grafana-lens

用于数据可视化、监控、警报、安全和 SRE 调查的 Grafana 工具。使用grafana_query、grafana_query_logs、grafana_query_traces、grafana_create_dashboard、grafana_update_dashboard、grafana_create_alert、grafana_share_dashboard、grafana_annotate、grafana_explore_datasources、grafana_list_metrics、grafana_search、grafana_get_dashboard、 grafana_check_alerts、grafana_push_metrics、grafana_explain_metric、grafana_security_check 和 grafana_investigate。当询问指标、仪表板、监控、警报、成本、令牌使用、数据可视化、PromQL、Prometheus、LogQL、Loki、日志查询、错误日志、日志搜索、TraceQL、Tempo、跟踪、分布式跟踪、跨度搜索、查找慢速跟踪、调试会话跟踪、注释、部署、共享图表、调查警报通知、将自定义数据（日历、git、健身、财务）推送到 Grafana 进行可视化、推送历史数据、回填指标时触发，用时间戳记录过去的数据，修改仪表板，添加面板，删除面板，更改仪表板设置，更新仪表板时间范围，解释指标，指标趋势，这个指标是什么，它是如何变化的，这个指标正常吗，为什么我的账单激增，成本可见性，安全监控，安全检查，安全审计，我是否受到攻击，我的代理是否受到损害，可疑活动，威胁检测，提示注入检测，设置安全警报，调查，调试，分类，根本原因，出了什么问题，为什么X被破坏，异常检测、RED 方法、USE 方法、警报疲劳、事后分析、事件总结。

## 概述（中文）

用于数据可视化、监控、警报、安全和 SRE 调查的 Grafana 工具。使用grafana_query、grafana_query_logs、grafana_query_traces、grafana_create_dashboard、grafana_update_dashboard、grafana_create_alert、grafana_share_dashboard、grafana_annotate、grafana_explore_datasources、grafana_list_metrics、grafana_search、grafana_get_dashboard、 grafana_check_alerts、grafana_push_metrics、grafana_explain_metric、grafana_security_check 和 grafana_investigate。当询问指标、仪表板、监控、警报、成本、令牌使用、数据可视化、PromQL、Prometheus、LogQL、Loki、日志查询、错误日志、日志搜索、TraceQL、Tempo、跟踪、分布式跟踪、跨度搜索、查找慢速跟踪、调试会话跟踪、注释、部署、共享图表、调查警报通知、将自定义数据（日历、git、健身、财务）推送到 Grafana 进行可视化、推送历史数据、回填指标时触发，用时间戳记录过去的数据，修改仪表板，添加面板，删除面板，更改仪表板设置，更新仪表板时间范围，解释指标，指标趋势，这个指标是什么，它是如何变化的，这个指标正常吗，为什么我的账单激增，成本可见性，安全监控，安全检查，安全审计，我是否受到攻击，我的代理是否受到损害，可疑活动，威胁检测，提示注入检测，设置安全警报，调查，调试，分类，根本原因，出了什么问题，为什么X被破坏，异常检测、RED 方法、USE 方法、警报疲劳、事后分析、事件总结。

## 原文

# Grafana Lens

You have full native Grafana access — query data, create dashboards, set alerts, receive alert notifications, annotate events, explore datasources, push custom data, and deliver visualizations inline. Works with ANY data in Grafana, not just agent metrics.

## Musts

- **Always call `grafana_explore_datasources` first** when you need a datasource UID — never guess UIDs
- **Always call `grafana_search` before creating a dashboard** — avoid duplicates
- **Always call `grafana_get_dashboard` before `grafana_share_dashboard`** — you need exact panel IDs
- **Always call `grafana_get_dashboard` before `grafana_update_dashboard`** — you need panel IDs and current structure
- **Prefer `grafana_query` for direct answers** over creating dashboards — "what's my cost?" needs a number, not a URL
- **Prefer `grafana_query` over `grafana_create_dashboard` + `grafana_share_dashboard`** for simple data questions — a number is faster than a chart
- **Use `grafana_query_logs` for log searches** — LogQL for logs, PromQL for metrics, TraceQL for traces. Never use `grafana_query` for Loki datasources
- **Use `grafana_query_traces` for trace searches** — TraceQL for traces, PromQL for metrics, LogQL for logs. Never use `grafana_query` or `grafana_query_logs` for Tempo datasources
- **All tools work with ANY Prometheus datasource** — not just `openclaw_lens_*` metrics
- **When you see "GRAFANA ALERTS" in prompt context**, investigate immediately with `grafana_check_alerts` — use the `suggestedInvestigation` field to go directly to querying (it provides the tool, query, and datasource)
- **Run `grafana_check_alerts` with action `setup` once** before alert notifications can reach the agent — this creates the webhook contact point
- **Push data before querying or dashboarding it** — data is pushed via OTLP and available immediately
- **Prefer `grafana_explain_metric` for "what is this metric?" questions** over manual `grafana_query` — it returns current value, trend, stats, and metadata in one call
- **Use `queryNames` from push response for PromQL queries** — don't guess metric names (counters get `_total` suffix)
- **Use `openclaw_ext_` prefix for custom metrics** — `grafana_push_metrics` auto-prepends it if missing
- **Follow statistics-first discipline for log investigation** — always run count/rate LogQL before reading individual entries. Use `grafana_query_logs` with metric-over-logs queries (`count_over_time`, `rate`, `topk`) before switching to raw log entries
- **Silence alerts during investigation** — use `grafana_check_alerts` with action `silence` to prevent repeat notifications while investigating
- **Use `list_rules` for complete alert health** — `grafana_check_alerts` with action `list_rules` returns all rules with live eval state (normal/firing/pending/nodata/error), health, and lastEvaluation — no need to cross-reference with `list` action
- **Use `dashboardUid` + `panelId` to re-run panel queries** — don't manually extract PromQL/LogQL from `get_dashboard` output. Both `grafana_query` and `grafana_query_logs` accept these params to auto-resolve the panel's query expression and datasource. The tool handles template variable replacement and datasource routing automatically
- **Confirm with user before deleting dashboards or alert rules** — `grafana_update_dashboard` with operation `delete` and `grafana_check_alerts` with action `delete_rule` are permanent and cannot be undone

