> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data source management

> Configure and manage data sources for Monitors, including Prometheus, Elasticsearch, Loki, ClickHouse, MySQL, Oracle, PostgreSQL, Aliyun SLS, Tencent CLS, and VictoriaLogs

Data sources are where the alert engine queries data. You need to configure data sources first so the alert engine can read data from them for anomaly detection.

**Menu Entry**: Data Sources

## Supported data source types

Monitors supports the following 10 data source types:

| Type              | Description                                                         |
| ----------------- | ------------------------------------------------------------------- |
| **Prometheus**    | Time series database, queried via PromQL                            |
| **Elasticsearch** | Distributed search and analytics engine                             |
| **Loki**          | Lightweight log aggregation system                                  |
| **ClickHouse**    | Columnar analytics database                                         |
| **MySQL**         | Relational database                                                 |
| **Oracle**        | Relational database                                                 |
| **PostgreSQL**    | Relational database                                                 |
| **Aliyun SLS**    | Alibaba Cloud Log Service                                           |
| **Tencent CLS**   | Tencent Cloud Log Service                                           |
| **VictoriaLogs**  | Log database, a logging solution from the VictoriaMetrics ecosystem |

## Data source list

The data source list displays all configured data sources with the following information:

* **Name**: The identifier for the data source
* **Type**: Data source type with icon
* **Connection URL**: The access address of the data source
* **Associated Alert Engine**: The bound alert engine cluster name, with engine online status indicator
* **Notes**: Supplementary description

You can filter data sources by name or type using the search box. The list auto-refreshes every 5 seconds to reflect real-time engine connection status.

## Create a data source

<Steps>
  <Step title="Select data source type">
    Click the **New** button and select the data source type (e.g., Prometheus, MySQL) at the top of the form.
  </Step>

  <Step title="Fill in basic information">
    | Config Item                 | Description                                                                                                                         |
    | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
    | **Name**                    | Unique identifier for the data source; alert rules can reference data sources via wildcard by name or exact match by ID (see below) |
    | **Notes**                   | Optional supplementary description                                                                                                  |
    | **Associated Alert Engine** | Select the engine cluster responsible for querying this data source; typically choose a cluster in the same datacenter              |
  </Step>

  <Step title="Configure connection parameters">
    Fill in the connection parameters specific to the data source type. See the sections below for details.
  </Step>

  <Step title="Save">
    Click **OK** to complete creation.
  </Step>
</Steps>

### Two ways to bind data sources in alert rules

Alert rules support two methods for binding data sources. Both can be used together, and at least one must be specified. The rule applies to all data sources matched by either method (union).

| Binding Mode          | Field                        | Matching Logic                                                                                           | Use Case                                                                                     |
| --------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| **Wildcard by name**  | `Data Sources (Wildcard)`    | Matches by name with wildcards. `*` matches all data sources; `Prom*` matches names with the Prom prefix | Dynamically match a group of data sources, e.g., data sources sharing a common naming prefix |
| **Exact match by ID** | `Data Sources (Exact Match)` | Associates by data source ID; select specific data sources from a dropdown list                          | Precisely bind specific data sources, unaffected by data source renames                      |

<Warning>
  Wildcard by name stores name strings — if a data source is renamed, existing wildcard rules may no longer match. Exact match by ID stores the data source ID and is unaffected by renames. If stability is a priority, prefer exact match.
</Warning>

## Data source type configuration

### Prometheus

| Config Item                                         | Description                                                                                                                  |
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **Server URL**                                      | Prometheus server address, e.g., `http://localhost:9090`                                                                     |
| **Headers**                                         | Custom HTTP request headers, supports multiple Key-Value pairs                                                               |
| **Params**                                          | Custom URL query parameters, supports multiple Key-Value pairs                                                               |
| **Basic Authentication**                            | When enabled, requires username and password                                                                                 |
| **Use a custom CA certificate**                     | When checked, fill in the CA certificate content; leave empty to use the system trust store of the alert engine host         |
| **Enable client certificate authentication (mTLS)** | When checked, fill in the client certificate and client key; the two must be provided as a pair                              |
| **Server name (optional)**                          | Used for SNI and certificate hostname verification; inferred from the connection address when empty                          |
| **Minimum / Maximum TLS version**                   | Options: TLS 1.0, 1.1, 1.2, 1.3; defaults to system default. The minimum version must not be higher than the maximum version |
| **Skip server certificate verification**            | When checked, the server certificate is not verified                                                                         |

