Prometheus integration¶
Connect DXDT to your Prometheus HTTP API for read-only metrics, targets, alerts, and recording/alerting rules. DXDT runs instant and range PromQL queries and inspects scrape-target health to support incident diagnosis and capacity analysis. No data is ever written back to Prometheus.
| Setup time | ~5 minutes |
| Difficulty | Easy |
Access required: Network reachability to the Prometheus HTTP API endpoint. Authentication is optional; if your Prometheus sits behind a proxy, you will need either basic-auth credentials or a bearer token accepted by that proxy.
Prerequisites¶
- The base URL of your Prometheus server (or the fronting proxy/ingress), reachable from DXDT.
- If, and only if, the endpoint is authenticated: either a username/password pair (basic auth) or a bearer token.
Setup¶
1. Locate your Prometheus base URL¶
Identify the base URL of the Prometheus HTTP API, for example https://prometheus.acme.internal or https://prometheus.acme.internal:9090. Do not include a trailing /api/v1 path — DXDT appends the API path itself. This becomes the prometheus_url value.
Note
Many internal Prometheus deployments are unauthenticated. If yours is, you can skip the auth steps entirely.
2. Decide whether authentication is needed¶
If your Prometheus is reachable without credentials, leave all auth fields blank. If it is fronted by a reverse proxy (nginx, OAuth2 proxy, etc.), choose one method: HTTP basic auth (a username and password) or a bearer token. DXDT sends only read requests regardless of the method chosen.
- For basic auth: obtain the least-privileged read-only username and password accepted by the proxy.
- For bearer auth: obtain a token scoped to read-only access to the Prometheus API.
3. Enter the configuration in DXDT¶
In the DXDT marketplace, open the Prometheus plugin and paste your prometheus_url. Fill in username + password for basic auth, OR bearer_token for bearer auth, OR leave all three blank for an unauthenticated endpoint. Save to install.
Configuration fields¶
| Field | Where to find it |
|---|---|
Prometheus URL (prometheus_url) |
Base URL of the Prometheus HTTP API, e.g. https://prometheus.acme.internal (no trailing /api/v1). Required. |
Username (username) |
Optional — basic-auth username, only if Prometheus sits behind an auth proxy. Use with password; leave blank otherwise. |
Password (password) |
Optional — basic-auth password paired with username. Leave blank for unauthenticated endpoints. |
Bearer Token (bearer_token) |
Optional — bearer token for a proxied/authenticated Prometheus. Use instead of username/password. Leave blank if no auth is required. |
Verify the connection¶
After saving, DXDT runs a ping against the Prometheus API. A successful result confirms connectivity; you can then ask DXDT to list scrape targets or run a simple query such as up to confirm data is flowing.
Security
DXDT's Prometheus integration is strictly read-only — it issues only queries and metadata/target/alert/rule reads, never writes or admin calls. Prefer an unauthenticated internal endpoint or a least-privilege read-only credential on the fronting proxy. Never supply an admin or write-capable token.
Troubleshooting¶
Connection refused or timeout on save
prometheus_url is unreachable from DXDT, or a firewall/security group blocks the port. Confirm the URL resolves and the port (commonly 9090) is open to DXDT. Allow-list DXDT's egress if the endpoint is private.
HTTP 401 or 403 returned
The endpoint is behind an auth proxy but no credentials (or the wrong ones) were supplied. Add username + password, or a valid bearer_token. Verify the credential is accepted by the proxy, not just by Prometheus.
404 on queries but ping succeeds
prometheus_url includes an extra path such as /api/v1 or points at a Grafana datasource proxy. Set prometheus_url to the bare base URL of the Prometheus server itself.
Vendor documentation: https://prometheus.io/docs/prometheus/latest/querying/api/