self';connect-src 'self' grafana.com;manifest-src 'self';media-src 'none';form-action 'self';"""

#################################### Snapshots ###########################

[snapshots]

# snapshot sharing options

external_enabled = false

external_snapshot_url = https://snapshots-origin.raintank.io

external_snapshot_name = Publish to snapshot.raintank.io

# Set to true to enable this Grafana instance act as an external snapshot server and allow unauthenticated requests for

# creating and deleting snapshots.

public_mode = false

# remove expired snapshot

snapshot_remove_expired = true

#################################### Dashboards ##################

[dashboards]

# Number dashboard versions to keep (per dashboard). Default: 20, Minimum: 1

versions_to_keep = 20

# Minimum dashboard refresh interval. When set, this will restrict users to set the refresh interval of a dashboard lower than given interval. Per default this is 5 seconds.

# The interval string is a possibly signed sequence of decimal numbers, followed by a unit suffix (ms, s, m, h, d), e.g. 30s or 1m.

min_refresh_interval = 1s

# Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json"

default_home_dashboard_path =

################################### Data sources #########################

[datasources]

# Upper limit of data sources that Grafana will return. This limit is a temporary configuration and it will be deprecated when pagination will be introduced on the list data sources API.

datasource_limit = 5000

#################################### Users ###############################

[users]

# disable user signup / registration

allow_sign_up = false

# Allow non admin users to create organizations

allow_org_create = false

# Set to true to automatically assign new users to the default organization (id 1)

auto_assign_org = true

# Set this value to automatically add new users to the provided organization (if auto_assign_org above is set to true)

auto_assign_org_id = 1

# Default role new users will be automatically assigned (if auto_assign_org above is set to true)

auto_assign_org_role = Viewer

# Require email validation before sign up completes

verify_email_enabled = false

# Background text for the user field on the login page

login_hint = email or username

password_hint = password

# Default UI theme ("dark" or "light")

default_theme = dark

# Path to a custom home page. Users are only redirected to this if the default home dashboard is used. It should match a frontend route and contain a leading slash.

home_page =

# External user management

external_manage_link_url =

external_manage_link_name =

external_manage_info =

# Viewers can edit/inspect dashboard settings in the browser. But not save the dashboard.

viewers_can_edit = false

# Editors can administrate dashboard, folders and teams they create

editors_can_admin = false

# The duration in time a user invitation remains valid before expiring. This setting should be expressed as a duration. Examples: 6h (hours), 2d (days), 1w (week). Default is 24h (24 hours). The minimum supported duration is 15m (15 minutes).

user_invite_max_lifetime_duration = 24h

# Enter a comma-separated list of usernames to hide them in the Grafana UI. These users are shown to Grafana admins and to themselves.

hidden_users =

[auth]

# Login cookie name

login_cookie_name = grafana_session

# The maximum lifetime (duration) an authenticated user can be inactive before being required to login at next visit. Default is 7 days (7d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month). The lifetime resets at each successful token rotation (token_rotation_interval_minutes).

login_maximum_inactive_lifetime_duration =

# The maximum lifetime (duration) an authenticated user can be logged in since login time before being required to login. Default is 30 days (30d). This setting should be expressed as a duration, e.g. 5m (minutes), 6h (hours), 10d (days), 2w (weeks), 1M (month).

login_maximum_lifetime_duration =

# How often should auth tokens be rotated for authenticated users when being active. The default is each 10 minutes.

token_rotation_interval_minutes = 10

# Set to true to disable (hide) the login form, useful if you use OAuth

disable_login_form = false

# Set to true to disable the signout link in the side menu. useful if you use auth.proxy

disable_signout_menu = false

# URL to redirect the user to after sign out

signout_redirect_url =

# Set to true to attempt login with OAuth automatically, skipping the login screen.

# This setting is ignored if multiple OAuth providers are configured.

oauth_auto_login = false

# OAuth state max age cookie duration in seconds. Defaults to 600 seconds.

oauth_state_cookie_max_age = 600

# limit of api_key seconds to live before expiration

api_key_max_seconds_to_live = -1

# Set to true to enable SigV4 authentication option for HTTP-based datasources

sigv4_auth_enabled = false

#################################### Anonymous Auth ######################

[auth.anonymous]

# enable anonymous access

enabled = false

# specify organization name that should be used for unauthenticated users

org_name = Main Org.

