Custom Dashboards

A dashboard belongs to an organization and holds a list of panels. Each panel carries its own layout (position and size on the grid) and its own configuration (what it queries and how it renders). Editing is inline: click Edit, drag panels to rearrange them, drag the bottom-right corner to resize, use the gear icon to configure, then Save. Nothing is written until you save, so Cancel always restores the board.

The number of custom dashboards per organization is governed by the dashboards.max_custom capability, which is unlimited on self-hosted installs unless you configure an entitlement. See Usage & Metering.

Fifteen panel types are available, covering every LogTide vertical. Panels that scope their query to a lookback window are marked windowed; those are the ones the time range controls in the next section apply to.

Logs

Traces and metrics

Percentiles are computed from raw spans on every storage engine, not from approximations, so the numbers match what the Traces view reports. Metric panels read OTLP metrics ingested through the OpenTelemetry endpoint.

Security, uptime and overview

Every windowed panel picks its lookback from the same list, so a board never mixes incompatible sets of options:

15m   1h   6h   12h   24h   48h   3d   7d   14d   30d

In the panel editor the control is labelled Time range and spells the values out ("Last 48 hours"). The stored configuration keeps the short form, which is what you see in a YAML export.

Retiming a whole board

The clock control in the dashboard toolbar overrides the time range of every windowed panel at once, which is what you usually want during an incident review: same board, different window. It is a view-level control:

• Panel configurations and the saved dashboard are never modified.
• Panels without a window (single stat, live stream, alert and monitor status) are left alone, and so are log tables in live mode.
• Choosing Panel defaults hands every panel back its own configured range.
• The override is not persisted, so a shared dashboard always opens the way its author set it up.

Bucket sizes

Time-based charts choose a bucket size to match the window, so a one-hour view is not drawn with the same granularity as a month:

Empty buckets are filled with zeros rather than skipped, so a quiet period reads as quiet instead of disappearing from the line, and axis labels switch to dates once the window spans more than a couple of days.

Metadata columns and dimensions

The log table's extra columns and the Top N table's metadata dimension both address a metadata field by path, using the same rules as Log Search: an exact key wins over a dotted path, so a field literally named user.id is matched before the nested user → id lookup is attempted.

status_code          # flat key
user.id              # exact key "user.id", else nested user -> id
geo_country          # flat key written by the GeoIP pipeline step

A log table accepts up to ten metadata columns alongside the built-in time, level, service and message columns. In the Top N table, percentages are computed against all logs matching the panel's filters, so on a project where only some logs carry the key, the share reflects reality instead of being inflated.

The geo map plots log volume on a world map. It reads geographic metadata that a GeoIP pipeline step writes onto your logs, so the panel needs that step configured before it has anything to draw.

Add a GeoIP step to a parsing pipeline for the project, pointing it at the metadata field that holds the client IP and choosing an output target (geo by default). The step writes a nested object plus flat keys derived from the target name:

{
  "client_ip": "203.0.113.10",
  "geo": { "country": "Italy", "countryCode": "IT", "city": "Milan" },
  "geo_country": "Italy",
  "geo_country_code": "IT",
  "geo_city": "Milan",
  "geo_place": "45.46,9.19|Milan, Italy"
}

In the panel configuration, Geo field prefix must match the step's target (geo unless you changed it). Two modes are available:

• By country reads {prefix}_country_code and places one bubble per country, sized by volume.
• By location reads {prefix}_place and places bubbles at rounded coordinates, which is more precise but produces more points; the row limit caps how many are drawn.

The map needs no tile server and makes no external requests: the world outline ships with the frontend, so the panel works on air-gapped installs and follows your light or dark theme. Values without usable coordinates are counted and reported under the map rather than silently dropped.

Any dashboard can be exported to YAML and imported into another organization or another LogTide install, which makes boards reviewable in a pull request and reproducible across environments. The export contains the board's name, description, schema version and panels:

name: Edge Traffic
description: Public traffic overview
schema_version: 1
panels:
  - id: panel-1
    layout: { x: 0, y: 0, w: 8, h: 4 }
    config:
      type: geo_map
      title: Traffic Map
      source: logs
      projectId: null
      interval: 24h
      mode: country
      limit: 100
      fieldPrefix: geo
      levels: []
      service: null
      hostname: null
  - id: panel-2
    layout: { x: 8, y: 0, w: 4, h: 4 }
    config:
      type: top_n_table
      title: Top Countries
      source: logs
      dimension: metadata
      metadataField: geo_country
      limit: 10
      projectId: null
      interval: 24h
      showLastSeen: true

Import validates every panel against the same rules the editor enforces, so a malformed board is rejected with an explanation instead of being half-created. Project references are checked against the importing organization: a panel pointing at a project id from somewhere else is refused rather than silently returning another tenant's data.

Dashboards are managed through the authenticated API under /api/v1/custom-dashboards. All endpoints require a session and take the organization id.

The batch data endpoint is what the UI calls on every refresh. Restrict it to specific panels with panelIds, and apply the board-wide time override with timeRange:

POST /api/v1/custom-dashboards/{dashboardId}/panels/data
Content-Type: application/json

{
  "organizationId": "…",
  "panelIds": ["panel-1", "panel-2"],
  "timeRange": "48h"
}

Panels are fetched independently, so one failing panel returns an error in its own entry while the rest still return data. Omit panelIds to fetch the whole board, and omit timeRange to use each panel's configured window.