Grafana Cloud

Overview

Onehouse can export your deployment's metrics to your own Grafana Cloud stack, so you can build dashboards and alerts on Onehouse metrics alongside the rest of your telemetry.

Before you begin

• Grafana Cloud must be enabled for your org. Contact Onehouse (or your account team) to turn on the Grafana Cloud vendor for your project. Until then it does not appear in the vendor list.
• Outbound network access to *.grafana.net must be permitted from your data plane. If your VPC uses an egress firewall with domain or SNI filtering, add *.grafana.net to the allowlist — otherwise exports fail silently at the network layer.

Collect your Grafana Cloud values

You need three values, and all three come from one page in Grafana Cloud: the OpenTelemetry configuration page for your stack.

Open the OpenTelemetry configuration page

1. Sign in to the Grafana Cloud Portal — this is grafana.com, not your <stack>.grafana.net Grafana instance.
2. On your organization's Overview page, find the stack you want to send metrics to.
3. On the OpenTelemetry tile, click Configure.

This page shows your OTLP endpoint and Instance ID, and it is where you generate the API token.

tip

Check out the Grafana Cloud OTLP documentation to locate these values — it includes screenshots of the connection details page.

1. OTLP endpoint

On the OpenTelemetry page, copy the OTLP Endpoint value. It looks like:

https://otlp-gateway-prod-us-east-0.grafana.net/otlp

Your region (prod-us-east-0 above) depends on where your stack is hosted — for example prod-eu-west-2 or prod-ap-south-1. Copy it exactly as shown.

Use the OTLP endpoint, not the Prometheus remote-write URL

Onehouse accepts only the OTLP gateway host, otlp-gateway-<region>.grafana.net. The Prometheus remote-write URL from the same stack (https://prometheus-prod-<n>-<region>.grafana.net/api/prom/push) is rejected — it is a different service and will not work here.

Also do not append /v1/metrics to the endpoint. Onehouse adds it. The value you paste must end at /otlp.

2. Instance ID

On the same page, copy the Instance ID — the numeric username for OTLP Basic auth, for example 1730155.

note

The Instance ID is a number, not your stack name or your email address. If the value you copied contains letters, you have the wrong field.

3. API token

On the same page, find the Password / API Token field. If no token exists yet, click Generate now to create one and give it a name you will recognise later, such as onehouse-metrics.

The token starts with glc_. Copy it immediately — Grafana Cloud shows it only once, and you will need to generate a replacement if you lose it.

If you would rather create the token yourself, use Access Policies in the Cloud Portal (or Administration ▸ Cloud access policies in your Grafana instance) and give the policy the metrics:write scope. Metrics-only is sufficient — Onehouse does not send logs or traces to Grafana Cloud.

You should now have all three values:

Value	Example	Where it came from
OTLP endpoint	https://otlp-gateway-prod-us-east-0.grafana.net/otlp	OpenTelemetry page, OTLP Endpoint
Instance ID	1730155	OpenTelemetry page, Instance ID
API token	glc_eyJvIj…	OpenTelemetry page, Password / API Token — or an Access Policy token with metrics:write

Build the credential

Grafana Cloud uses HTTP Basic auth, and Onehouse sends the credential you supply verbatim as the Basic value — it does not encode it or prepend your Instance ID.

The credential is base64(instanceID:token) — not the raw glc_ token

Unlike Datadog, Honeycomb, or Splunk, where you paste the raw API key, Grafana Cloud requires you to join your Instance ID and token with a colon and Base64-encode the result. Pasting the raw glc_… token will fail authentication.

Join the two values as <instanceID>:<token> and Base64-encode them. The result is a single string — for example MTczMDE1NTpnbGNf… — and that string is the credential Onehouse stores.

Use whichever method below suits you. They all produce the same value.