# specify role for unauthenticated users

org_role = Viewer

# mask the Grafana version number for unauthenticated users

hide_version = false

#################################### GitHub Auth #########################

[auth.github]

enabled = false

allow_sign_up = true

client_id = some_id

client_secret =

scopes = user:email,read:org

auth_url = https://github.com/login/oauth/authorize

token_url = https://github.com/login/oauth/access_token

api_url = https://api.github.com/user

allowed_domains =

team_ids =

allowed_organizations =

#################################### GitLab Auth #########################

[auth.gitlab]

enabled = false

allow_sign_up = true

client_id = some_id

client_secret =

scopes = api

auth_url = https://gitlab.com/oauth/authorize

token_url = https://gitlab.com/oauth/token

api_url = https://gitlab.com/api/v4

allowed_domains =

allowed_groups =

#################################### Google Auth #########################

[auth.google]

enabled = false

allow_sign_up = true

client_id = some_client_id

client_secret =

scopes = https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email

auth_url = https://accounts.google.com/o/oauth2/auth

token_url = https://accounts.google.com/o/oauth2/token

api_url = https://www.googleapis.com/oauth2/v1/userinfo

allowed_domains =

hosted_domain =

#################################### Grafana.com Auth ####################

# legacy key names (so they work in env variables)

[auth.grafananet]

enabled = false

allow_sign_up = true

client_id = some_id

client_secret =

scopes = user:email

allowed_organizations =

[auth.grafana_com]

enabled = false

allow_sign_up = true

client_id = some_id

client_secret =

scopes = user:email

allowed_organizations =

#################################### Azure AD OAuth #######################

[auth.azuread]

name = Azure AD

enabled = false

allow_sign_up = true

client_id = some_client_id

client_secret =

scopes = openid email profile

auth_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize

token_url = https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token

allowed_domains =

allowed_groups =

#################################### Okta OAuth #######################

[auth.okta]

name = Okta

enabled = false

allow_sign_up = true

client_id = some_id

client_secret =

scopes = openid profile email groups

auth_url = https://<tenant-id>.okta.com/oauth2/v1/authorize

token_url = https://<tenant-id>.okta.com/oauth2/v1/token

api_url = https://<tenant-id>.okta.com/oauth2/v1/userinfo

allowed_domains =

allowed_groups =

role_attribute_path =

#################################### Generic OAuth #######################

[auth.generic_oauth]

name = OAuth

enabled = false

allow_sign_up = true

client_id = some_id

client_secret =

scopes = user:email

email_attribute_name = email:primary

email_attribute_path =

login_attribute_path =

name_attribute_path =

role_attribute_path =

id_token_attribute_name =

auth_url =

token_url =

api_url =

allowed_domains =

team_ids =

allowed_organizations =

tls_skip_verify_insecure = false

tls_client_cert =

tls_client_key =

tls_client_ca =

#################################### Basic Auth ##########################

[auth.basic]

enabled = true

#################################### Auth Proxy ##########################

[auth.proxy]

enabled = false

header_name = X-WEBAUTH-USER

header_property = username

auto_sign_up = true

# Deprecated, use sync_ttl instead

ldap_sync_ttl = 60

sync_ttl = 60

whitelist =

headers =

enable_login_token = false

#################################### Auth LDAP ###########################

[auth.ldap]

enabled = false

config_file = /etc/grafana/ldap.toml

allow_sign_up = true

# LDAP background sync (Enterprise only)

# At 1 am every day

sync_cron = "0 0 1 * * *"

active_sync_enabled = true

#################################### AWS ###########################

[aws]

# Enter a comma-separated list of allowed AWS authentication providers. 

# Options are: default (AWS SDK Default), keys (Access && secret key), credentials (Credentials field), ec2_iam_role (EC2 IAM Role)

allowed_auth_providers = default,keys,credentials

# Allow AWS users to assume a role using temporary security credentials. 

# If true, assume role will be enabled for all AWS authentication providers that are specified in aws_auth_providers

assume_role_enabled = true

# Specify max no of pages to be returned by the ListMetricPages API

list_metrics_page_limit = 500

#################################### SMTP / Emailing #####################

[smtp]

enabled = false

host = localhost:25

user =

# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""

password =

cert_file =

key_file =

skip_verify = false

from_address = admin@grafana.localhost

from_name = Grafana

ehlo_identity =

startTLS_policy =

[emails]

welcome_email_on_sign_up = false

templates_pattern = emails/*.html

#################################### Logging ##########################

[log]