### MySQL / Oracle / PostgreSQL

Relational databases share a similar configuration structure:

| Config Item                       | Description                                                                                                | Default |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------- |
| **Connection URL**                | Database address, e.g., `localhost:3306` (MySQL), `localhost:1521` (Oracle), `localhost:5432` (PostgreSQL) | -       |
| **Max Connections**               | Maximum open connections in the connection pool                                                            | 32      |
| **Idle Connections**              | Maximum idle connections in the connection pool                                                            | 4       |
| **Connection Lifetime (seconds)** | Maximum connection lifetime                                                                                | 600     |
| **Timeout (milliseconds)**        | Query timeout                                                                                              | 5000    |
| **Username**                      | Database username                                                                                          | -       |
| **Password**                      | Database password                                                                                          | -       |

In addition to the basic connection settings above, Oracle supports multiple key-value **Options**. MySQL and PostgreSQL additionally support TLS/SSL encrypted connections, selected via the **TLS/SSL mode** dropdown.

#### TLS/SSL modes for MySQL

| Mode                                                           | Description                                                                                                                              |
| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Disable TLS** (disable)                                      | The connection is not encrypted with TLS                                                                                                 |
| **Encrypt without certificate verification** (require)         | TLS encryption is required, but the identity of the database server is not verified; a custom CA certificate is not allowed in this mode |
| **Verify certificate and hostname** (verify-full, recommended) | Verifies the certificate authority and the certificate hostname; a custom CA certificate can be configured in this mode                  |

With any mode other than "Disable TLS", you can also enable client certificate authentication (mTLS — the client certificate and client key must be provided as a pair), set the server name, and configure the minimum / maximum TLS version. With "Verify certificate and hostname", use the database DNS name that matches the server certificate as the connection address instead of an IP address.

<Warning>
  Setting any mode other than "Disable TLS" requires all registered Edge instances in the associated alert engine cluster to be v0.51.0 or later.
</Warning>

#### TLS/SSL modes for PostgreSQL

| Mode                                                           | Description                                                                                                                              |
| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Disable TLS** (disable)                                      | The connection is not encrypted with TLS                                                                                                 |
| **Encrypt without certificate verification** (require)         | TLS encryption is required, but the identity of the database server is not verified; a custom CA certificate is not allowed in this mode |
| **Verify certificate authority** (verify-ca)                   | Verifies that the server certificate was issued by a trusted certificate authority without checking its hostname                         |
| **Verify certificate and hostname** (verify-full, recommended) | Verifies the certificate authority and ensures the certificate hostname matches the connection address                                   |

In "Verify certificate authority" and "Verify certificate and hostname" modes, a custom CA certificate is optional — leave it empty to use the system trust store of the alert engine host. Client certificate authentication (mTLS) can be enabled in any mode other than "Disable TLS". With "Verify certificate and hostname", use the database DNS name that matches the server certificate as the connection address instead of an IP address.

<Warning>
  Setting any mode other than "Disable TLS" requires all registered Edge instances in the associated alert engine cluster to be v0.50.0 or later.
</Warning>

### Elasticsearch

Elasticsearch supports Cloud and Self-Managed deployments. Cloud is selected by default.

| Config Item                      | Cloud     | Self-Managed                                  | Default |
| -------------------------------- | --------- | --------------------------------------------- | ------- |
| **Cloud ID**                     | Required  | -                                             | -       |
| **API Key**                      | Required  | -                                             | -       |
| **Connection URL**               | -         | Required; separate multiple nodes with commas | -       |
| **Query timeout (milliseconds)** | Supported | Supported                                     | 5000    |
| **Headers**                      | -         | Supports multiple custom request headers      | -       |
| **Username / Password**          | -         | Required                                      | -       |
| **Service Token**                | -         | Optional                                      | -       |
| **CA certificate**               | -         | Optional                                      | -       |
| **Certificate fingerprint**      | -         | Optional                                      | -       |

### Loki / VictoriaLogs

Loki and VictoriaLogs use the same HTTP connection structure as Prometheus: server URL, Headers, Params, Basic Authentication, and TLS settings such as a custom CA, mTLS, server name, TLS versions, and skipping certificate verification.

| Type             | Example server URL      |
| ---------------- | ----------------------- |
| **Loki**         | `http://localhost:3100` |
| **VictoriaLogs** | `http://localhost:9428` |

These addresses are input examples; the form does not save them as defaults automatically.

