Environment Variables
All monitored targets are configured in the UI "Data Sources" page. MySQL/MongoDB/Redis/Kafka/Elasticsearch/Host/Flink no longer have corresponding environment variables. After deployment, open the Data Sources page to add them, or download a YAML template for batch import (each entry is connection-tested during import). Changes take effect immediately without restarting containers.
1.4.x once supported configuring monitoring targets in ops.yaml through ENV_MYSQL_*/ENV_REDIS_* and similar variables, which were seeded as data sources during first startup. This mechanism was removed in 1.5.0. These variables are no longer read, and the configuration no longer takes effect. Startup logs explicitly list and warn about them.
For instances upgraded from 1.4.x, existing data sources remain unchanged. Historical configuration lines can be removed from ops.yaml.
Other variables on this page (token, sub-path, retention, object storage, Alloy, and others) are unaffected and remain authoritative.
All Ops Platform configuration is passed through environment variables: Docker Compose writes them in ops.yaml, and Kubernetes writes them in ConfigMap. The table below groups variables by purpose. Unless otherwise noted, configure them as needed; defaults are used when not configured.
Common/Gateway
| Environment Variable | Description |
|---|---|
| ENV_OPS_TOKEN | Access authentication key for the Ops Platform. Must be changed during first deployment |
| ENV_OPS_SUB_PATH | Reverse proxy sub-path. Not required for direct port access. After configured, gateway and Grafana automatically adapt GF_SERVER_ROOT_URL and GF_SERVER_SERVE_FROM_SUB_PATH. Example: /mdis |
| ENV_OPS_PORT | Internal listening port of ops-server, default 8081; usually no change required |
| ENV_OPS_GATEWAY_PORT | External gateway port, default 48881 |
Host Monitoring (Node Exporter)
No environment variables. Add a "Host" data source in the UI "Data Sources" page. Address format: IP:59100 (fixed port 59100).
Docker Compose deployment hosts and Kubernetes cluster nodes already include ops-nodeagent (automatically listening on 59100). Do not add it repeatedly or install node_exporter separately. Only additional external hosts need to be added on this page.
Cluster Monitoring (Kubernetes)
The Ops Platform supports Kubernetes cluster monitoring since 1.3.0 (nodes, containers, Pods, and cluster object status). See Kubernetes Cluster Monitoring for complete configuration.
| Environment Variable | Description |
|---|---|
| ENV_K8S_MONITOR_MODE | Kubernetes monitoring mode: off (default, disabled) / incluster (uses the ServiceAccount of the cluster where it runs to discover targets automatically). Kubernetes-form Ops Platform deployments are preset to incluster; when the Ops Platform is outside the cluster, this value is used by the collection components inside the monitored cluster. ⚠️ External pull mode (static) was removed in 1.5.3, so configuring it no longer takes effect |
| ENV_K8S_CLUSTER_NAME | Cluster identifier written as the origin_prometheus label on metrics. The Kubernetes panel uses this value to switch clusters. Default: default. In multi-cluster scenarios, assign different names to each cluster, such as prod-k8s/test-k8s. Avoid duplicates and avoid using IPs |
| ENV_K8S_KSM_NAMESPACE | Namespace where kube-state-metrics runs in incluster mode. Default: mdis-monitoring. ⚠️ Both Kubernetes manifests (single-file ops.yaml and PVC 11-configmap.yaml) set it to hap-ops. Their built-in kube-state-metrics also runs in hap-ops, so no change is required. Only collection components deployed inside monitored clusters use the default mdis-monitoring |
In incluster mode, no data source needs to be registered. ops-prometheus uses its own ServiceAccount to discover kubelet/cAdvisor/kube-state-metrics, and changes take effect in real time.
Middleware and Monitored Targets
No environment variables. MySQL/MongoDB/Redis/Kafka/Elasticsearch are all added in the UI "Data Sources" page. Each data source can select purposes:
- Diagram (
metrics): Included in metrics collection and displayed as charts in resource monitoring - Alert (
alert): Included in alert monitoring - Diagnostics (
diagnose, MongoDB only): Used as the target database for slow-query diagnostics. The account requiresclusterMonitoranddbAdminon the target database. The Ops Platform runsprofile:1to enable profiling
Exporter ports are assigned automatically by the Ops Platform and do not need to be managed manually.
Batch Import
"Batch Import" in the upper-right corner of the Data Sources page supports YAML/JSON. Download the YAML template first, modify connection addresses for the current environment, and upload it. It is recommended to click "Validate Only" first, which performs only format validation and per-entry connection probes without writing data.
