Documentation Plugins Dynatrace data source Configure

Configure the Dynatrace data source

This document provides guidance on configuring the Dynatrace data source.

Before you begin

The Dynatrace data source has the following requirements.

Grafana requirements:

• Grafana 10.4 or later
• One of the following:
  • Grafana Cloud Free, Advanced, or Trial account.
  • Grafana Enterprise with an activated license.
• The Organization administrator role to add data sources.

Dynatrace requirements:

• A Dynatrace environment (SaaS, Managed, or Environment ActiveGate).
• A Dynatrace API token with appropriate scopes (see Get an API key from Dynatrace).
• If using TLS/SSL: CA certificates, client certificates, or client keys as needed.

Installation

Install the Dynatrace plugin from the Grafana plugin catalog.

Known limitations

The following are known limitations with the Dynatrace data source:

• Logs query type is in beta - The underlying Dynatrace API is an Early Adopter release and may change in non-compatible ways.
• Logs aggregate mode - Aggregate mode for Logs queries is not yet supported.
• Multi-value variables - Support for multi-value template variables varies by query type. Test your specific use case to verify compatibility.

Get an API key from Dynatrace

To set up an API token, refer to Dynatrace API - Tokens and authentication.

To query the individual services, you need specific scopes added to your API token.

Get a Platform token from Dynatrace

To query data stored in Dynatrace Grail, you need a Platform token in addition to an API token. Platform tokens provide access to Grail’s unified data lakehouse for logs, metrics, traces, and events.

To set up a Platform token, refer to Dynatrace API - Tokens and authentication.

An IAM policy must be attached to the service identity used by the Platform token and must grant access to the environment being queried. The policy must also allow read access to the relevant Grail datasets. For more information about configuring IAM policy permissions for Grail, refer to the Dynatrace documentation on assigning permissions in Grail.

The following table lists the required scopes for each Grail data type:

Add the Dynatrace data source

Complete the following steps to add a new Dynatrace data source:

1. Click Connections in the left-side menu.
2. Click Add new connection.
3. Type Dynatrace in the search bar.
4. Select the Dynatrace data source.
5. Click Add new data source in the upper right.

Grafana takes you to the Settings tab, where you will set up your Dynatrace configuration.

Configure the data source in the UI

The following is a list of configuration options for Dynatrace.

Dynatrace API type

Select the type of Dynatrace instance that you are connecting to:

SaaS Environment - Dynatrace’s cloud-hosted service where Dynatrace manages all the infrastructure for you.

• Environment ID - The environment ID from your instance URL. For example, in yfc55578.live.dynatrace.com, the Environment ID is yfc55578.

Managed Cluster - A self-hosted Dynatrace deployment that you run on your own infrastructure (on-premises or in your own cloud environment).

• Environment ID - The environment ID from your instance URL. For example, in yd8888.managed-sprint.dynalabs.io/e/abc99984-3af2-55tt-72kl-0672983gc45, the Environment ID is abc99984-3af2-55tt-72kl-0672983gc45.
• Domain - The domain name of your Dynatrace server. For example: yd8888.managed-sprint.dynalabs.io

Raw URL - Use this option for Dynatrace instances that don’t fit into the SaaS or Managed Cluster categories, such as Environment ActiveGate.

• URL - The full URL of your Dynatrace instance. For example: https://yfc55578.live.dynatrace.com

Common settings

The following settings apply to all API types:

• Dynatrace API token - Enter your Dynatrace API token. At minimum, it must have metrics.read and entities.read permissions. Refer to Get an API key from Dynatrace for instructions on creating the token and required scopes for each query type.
• Dynatrace Platform token - (Optional) Enter your Dynatrace Platform token. This token is required for querying data stored in Dynatrace Grail. Refer to Get a Platform token from Dynatrace for instructions on creating the token and required scopes.
• Timeout - The timeout, in seconds, for the HTTP client. The default is 30.
• Skip TLS Verify - Enable this option to skip SSL/TLS certificate validation when connecting to the Dynatrace API endpoint. Use with caution.
• With CA Cert - Enable this option to provide a CA certificate for TLS verification.
  • CA Cert - Paste your CA certificate content.

Configure the data source with provisioning

You can define and configure the data source in YAML files as part of the Grafana provisioning system. For more information about provisioning and available configuration options, refer to Provision Grafana.