### ClickHouse

| Config Item                           | Description                                                             | Default |
| ------------------------------------- | ----------------------------------------------------------------------- | ------- |
| **Connection URL**                    | ClickHouse Native protocol address; separate multiple nodes with commas | -       |
| **Max Connections**                   | Maximum open connections in the pool                                    | 32      |
| **Idle Connections**                  | Maximum idle connections in the pool                                    | 4       |
| **Connection Lifetime (seconds)**     | Maximum connection lifetime                                             | 600     |
| **Query timeout (milliseconds)**      | Timeout for each query                                                  | 5000    |
| **Maximum execution time (seconds)**  | Query execution limit sent to ClickHouse                                | 60      |
| **Connection timeout (milliseconds)** | Timeout for establishing a connection                                   | 2000    |
| **Username / Password**               | ClickHouse credentials                                                  | -       |
| **Database**                          | Optional default database                                               | -       |

After you enable **TLS**, you can configure a custom CA, mTLS, server name, minimum / maximum TLS versions, and skipping server certificate verification. Disabling TLS clears these TLS fields from the form.

### Aliyun SLS

| Config Item          | Description                                                                                            |
| -------------------- | ------------------------------------------------------------------------------------------------------ |
| **Endpoint**         | SLS endpoint, such as `cn-hangzhou.log.aliyuncs.com`. Do not include an `http://` or `https://` prefix |
| **Headers**          | Optional custom request headers; supports multiple Key-Value pairs                                     |
| **AccessKey ID**     | Alibaba Cloud access key ID, required                                                                  |
| **AccessKey Secret** | Alibaba Cloud access key secret, required                                                              |

The SLS form does not provide separate TLS settings. AccessKey ID and AccessKey Secret support the Edge environment variable references described below.

### Tencent CLS

The Tencent CLS (Tencent Cloud Log Service) data source lets alert rules query log topics in Tencent Cloud CLS. The form has four parts: access point, authentication, cluster capability gate, and connection test.

#### Access Point

| Config Item      | Description                                                                                                                                                                                                                                                    |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Access Point** | The endpoint Edge uses to reach Tencent Cloud CLS: **Public** (`cls.tencentcloudapi.com`) or **Tencent Cloud Internal** (`cls.internal.tencentcloudapi.com`). Choose the internal endpoint when Edge runs inside Tencent Cloud to avoid public traffic charges |

When editing an existing data source whose access address is neither of the two endpoints (for example, an endpoint for another region or a custom domain configured via API), the form shows **Unsupported access point**; reselect the public or internal endpoint before saving.

#### Authentication

| Config Item   | Description                                                     |
| ------------- | --------------------------------------------------------------- |
| **SecretId**  | Tencent Cloud API key ID, required                              |
| **SecretKey** | Tencent Cloud API secret key, required; write-only after saving |

Both fields accept two forms:

* **Literal**: Enter the credential value directly.
* **Environment variable reference**: Enter `${env:VAR_NAME}`; each Edge resolves it locally and the resolved value is never sent back to the control plane. Variable names may contain only uppercase letters, digits, and underscores, e.g., `${env:TENCENT_CLS_SECRET_KEY}`. A value that starts with `${env:` but is not a complete reference is rejected by the form immediately.

SecretKey is write-only: after saving, neither the list nor the detail returns the literal key. When editing, if a literal key is stored on the server, the field shows a fixed mask (`••••••••••••`); click the **Change** icon to switch to an input, and leave it blank to keep the current key. Keys saved as `${env:}` references are not secrets and are shown as-is.

