From 8e366fd6339f1c3103b708d4d9b32cf8b67d955b Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 8 Jul 2021 17:27:51 -0400
Subject: [PATCH] add combined container mem panel

---
 .../panels/cpu_docker_combined.json.jinja     |   4 +-
 .../memory_used_docker_combined.json.jinja    | 538 ++++++++++++++++++
 2 files changed, 540 insertions(+), 2 deletions(-)
 create mode 100644 salt/grafana/panels/memory_used_docker_combined.json.jinja

diff --git a/salt/grafana/panels/cpu_docker_combined.json.jinja b/salt/grafana/panels/cpu_docker_combined.json.jinja
index 751f999d7..39ff5395e 100644
--- a/salt/grafana/panels/cpu_docker_combined.json.jinja
+++ b/salt/grafana/panels/cpu_docker_combined.json.jinja
@@ -1,11 +1,11 @@
 {
   "type": "graph",
-  "title": "Panel Title",
+  "title": "Container CPU Usage",
   "gridPos": {
     "x": 0,
     "y": 0,
     "w": 30,
-    "h": 15
+    "h": 10
   },
   "id": 78,
   "targets": [
diff --git a/salt/grafana/panels/memory_used_docker_combined.json.jinja b/salt/grafana/panels/memory_used_docker_combined.json.jinja
new file mode 100644
index 000000000..386d0f19b
--- /dev/null
+++ b/salt/grafana/panels/memory_used_docker_combined.json.jinja
@@ -0,0 +1,538 @@
+{
+  "type": "graph",
+  "title": "Container Memory Usage",
+  "gridPos": {
+    "x": 0,
+    "y": 10,
+    "w": 30,
+    "h": 10
+  },
+  "id": 78,
+  "targets": [
+    {
+      "refId": "A",
+      "queryType": "randomWalk",
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-elasticsearch"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "hide": false,
+      "alias": "elasticsearch"
+    },
+    {
+      "refId": "B",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-filebeat"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "alias": "filebeat"
+    },
+    {
+      "refId": "C",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-influxdb"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "alias": "influxdb"
+    },
+    {
+      "refId": "D",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-logstash"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "alias": "logstash"
+    },
+    {
+      "refId": "E",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-zeek"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "alias": "zeek",
+      "measurement": "docker_container_mem"
+    },
+    {
+      "refId": "F",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-suricata"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "value"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "alias": "suricata"
+    },
+    {
+      "refId": "G",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-steno"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "alias": "steno"
+    },
+    {
+      "refId": "H",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-kibana"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "alias": "kibana"
+    },
+    {
+      "refId": "I",
+      "hide": false,
+      "policy": "default",
+      "resultFormat": "time_series",
+      "orderByTime": "ASC",
+      "tags": [
+        {
+          "key": "host",
+          "operator": "=",
+          "value": "$servername"
+        },
+        {
+          "condition": "AND",
+          "key": "container_name",
+          "operator": "=",
+          "value": "so-redis"
+        }
+      ],
+      "groupBy": [
+        {
+          "type": "time",
+          "params": [
+            "$__interval"
+          ]
+        },
+        {
+          "type": "fill",
+          "params": [
+            "null"
+          ]
+        }
+      ],
+      "select": [
+        [
+          {
+            "type": "field",
+            "params": [
+              "usage_percent"
+            ]
+          },
+          {
+            "type": "mean",
+            "params": []
+          }
+        ]
+      ],
+      "measurement": "docker_container_mem",
+      "alias": "redis"
+    }
+  ],
+  "options": {
+    "alertThreshold": true
+  },
+  "datasource": "InfluxDB",
+  "fieldConfig": {
+    "defaults": {},
+    "overrides": []
+  },
+  "pluginVersion": "7.5.4",
+  "renderer": "flot",
+  "yaxes": [
+    {
+      "label": null,
+      "show": true,
+      "logBase": 1,
+      "min": null,
+      "max": null,
+      "format": "short"
+    },
+    {
+      "label": null,
+      "show": true,
+      "logBase": 1,
+      "min": null,
+      "max": null,
+      "format": "short"
+    }
+  ],
+  "xaxis": {
+    "show": true,
+    "mode": "time",
+    "name": null,
+    "values": [],
+    "buckets": null
+  },
+  "yaxis": {
+    "align": false,
+    "alignLevel": null
+  },
+  "lines": true,
+  "fill": 1,
+  "linewidth": 1,
+  "dashLength": 10,
+  "spaceLength": 10,
+  "pointradius": 2,
+  "legend": {
+    "show": true,
+    "values": false,
+    "min": false,
+    "max": false,
+    "current": false,
+    "total": false,
+    "avg": false
+  },
+  "nullPointMode": "connected",
+  "tooltip": {
+    "value_type": "individual",
+    "shared": true,
+    "sort": 0
+  },
+  "aliasColors": {},
+  "seriesOverrides": [],
+  "thresholds": [],
+  "timeRegions": [],
+  "fillGradient": 0,
+  "dashes": false,
+  "hiddenSeries": false,
+  "points": false,
+  "bars": false,
+  "stack": false,
+  "percentage": false,
+  "steppedLine": false,
+  "timeFrom": null,
+  "timeShift": null
+}