Connectors

Sources at a glance

Instrument your application with standard telemetry. Lumis is configured outside it, reads through these connectors, and never imports your code. All connectors are read-only and bounded by item, byte and time limits, with no hidden retries or pagination.

Install lumis-sdk[http] for the HTTP connectors. All of these were exercised live on the GridCast estate; qualify scope, identities, permissions and query meaning on your own.

Kubernetes

sources:
  kubernetes:
    enabled: true
    context: my-approved-context
    namespace: my-estate

Uses kubectl with your read access. No all-namespace scan, no secret or environment extraction, no kubeconfig edits and no workload changes. If the source fails, preparation stops.

Prometheus

sources:
  prometheus:
    enabled: true
    endpoint: http://localhost:9090
queries:
  - id: service-up
    provider: prometheus
    entity_id: service:demo
    key: up
    description: Availability at the end of the incident
    parameters:
      promql: 'min(up{job="demo"})'

The query runs at the end of the incident and must return one finite scalar or one vector series; aggregate explicitly. An outage, malformed response or empty result supplies no fact. To add call topology from an existing service-graph metric, set discover_service_graph: true with an explicit service_namespace.

Loki, Tempo and Prefect

sources:
  loki:
    enabled: true
    endpoint: https://approved-log-gateway.example
    headers_env:
      Authorization: LUMIS_LOKI_AUTHORIZATION
      X-Scope-OrgID: LUMIS_LOKI_TENANT
    max_results: 50
  tempo:
    enabled: true
    endpoint: http://localhost:3200
    max_results: 50
  prefect:
    enabled: true
    endpoint: http://localhost:4200/api
    flow_names: [daily-forecast]
    max_results: 50

Point Loki and Tempo at query frontends, and Prefect at its API base (including /api). Credentials in URLs are refused; header values come from environment variables and fail closed when missing. Log counts are not failure rates, and capped results are marked degraded.

Read-only SQL

sources:
  sql:
    enabled: true
    dsn_env: ESTATE_READONLY_DSN
    statement_timeout_ms: 5000
    connect_timeout_seconds: 5
queries:
  - id: incident-events
    provider: sql
    entity_id: service:demo
    key: event_count
    description: Registered event count during the incident
    parameters:
      sql: >-
        SELECT count(*) FROM operational_events
        WHERE at >= %(started_at)s AND at <= %(ended_at)s

Each query is one SELECT or WITH statement returning exactly one row and column. Only started_at and ended_at parameters are accepted. Transactions are read-only and rolled back, but that is not a permission boundary: use a database role that can only read the approved tables. NULL supplies no fact.

Recent changes

Many incidents follow a change. sources.changes attributes recent Git commits and Kubernetes rollouts to graph entities, so a check or the investigator can ask “what changed here, and when?”. A change is evidence about an entity, never proof that it caused the incident.

sources:
  changes:
    enabled: true
    lookback_seconds: 3600
    max_records: 50
    git:
      - id: gitops
        root: ../gitops
        paths:
          services/demo/: ["service:demo"]
queries:
  - id: demo-changes
    provider: changes
    entity_id: service:demo
    key: release_changes_30m
    description: Recent mapped changes before incident end
    parameters: {output: count, lookback_seconds: "1800"}

count returns the number of mapped changes in the lookback; seconds_since_latest returns the age of the newest one. Set kubernetes_rollouts: true (with the Kubernetes source enabled) to include rollouts, including re-activations seen through ScalingReplicaSet events. Git is the durable record; Kubernetes event history expires.

Source: Connector reference ↗ in the SDK repository.