Import is idempotent by "type + name": entries with the same name are updated instead of created. The same file can be imported repeatedly. Leave passwords empty during update to keep original passwords. Failed connection probes do not block import, but results are listed per entry.
Automation can call the API directly:
curl -X POST "http://<deployment-host-IP>:48881/api/alert/sources/import" \
-H "Content-Type: application/yaml" \
--data-binary @datasources.yaml
- MySQL cluster: Enter the real address of each node. Do not use read/write splitting entries such as mysqlrouter, because only the routed backend can be collected and member status will be incomplete
- Elasticsearch username: Private deployment built-in ES uses
md, notelastic. If filled incorrectly, the collector process runs but cannot obtain metrics - MongoDB replica set: Put all members in the URI, separated by commas
Data Source Service Discovery
agent pulls data sources that are enabled and have the metrics purpose from ops-server every 30 seconds, and starts/stops corresponding exporters as needed.
Prometheus scrape targets are also delivered by the registry and hot-loaded. Therefore, data source changes take effect immediately.
| Environment Variable | Description |
|---|---|
| ENV_OPS_SD_URL | Address used by ops-prometheus/agent to access the registry (ops-server), default http://gateway:8081. ⚠ ️ This is the 8081 directly listened by ops-server, not the gateway external 48881 (that is nginx and has no /api/sd route). Kubernetes Service must expose both ports |
| ENV_OPS_SD_TOKEN | Access token for the registry API. Keep it consistent on gateway, ops-prometheus, and agent. Empty means no validation (recommended only for Docker internal networks) |
| ENV_AGENT_SD_HOST | Hostname of the agent service, used by Prometheus to address exporters. Default: agent; usually no change required |
Check the agent container logs first. If [sd] failed to pull xxx appears repeatedly, agent cannot access the registry.
The most common causes are ENV_OPS_SD_URL pointing to 48881, or Kubernetes Service exposing only 48881 but not 8081.
In this case, exporters cannot start and all middleware monitoring is empty.
Data Retention
| Environment Variable | Description |
|---|---|
| ENV_PROMETHEUS_RETENTION | Prometheus metrics retention. Default when not configured: 15d. Example: 30d |
| ENV_LOKI_RETENTION | Loki log retention. Default when not configured: 720h (30 days). Example: 360h |
| ENV_TEMPO_RETENTION | Tempo trace retention. Default when not configured: 720h (30 days). Example: 360h |
Observability Collection (Alloy)
| Environment Variable | Description |
|---|---|
| ENV_TEMPO_GRPC_URL | gRPC address where alloy forwards trace data to Tempo. Example: http://ops-tempo:4317 |
| ENV_PROMETHEUS_REMOTE_WRITE_URL | remote_write write address shared by two scenarios: 1. alloy reports the Ops Platform's own metrics and can connect directly inside the same cluster, for example http://ops-prometheus:9090/prometheus/server/api/v1/write; 2. collection components in other Kubernetes clusters push metrics back to the Ops Platform and must use the gateway external port with token, for example http://<Ops-Platform-address>:30881/mdis/prometheus/server/api/v1/write (Ops Platform ops-prometheus is ClusterIP and cannot be accessed from outside the cluster on :9090) |
| ENV_PROMETHEUS_REMOTE_WRITE_TOKEN | Bearer token used when the previous item goes through the gateway. Fill in the Ops Platform ENV_OPS_TOKEN. If omitted, the gateway returns 401, visible only in collection-side logs while the UI only appears as "No Data". Direct :9090 access does not need it |
| ENV_LOKI_PUSH_URL | HTTP API address where alloy pushes logs to Loki. Example: http://ops-loki:3100/loki/api/v1/push |
| ENV_LOKI_PUSH_TOKEN | Bearer token for log push. Required only when the collector is in another cluster and pushes through the Ops Platform gateway (fill in the Ops Platform ENV_OPS_TOKEN). Leave empty when directly connecting to ops-loki inside the cluster. If omitted while using the gateway, it returns 401 and is visible only in collection-side logs |
Log Storage Backend (Loki S3/MinIO, Optional)
When not configured, Loki uses the local file system for storage.