YAML Copy

apiVersion: 1
datasources:
  - name: Dynatrace
    type: grafana-dynatrace-datasource
    jsonData:
      apiType: saas
      environmentId: environment Id
    secureJsonData:
      apiToken: API token
      platformToken: Platform token # Optional: Required for Grail queries
  - name: Dynatrace Managed
    type: grafana-dynatrace-datasource
    jsonData:
      apiType: managed
      environmentId: environment Id # example: abc99984-3af2-55tt-72kl-0672983gc45
      domain: domain # example: yd8888.managed-sprint.dynalabs.io
      tlsSkipVerify: false
      tlsAuthWithCACert: true
      httpClientTimeout: 360
    secureJsonData:
      apiToken: API token
      platformToken: Platform token # Optional: Required for Grail queries
      tlsCACert: |
        -----BEGIN CERTIFICATE-----
        1221323123213123231231232+g6DAzj/11231
        sdsaas==
        -----END CERTIFICATE-----

Configure Dynatrace with Terraform

You can configure the Dynatrace data source as code using the Grafana Terraform provider. This approach enables version-controlled, reproducible data source configurations across environments.

The following examples demonstrate configurations for each API type (SaaS, Managed, and Raw URL), as well as an advanced configuration with TLS settings.

Terraform Copy

terraform {
  required_providers {
    grafana = {
      source  = "grafana/grafana"
      version = "~> 3.0"
    }
  }
}

provider "grafana" {
  url  = var.grafana_url
  auth = var.grafana_auth
}

# SaaS Environment Example
resource "grafana_data_source" "dynatrace_saas" {
  type = "grafana-dynatrace-datasource"
  name = "Dynatrace SaaS"

  json_data_encoded = jsonencode({
    apiType       = "saas"
    environmentId = var.dynatrace_environment_id
  })

  secure_json_data_encoded = jsonencode({
    apiToken      = var.dynatrace_api_token
    platformToken = var.dynatrace_platform_token # Optional: Required for Grail queries
  })
}

# Managed Cluster Example
resource "grafana_data_source" "dynatrace_managed" {
  type = "grafana-dynatrace-datasource"
  name = "Dynatrace Managed"

  json_data_encoded = jsonencode({
    apiType       = "managed"
    environmentId = var.dynatrace_environment_id
    domain        = var.dynatrace_domain
  })

  secure_json_data_encoded = jsonencode({
    apiToken = var.dynatrace_api_token
  })
}

# Raw URL Example
resource "grafana_data_source" "dynatrace_raw" {
  type = "grafana-dynatrace-datasource"
  name = "Dynatrace Raw URL"

  json_data_encoded = jsonencode({
    apiType       = "url"
    environmentId = var.dynatrace_raw_url
  })

  secure_json_data_encoded = jsonencode({
    apiToken = var.dynatrace_api_token
  })
}

# Advanced Configuration with TLS and Timeout
resource "grafana_data_source" "dynatrace_advanced" {
  type = "grafana-dynatrace-datasource"
  name = "Dynatrace Advanced"

  json_data_encoded = jsonencode({
    apiType           = "managed"
    environmentId     = var.dynatrace_environment_id
    domain            = var.dynatrace_domain
    httpClientTimeout = 30
    tlsSkipVerify     = false
    tlsAuthWithCACert = true
  })

  secure_json_data_encoded = jsonencode({
    apiToken      = var.dynatrace_api_token
    tlsCACert     = var.dynatrace_ca_cert
  })
}

# Variables
variable "grafana_url" {
  description = "Grafana instance URL"
  type        = string
  default     = "http://localhost:3000"
}

variable "grafana_auth" {
  description = "Grafana authentication (e.g., admin:password or API key)"
  type        = string
  sensitive   = true
}

variable "dynatrace_environment_id" {
  description = "Dynatrace Environment ID"
  type        = string
}

variable "dynatrace_domain" {
  description = "Dynatrace domain for managed cluster"
  type        = string
  default     = ""
}

variable "dynatrace_raw_url" {
  description = "Full URL for Dynatrace instance (Raw URL mode). Used as environmentId when apiType is 'url'."
  type        = string
  default     = ""
}

variable "dynatrace_api_token" {
  description = "Dynatrace API Token"
  type        = string
  sensitive   = true
}

variable "dynatrace_platform_token" {
  description = "Dynatrace Platform Token for Grail queries"
  type        = string
  sensitive   = true
  default     = ""
}

variable "dynatrace_ca_cert" {
  description = "CA Certificate for TLS"
  type        = string
  sensitive   = true
  default     = ""
}

# Outputs
output "dynatrace_saas_uid" {
  description = "UID of the Dynatrace SaaS data source"
  value       = grafana_data_source.dynatrace_saas.uid
}

output "dynatrace_managed_uid" {
  description = "UID of the Dynatrace Managed data source"
  value       = grafana_data_source.dynatrace_managed.uid
}

output "dynatrace_raw_uid" {
  description = "UID of the Dynatrace Raw URL data source"
  value       = grafana_data_source.dynatrace_raw.uid
}