# Either "console", "file", "syslog". Default is console and file

# Use space to separate multiple modes, e.g. "console file"

mode = console file

# Either "debug", "info", "warn", "error", "critical", default is "info"

level = info

# optional settings to set different levels for specific loggers. Ex filters = sqlstore:debug

filters =

# For "console" mode only

[log.console]

level =

# log line format, valid options are text, console and json

format = console

# For "file" mode only

[log.file]

level =

# log line format, valid options are text, console and json

format = text

# This enables automated log rotate(switch of following options), default is true

log_rotate = true

# Max line number of single file, default is 1000000

max_lines = 1000000

# Max size shift of single file, default is 28 means 1 << 28, 256MB

max_size_shift = 28

# Segment log daily, default is true

daily_rotate = true

# Expired days of log file(delete after max days), default is 7

max_days = 7

[log.syslog]

level =

# log line format, valid options are text, console and json

format = text

# Syslog network type and address. This can be udp, tcp, or unix. If left blank, the default unix endpoints will be used.

network =

address =

# Syslog facility. user, daemon and local0 through local7 are valid.

facility =

# Syslog tag. By default, the process' argv[0] is used.

tag =

[log.frontend]

# Should Sentry javascript agent be initialized

enabled = false

# Sentry DSN if you want to send events to Sentry.

sentry_dsn =

# Custom HTTP endpoint to send events captured by the Sentry agent to. Default will log the events to stdout.

custom_endpoint = /log

# Rate of events to be reported between 0 (none) and 1 (all), float

sample_rate = 1.0

# Requests per second limit enforced per an extended period, for Grafana backend log ingestion endpoint (/log).

log_endpoint_requests_per_second_limit = 3

# Max requests accepted per short interval of time for Grafana backend log ingestion endpoint (/log)

log_endpoint_burst_limit = 15

#################################### Usage Quotas ########################

[quota]

enabled = false

#### set quotas to -1 to make unlimited. ####

# limit number of users per Org.

org_user = 10

# limit number of dashboards per Org.

org_dashboard = 100

# limit number of data_sources per Org.

org_data_source = 10

# limit number of api_keys per Org.

org_api_key = 10

# limit number of orgs a user can create.

user_org = 10

# Global limit of users.

global_user = -1

# global limit of orgs.

global_org = -1

# global limit of dashboards

global_dashboard = -1

# global limit of api_keys

global_api_key = -1

# global limit on number of logged in users.

global_session = -1

#################################### Alerting ############################

[alerting]

# Disable alerting engine & UI features

enabled = true

# Makes it possible to turn off alert rule execution but alerting UI is visible

execute_alerts = true

# Default setting for new alert rules. Defaults to categorize error and timeouts as alerting. (alerting, keep_state)

error_or_timeout = alerting

# Default setting for how Grafana handles nodata or null values in alerting. (alerting, no_data, keep_state, ok)

nodata_or_nullvalues = no_data

# Alert notifications can include images, but rendering many images at the same time can overload the server

# This limit will protect the server from render overloading and make sure notifications are sent out quickly

concurrent_render_limit = 5

# Default setting for alert calculation timeout. Default value is 30

evaluation_timeout_seconds = 30

# Default setting for alert notification timeout. Default value is 30

notification_timeout_seconds = 30

# Default setting for max attempts to sending alert notifications. Default value is 3

max_attempts = 3

# Makes it possible to enforce a minimal interval between evaluations, to reduce load on the backend

min_interval_seconds = 1

# Configures for how long alert annotations are stored. Default is 0, which keeps them forever.

# This setting should be expressed as an duration. Ex 6h (hours), 10d (days), 2w (weeks), 1M (month).

max_annotation_age =

# Configures max number of alert annotations that Grafana stores. Default value is 0, which keeps all alert annotations.

max_annotations_to_keep =

#################################### Annotations #########################

[annotations]

# Configures the batch size for the annotation clean-up job. This setting is used for dashboard, API, and alert annotations.

cleanupjob_batchsize = 100

[annotations.dashboard]

# Dashboard annotations means that annotations are associated with the dashboard they are created on.

# Configures how long dashboard annotations are stored. Default is 0, which keeps them forever.

# This setting should be expressed as a duration. Examples: 6h (hours), 10d (days), 2w (weeks), 1M (month).

max_age =

# Configures max number of dashboard annotations that Grafana stores. Default value is 0, which keeps all dashboard annotations.

max_annotations_to_keep =

[annotations.api]

# API annotations means that the annotations have been created using the API without any

# association with a dashboard.

# Configures how long Grafana stores API annotations. Default is 0, which keeps them forever.

# This setting should be expressed as a duration. Examples: 6h (hours), 10d (days), 2w (weeks), 1M (month).