#### Cluster Capability Gate

Tencent Cloud CLS requires all Edge instances in the alert engine cluster to run a minimum version. The form checks the selected **Associated Alert Engine** cluster in real time and warns when any instance is below the requirement:

| Status             | Message                                                                                                                                 |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
| **mixed\_version** | Some instances in the alert engine cluster are outdated; upgrade all instances in the cluster to the suggested minimum version or later |
| **unsupported**    | The alert engine is too old to support Tencent Cloud CLS                                                                                |
| **unavailable**    | No registered alert engine was found                                                                                                    |

The same gate applies on the alert rule page: a cluster can degrade later due to a rollback or a newly joined old instance, in which case saving a rule is rejected by the backend even though the data source already exists.

#### Connection Test

After saving the data source, you can use **Connection Test** to verify the connection:

1. The test is unavailable for a new data source — save it first ("Save the data source before testing the connection").
2. Pick a region to test against. The data source itself does not store a region, so you pick one at test time.
3. Click **Test**. The request is routed to a single Edge instance in the selected region, and the result is tagged **Current execution instance only** — it does not mean the whole cluster was verified.
4. On failure, the result surfaces the raw Tencent Cloud error code and RequestId, which you can use for troubleshooting.

Results are **Connection is healthy**, **Connected with warnings**, or **Connection failed**.

#### Region Selection

The region picker, shared by rule queries and the connection test, offers a list of commonly used regions: Guangzhou (ap-guangzhou), Shanghai (ap-shanghai), Beijing (ap-beijing), Nanjing (ap-nanjing), Chengdu (ap-chengdu), Chongqing (ap-chongqing), Hong Kong (ap-hongkong), Singapore (ap-singapore), Bangkok (ap-bangkok), Jakarta (ap-jakarta), Seoul (ap-seoul), Tokyo (ap-tokyo), Silicon Valley (na-siliconvalley), Ashburn (na-ashburn), Frankfurt (eu-frankfurt), Sao Paulo (sa-saopaulo), and Riyadh (me-saudi-arabia). The list is a suggestion, not a whitelist — Tencent Cloud opens new regions from time to time, so you can also type any region code matching `[a-z0-9-]`; Tencent Cloud decides whether it works.

#### Rule Binding Constraint

Alert rules of the Tencent CLS type can bind exactly one data source and do not support name patterns. When creating a rule, the data source picker is single-select and the name-pattern input is hidden; an invalid configuration is rejected on save with "This data source type can bind only one data source" or "This data source type does not support name patterns. Clear them and pick one data source." See [Tencent CLS alert rules](/en/monitors/alert-rules/tencent-cls).

## Reference credentials locally in Edge

With Edge `v0.46.0` or later, you can use environment variable references in supported data-source connection fields instead of placing credentials directly in the data-source configuration. Edge resolves each reference in its local process; the resolved credential is never written back to the synced data-source configuration, debug output, or API payloads.

<Steps>
  <Step title="Set environment variables for the Edge process">
    Set credentials in the environment of every Edge process that queries this data source. For example, set `SLS_ACCESS_KEY_ID` and `SLS_ACCESS_KEY_SECRET` for SLS. Restart the Edge process after changing its environment so the new values take effect.
  </Step>

  <Step title="Enter references in the data-source form">
    When editing a data source, enter `${env:VARIABLE_NAME}` in a supported authentication or connection field. For example, enter `${env:SLS_ACCESS_KEY_ID}` for the SLS **AccessKey ID** and `${env:SLS_ACCESS_KEY_SECRET}` for the **AccessKey Secret**.
  </Step>

  <Step title="Save and test">
    Save the data source, then use **Test** to verify the connection. Each referenced variable must exist in the corresponding Edge process environment.
  </Step>
</Steps>

Variable names must start with an uppercase letter or underscore and may then contain only uppercase letters, digits, or underscores, such as `SLS_ACCESS_KEY_SECRET`.

<Warning>
  Environment variable references are not supported in the data-source **address**. They are also not supported in **Params** for Prometheus, Loki, or VictoriaLogs. Use this syntax only in supported authentication and connection fields.
</Warning>

## Test a data source

In the data source list, click the **Test** button for the corresponding data source to open a query preview window, verify the connection, and preview query results.

## Edit and delete

* **Edit**: Click the **Edit** button in the data source list to modify the configuration and save.
* **Delete**: Click the **Delete** button in the data source list and confirm to delete the data source.

<Warning>
  Before deleting a data source, ensure no alert rules reference it, otherwise the related alert rules will not execute properly.
</Warning>