Grafana OSS JSON Server Log

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/application-grafana-server-json/generator.yml \
  --id grafana \
  --live-mode true

Event Types

Realism Features

• 80 browser users, four of them organization admins, sign in with the login form, open dashboards and run data source queries, occasionally mistype passwords, give up or hit the brute-force lockout (the sixth failure within five minutes gets the lockout text), and sign out. About 9% of POST /login requests fail: about one admin login in six starts with one or more failures, against one in twenty-five for other users. A session lasts about 40 minutes (median, up to eight hours); admins work in sessions of about 15 minutes and sign in about 11 to 17 times a day. About 30% of sessions end with an explicit logout.
• Admins list, create and delete service account tokens: about 15 tokens a day, mostly for the service account each admin looks after, each deleted later by an admin signed in at that time, usually within an hour (a token created late in the day may stay until the next morning). Four service accounts call the API with bearer tokens at a flat 0.05 lines/s, day and night.
• Browser users follow a working-day curve in UTC: about 0.07 lines/s at night, rising from 05:00, peaking at about 0.95 lines/s near 10:40 and back to the night level after 18:00, with about 15 distinct accounts active an hour at night and about 70 at the peak. Weekends look like weekdays. Requests of a session are seconds to minutes apart, so the burst of panel queries a real dashboard load makes within one second is not reproduced; the two lines of one request are microseconds apart. Request mix, session lengths, sign-in frequency, failure rates, token activity and data request durations and sizes are synthetic.
• event.original is compact JSON with alphabetically sorted keys, an RFC 3339 t with up to nine fractional digits (trailing zeros dropped), and level, logger and msg on every line; four real 9.5.0/9.5.1 lines in Grafana issue 67582 confirm the layout and the Request Completed field set. Request Completed fields follow the 9.5.1 request logging middleware: Go duration text, whole-millisecond time_ms and the registered route pattern in handler, whose trailing-slash forms for /api/search and /api/user are inferred from route registration. Login, logout and token-deletion body sizes are exact.
• Ordinary traffic in both modes contains failed logins by every admin, runs of three or more failures from one address within 10 minutes (about 4-5 a day), lockouts (about one a day), three or more failures followed by a successful login (about 2 a day) and token creations within ten minutes of a login (about 6 a day). The failed-login line names no username, so failures of different accounts from one address look the same.
• Grafana defaults to text logs and router_logging = false; with router logging off only the 302 and 401 request lines and the Invalid username or password, Successful Login and Successful Logout messages remain. Not modeled: static files, /api/health probes, live websocket traffic, 304, 403, 404 and 5xx responses, expired-session and API-key authentication, LDAP/OAuth/JWT logins, alerting and provisioning logs, and tracing (traceID stays empty). The clock is UTC; ECS fields repeat values from the native line only.

Sample Output

{
  "@timestamp": "2026-09-01T12:45:46.243362+00:00",
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "action": "invalid-username-or-password",
    "category": [
      "authentication"
    ],
    "dataset": "grafana.server",
    "kind": "event",
    "module": "grafana",
    "original": "{\"error\":\"invalid username or password\",\"level\":\"error\",\"logger\":\"context\",\"msg\":\"Invalid username or password\",\"orgId\":0,\"remote_addr\":\"10.40.2.21\",\"t\":\"2026-09-01T12:45:46.243362334Z\",\"traceID\":\"\",\"uname\":\"\",\"userId\":0}",
    "outcome": "failure",
    "reason": "invalid username or password",
    "type": [
      "info"
    ]
  },
  "grafana": {
    "log": {
      "error": "invalid username or password",
      "level": "error",
      "logger": "context",
      "msg": "Invalid username or password",
      "orgId": 0,
      "remote_addr": "10.40.2.21",
      "t": "2026-09-01T12:45:46.243362334Z",
      "traceID": "",
      "uname": "",
      "userId": 0
    }
  },
  "host": {
    "name": "grafana-01"
  },
  "log": {
    "level": "error",
    "logger": "context"
  },
  "message": "Invalid username or password",
  "related": {
    "hosts": [
      "grafana-01"
    ],
    "ip": [
      "10.40.2.21"
    ]
  },
  "service": {
    "name": "grafana",
    "type": "grafana",
    "version": "9.5.1"
  },
  "source": {
    "ip": "10.40.2.21"
  }
}

Parameters