Dashboards

Overview

OpenSearch Dashboards provides Kibana-style visualization for all Logrite log data. The Logrite installation includes pre-built dashboards for payment queries, database queries, external service calls, and exceptions.

Access

Environment	URL
Production	https://analytics.logrite.ai/pxe/
Local	http://localhost:5601

How the Logrite UI talks to OSD

The Logrite-UI does not call analytics.logrite.ai/pxe/* directly — OSD’s auth chain only accepts Basic auth (dashboards-svc) or an OSD interactive session cookie, and rejects Logrite Bearer JWTs with {"ok":false,"err":"Authentication Exception"}.

Instead the UI calls https://leapfrogapi.deployd.io/api/v1/dashboards/** (configured via VITE_DASHBOARD_PROXY_API). The backend’s OpenSearchDashboardsProxyController strips the inbound Authorization header, injects dashboards-svc Basic auth, and forwards to OSD. The same path covers /api/status, /api/saved_objects/*, /api/alerting/*, /api/anomaly_detectors/*, /api/notifications/*, /api/ism/* — any OSD plugin wrapper API.

When OSD then makes its server-side OS call as dashboards-svc, that user must have the relevant plugin perm in OS. dashboards-svc is mapped into logrite_app_role so it inherits the read-only plugin grant set; see security-plugin for the full list. Without the mapping, OSD silently wraps the OS 403 security_exception into 200 {"ok":false,"err":"…"}.

Pre-Built Dashboards

Overview Dashboards (Combined)

Dashboard	URL Path
Payment Query Performance Overview	/app/dashboards#/view/pq-overview-dashboard
External Service Call Performance Overview	/app/dashboards#/view/esc-overview-dashboard
Database Query Performance Overview	/app/dashboards#/view/db-overview-dashboard
Exception Monitoring Overview	/app/dashboards#/view/exc-overview-dashboard

Payment Query Threshold Dashboards

Dashboard	Threshold	URL Path
Payment Queries - Warning	> 500ms	/app/dashboards#/view/pq-warning-dashboard
Payment Queries - Slow	> 2000ms	/app/dashboards#/view/pq-slow-dashboard
Payment Queries - Critical	> 5000ms	/app/dashboards#/view/pq-critical-dashboard

External Service Threshold Dashboards

Dashboard	Threshold	URL Path
External Calls - Warning	> 500ms	/app/dashboards#/view/esc-warning-dashboard
External Calls - Slow	> 1000ms	/app/dashboards#/view/esc-slow-dashboard
External Calls - Critical	> 3000ms	/app/dashboards#/view/esc-critical-dashboard

Database Query Threshold Dashboards

Dashboard	Threshold	URL Path
DB Queries - Warning	> 50ms	/app/dashboards#/view/db-warning-dashboard
DB Queries - Slow	> 200ms	/app/dashboards#/view/db-slow-dashboard
DB Queries - Critical	> 500ms	/app/dashboards#/view/db-critical-dashboard

CTM (Worksoft) Dashboards

Dashboard	URL Path
CTM Test Results Overview	/app/dashboards#/view/ctm-test-overview-dashboard
CTM Error & Event Monitoring	/app/dashboards#/view/ctm-errors-dashboard

Workspace bundles: building and importing (2026-10-14)

Per-workspace dashboards are generated in MasterControl scripts/opensearch/:

File
osd_bundle.py	Shared Bundle helpers (index pattern, metric, terms pie/bar, volume over time, markdown, dashboard, saved search)
build-workspace-dashboards.py	The ws 3103 bundle; its output is byte-identical to the checked-in logrite-3103-dashboards.ndjson
build-worksoft-dashboards.py	Writes logrite-302-worksoft-dashboards.ndjson. --check-live [--env-file] first reads prod _mapping/field and exits 1 without writing if an index is missing, a field is unmapped, or a text field has no .keyword
import-via-proxy.py	--estate prod|dev --email E --password-file F [--workspace N] BUNDLE

Import only through the backend proxy. import-via-proxy.py logs in, switches workspace when needed, and writes every object in one POST /api/v1/dashboards/api/saved_objects/_bulk_create?overwrite=true, which records an ownership row per object; it then checks workspaceOwned:true with _find. An object imported straight into OSD has no ownership row and strict mode hides it.

Multipart import through the proxy is broken

A multipart _import through /api/v1/dashboards returns OSD 400 “Invalid multipart payload format”. The app’s own Import button sends the same form, so it is probably broken too. Use _bulk_create.

The ws 302 bundle (42 objects, ids ws302-*): 13 index patterns, 22 visualisations, 3 saved searches (“LDAP bind failures”, “Failed CTM executions”, “Results Exporter → PI 401”) and 4 dashboards:

Dashboard	Id	Reads
Worksoft Platform Health (now-48h)	ws302-platform-health	The 8 log-analytics-302-worksoft-<svc> indexes as a comma list (a wildcard would also match CTM results and the _semantic copies)
CTM Regression Results (now-7d)	ws302-ctm-regression	log-analytics-302-worksoft-ctm-results
AI Warden — Certify Authoring Assistant (now-7d)	ws302-warden	warden-requests-302 (verdict, model) and relay-compliance-events-302 (rule, framework)
SOC 2 Evidence (now-7d)	ws302-soc2	compliance-logs-302, time field timestamp

Generating Test Data

cd /root/opensearch/scripts

# Payment query logs (1000 entries)
node generate-payment-logs.js --count=1000

# Ingest into OpenSearch
curl -XPOST "http://localhost:9200/_bulk?refresh=true" \
  -H "Content-Type: application/x-ndjson" \
  --data-binary @payment-logs.ndjson

# External service call logs
node generate-synthetic-logs.js

# Database query logs
node generate-db-logs.js

# Anomaly demo data (24h with spikes)
node generate-anomaly-demo-logs.js --hours 24 --ingest

# Recreate all dashboards
node create-payment-dashboards.js

Log Format

Payment query logs use this format:

makePayment(paymentId)=9883: query executed in 240 ms

Dashboards Configuration

The Dashboards service reads config from: /root/opensearch/OpenSearch-Dashboards/config/opensearch_dashboards.yml

The root-check bypass (allows running as root) is patched in: /root/opensearch/OpenSearch-Dashboards/src/setup_node_env/root/index.js