Easiest — let Grafana do it for you

The OpenTelemetry configuration page already emits an OTEL_EXPORTER_OTLP_HEADERS environment variable containing Authorization=Basic <encoded value>. That <encoded value> is already base64(instanceID:token), so you can copy it straight into Onehouse and skip encoding entirely.

Strip the Authorization=Basic prefix, and if the snippet shows Basic%20, drop the %20 as well — paste only the encoded string itself.

macOS or Linux terminal

printf '%s' '1730155:glc_eyJvIj…' | base64

On Linux add -w0 (base64 -w0) to stop the output wrapping across lines.

Windows PowerShell

[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('1730155:glc_eyJvIj…'))

Any browser, nothing to install

Open your browser's developer console (F12, or Cmd+Option+J on macOS) and run:

btoa('1730155:glc_eyJvIj…')

This runs locally in your own browser — the token is never sent anywhere.

Common encoding mistakes

• Use printf, not echo — echo appends a newline that corrupts the value.
• The result must be one line with no spaces. If your tool wraps long output, join it back into a single line.
• Encode instanceID:token together. Encoding the token on its own will not authenticate.

Set up the integration

1. In the Onehouse console, go to Settings ▸ Integrations ▸ Observability.

2. Click Configure and select Grafana Cloud as the vendor.

3. Set Endpoint to your OTLP gateway base URL, e.g. https://otlp-gateway-prod-us-east-0.grafana.net/otlp.

4. Protocol is fixed to HTTPS, and Signals is fixed to Metrics — both are determined by the vendor and are not editable.

5. Enter the credential from the previous step:

   • Onehouse-managed secrets (OMS): paste the Base64 credential into the API Key field. Onehouse stores it in its managed secret store.
   • Bring-your-own-secret (BYOS): store the Base64 credential in your own cloud secret manager and enter its reference (e.g. the AWS Secrets Manager ARN) in the Secret reference field. The secret's value must be the base64(instanceID:token) blob, not the raw token.

   Which field you see is derived from your org's onboarding configuration — you do not choose it.

6. Turn on the Enabled toggle to start exporting.

Metrics begin flowing within a few minutes. Verify in Grafana Cloud by querying any Onehouse metric, for example ohds_deltastreamer_syncDurationSecs.

Which metrics are exported

Grafana Cloud receives the same Onehouse metric set documented in the Datadog Metrics Reference — ingestion lag and sync timing, write stats, and compaction, clustering, and cleaner service metrics, for both OneFlow (ohds_ prefix) and SQL cluster (ohsql_) workloads. Every metric carries table and database labels.

These are the same metrics that power the pre-built dashboards in Advanced Monitoring, so the alert query templates on that page work unchanged in your Grafana Cloud stack.

Edit or rotate credentials

Reopen the exporter and click Edit. Leaving the secret field blank keeps the credential already stored — only fill it in when you want to replace it.

To rotate a Grafana Cloud token, generate the new token, re-encode base64(instanceID:newToken), and paste the new value (OMS) or update your cloud secret's value (BYOS).

Troubleshooting

Symptom	Likely cause
Endpoint rejected in the dialog	The URL is not an otlp-gateway-<region>.grafana.net host — most often the Prometheus remote-write URL was used instead of the OTLP endpoint.
No metrics arrive, no console error	Authentication failure from a raw glc_ token, a credential encoded with a trailing newline, or a wrong Instance ID. Re-encode with printf and re-submit.
No metrics arrive, other exporters also affected	Egress firewall blocking *.grafana.net. Add it to your allowlist.
Only some metrics appear	The metric's table service may not be enabled or has not yet run — see the notes in the Datadog Metrics Reference.

Limitations

• Metrics only — logs are not exported to Grafana Cloud in this version. For Spark log export, see S3 Log Forwarding.
• HTTPS only — gRPC is not supported.
• One credential format — the credential must be the pre-encoded base64(instanceID:token) blob; Onehouse does not assemble or encode it for you.
• Endpoint host is restricted to otlp-gateway-<region>.grafana.net.