| Environment Variable | Description |
|---|---|
| ENV_S3_ENDPOINT | S3-compatible storage endpoint. Use host:port, without http://. Example: minio:9000. Tencent Cloud COS example: cos.ap-hongkong.myqcloud.com (without bucket prefix). Tempo's minio-go accepts only host:port; with scheme it reports Endpoint url cannot have fully qualified paths. Loki-side protocol is controlled by insecure in the configuration and does not need scheme either |
| ENV_S3_BUCKET_LOKI | Bucket name for logs (Loki). Example: mdis-loki. ⚠️ Create this bucket in object storage before deployment. If the bucket does not exist, Loki reports NoSuchBucket and restarts repeatedly |
| ENV_S3_BUCKET_TEMPO | Bucket name for traces (Tempo). Example: mdis-tempo. Must be different from the Loki bucket, and must also be created in advance |
| ENV_S3_BUCKET | Old generic bucket name retained only for existing deployment compatibility (used only when the two variables above are both unset). ⚠️ Do not use it for new deployments: it is passed to both Loki and Tempo, and sharing a bucket prevents Tempo from starting |
| ENV_S3_ACCESS_KEY | S3 access key |
| ENV_S3_SECRET_KEY | S3 secret key |
| ENV_S3_FORCE_PATH_STYLE | Bucket addressing mode. true (default) = path-style, suitable for MinIO/UCloud US3. Tencent Cloud COS/Alibaba Cloud OSS support only virtual-host and must be set to false. Loki (AWS SDK) and Tempo (minio-go, internally mapped to forced DNS bucket_lookup_type) share this switch |
Alert Subsystem (Since 1.4.0)
Ops Platform 1.4.0 includes a self-developed alert subsystem. Alert configuration data (rules/status/history/notification channels/data sources) is stored in an independent ops-mongo container and is completely decoupled from monitored business MongoDB.
| Environment Variable | Description |
|---|---|
| ENV_OPS_MONGODB_URI | MongoDB connection address for the alert subsystem's own storage. Defaults to the built-in ops-mongo container. Example: mongodb://ops-mongo:27017 |
| ENV_MONGODB_COLLECTION_PREFIX | Unified collection name prefix for the alert subsystem. Example: mdis_ |
| ENV_ALERT_CRYPTO_KEY | AES encryption key used before data source credentials (password/URI) are written to the database. Must be changed to a random string during first deployment and kept safe. After changing the key, saved credentials cannot be decrypted and must be re-entered |
Alert notification channels (Feishu/DingTalk/WeCom/email/custom Webhook) are configured in the Ops Platform UI under "Alerts → Notification Channels" and are no longer configured through environment variables. SMTP server information for email channels is also filled in on that page.
Slow Query Diagnostics Tuning (Optional)
Adjust MongoDB slow-query capture sensitivity. Defaults are suitable for production. In test environments, lower the first two items if you need easier reproduction. See Slow Query Analysis for the complete description of the four capture conditions.
| Environment Variable | Description |
|---|---|
| ENV_GATEWAY_DOCS_EXAMINED | Minimum number of documents examined before a query is recorded. Default 100000. Queries that are slow but examine fewer documents are not recorded |
| ENV_GATEWAY_CAPTURE_INTERVAL_MS | Capture interval in milliseconds, default 600000 (10 minutes). After triggering a slow query, wait for the next capture interval |
| ENV_GATEWAY_PROFILE_SLOW_MS | slowms threshold in milliseconds that the Ops Platform sets for monitored databases, default 100 |
| ENV_GATEWAY_LOG_EXPIRE_MS | Retention duration of slow-query history in the Ops Platform's own database, in milliseconds. Default 604800000 (7 days) |
Configure these on the gateway service. One fixed condition is not configurable: the same query fingerprint must appear more than 50 times within the last 120 minutes.
Service Log Ingestion (Easy to Confuse, Read Carefully)
"Service Logs" queries logs pushed by HAP/HDP microservices to Loki.
| Configuration Location | Variable | Purpose | Default |
|---|---|---|---|
| HAP/HDP | ENV_LOKI_URL | Write-side switch: whether logservice pushes logs to Loki. If not configured, the installer sets StoreInLoki to false, and service logs are not written | Empty (not set) |
| Ops Platform | ENV_LOKI_URL | Query-side address: where the Ops Platform reads logs from | http://ops-loki:3100; no change required in standard deployment |
The two variables have the same name but different purposes. If the "Service Logs" page has no content, configure the HAP/HDP service-side variable, using a reachable address for the Ops Platform Loki
(for example, http://<Ops-Platform-host-IP>:3100), and restart the corresponding product services after configuration.