## Quick Decision Tree

- "What is [metric]?" / "Why did it spike?" → `grafana_explain_metric`
- "What's the current value of X?" / complex PromQL → `grafana_query`
- "Find error logs" / "Search logs for..." → `grafana_query_logs`
- "Find slow traces" / "Show trace for session X" / "Debug distributed spans" → `grafana_query_traces`
- "Debug this session" / "Why did it fail?" / "What went wrong?" → `grafana_query_traces` (search error/slow) → `grafana_query_traces` (get → follow `correlationHint`) → `grafana_query_logs` → `grafana_query` → `grafana_annotate`
- "Show me a chart" / "Visualize..." → `grafana_search` → `grafana_get_dashboard` → `grafana_share_dashboard`
- "Create a dashboard for..." → `grafana_search` (check duplicates) → `grafana_create_dashboard`
- "Add a panel to my dashboard" → `grafana_get_dashboard` → `grafana_update_dashboard`
- "Delete this dashboard" → `grafana_update_dashboard` with operation `delete` (confirm with user first)
- "Alert me when..." → `grafana_check_alerts` (setup) → `grafana_create_alert`
- "List my alert rules" / "What alerts do I have?" → `grafana_check_alerts` with action `list_rules`
- "Delete alert rule X" → `grafana_check_alerts` with action `list_rules` → `delete_rule` with `ruleUid`
- "Track my [custom data]" / "Record my [past data]" → `grafana_push_metrics` (with optional `timestamp` for historical data, auto-registers, returns `queryNames`) → `grafana_query` with `queryNames`
- "What data sources do I have?" → `grafana_explore_datasources`
- "What metrics are available?" → `grafana_list_metrics`
- "Set up monitoring" / "Monitor my agent" / "What dashboards should I have?" → `grafana_search` (check existing) → `grafana_create_dashboard` with `llm-command-center` → follow `suggestedNext` chain through remaining templates
- "GenAI observability" / "OTel gen_ai metrics" / "Standard AI monitoring" → `grafana_create_dashboard` with `genai-observability` template
- "What happened in session X?" / "Debug this session" → `grafana_create_dashboard` with `session-explorer` template → paste session ID
- "Show me LLM traces" / "Show agent logs" → `grafana_create_dashboard` with `llm-command-center` template (Loki + Tempo)
- "How much am I spending?" / "Cost analysis" → `grafana_create_dashboard` with `cost-intelligence` template
- "Which tools are slow?" / "Tool errors" → `grafana_create_dashboard` with `tool-performance` template
- "Queue health" / "Webhook issues" / "Stuck sessions" → `grafana_create_dashboard` with `sre-operations` template
- "System health check" / "Status report" / "Review all dashboards" → `grafana_explore_datasources` → `grafana_check_alerts` (list + list_rules) → `grafana_search` → `grafana_get_dashboard` (audit=true for each) → summarize
- "Audit my dashboard" / "Which panels are broken?" → `grafana_get_dashboard` (audit=true) → review `auditSummary` + per-panel `health`
- "Am I being attacked?" / "Security check" / "Security status" → `grafana_security_check`
- "Set up security monitoring" → `grafana_check_alerts` (setup) → `grafana_create_dashboard` (`security-overview`) → `grafana_create_alert` (webhook error burst, cost spike, tool loops, injection signals)
- "Investigate security alert" → `grafana_security_check` → `grafana_query_logs` (correlate) → `grafana_annotate` (mark investigation) → `grafana_check_alerts` (silence)
- "Investigate this alert" / "Why is X broken?" / "Debug this issue" / "Triage" / "Root cause" → `grafana_investigate` (multi-signal triage) → follow `suggestedHypotheses.testWith` for deep-dives
- "Is this metric normal?" / "Is there an anomaly?" → `grafana_explain_metric` (returns `anomaly` z-score + `seasonality` vs 1d/7d ago for 24h period)
- "RED analysis" / "What's the e