> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ewake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Thanos

> Connect Thanos to give ewake access to your long-term, global PromQL metrics for anomaly detection and root cause analysis.

<Info>
  **What you'll get:** ewake can query your Thanos data with PromQL across your full retention and every cluster, detect anomalies, and correlate data points with alerts and deployments, without requiring manual query construction.
</Info>

***

## Prerequisites

* A Grafana instance (Cloud or self-hosted) with a **Prometheus-type data source pointing at Thanos Query** already configured
* Admin access to create a Service Account in Grafana

<Note>
  Ewake reads Thanos **through your Grafana data source proxy**, so you connect Grafana once rather than exposing Thanos directly. Ewake resolves the data source automatically — when several Prometheus-type data sources exist, it identifies the one backed by Thanos Query.
</Note>

***

## Configuration

<Steps>
  <Step title="Create a Service Account in Grafana">
    In Grafana, go to **Administration** → **Service Accounts** → click **Add service account**.

    Set the role to **Viewer**, ewake only needs read access.

    Once the account is created, click **Add service account token** → copy the token immediately.

    <Note>
      Copy the token now, you won't be able to see it again after closing the modal.
    </Note>
  </Step>

  <Step title="Get your Grafana instance URL">
    **Grafana Cloud:** Your instance URL follows the format `https://yourorg.grafana.net`.

    **Self-hosted:** Use the base URL of your Grafana instance (e.g. `https://grafana.yourcompany.com`).
  </Step>

  <Step title="Open the Thanos integration in ewake">
    In your ewake dashboard, go to **Integrations** → **Thanos** → click **Connect with API key**.
  </Step>

  <Step title="Enter your credentials">
    | Field           | Value                                                                 |
    | --------------- | --------------------------------------------------------------------- |
    | **Grafana URL** | Base URL of the Grafana instance that proxies your Thanos data source |
    | **API Key**     | The service account token generated in Step 1                         |

    <Note>
      If your Grafana sits behind an authenticating proxy (e.g. Cloudflare Access), add its service-token headers under **Custom headers** — ewake sends them with every request.
    </Note>
  </Step>

  <Step title="Test and save">
    Click **Test connection** to verify the connection, then click **Save**.

    <Check>
      Thanos is connected. Ewake can now query your metrics during investigations.
    </Check>
  </Step>
</Steps>

***

## Behind Cloudflare Access or a proxy

If your Grafana instance sits behind an authenticating proxy, add the credentials it expects under **Custom headers** in the same dialog.

For a Cloudflare Access service token that means two headers:

| Header                    | Value                             |
| ------------------------- | --------------------------------- |
| `CF-Access-Client-Id`     | The service token's client ID     |
| `CF-Access-Client-Secret` | The service token's client secret |

Ewake sends these with every request. Values are stored encrypted, and are not shown again after saving, leaving the fields empty when you edit the connection keeps the headers you already saved.

<Note>
  Without this, a connection test against a proxied endpoint fails with an authentication or redirect error even though the URL and API key are both correct. It's the most common cause of a test failing on a working instance.
</Note>

***

<Note>
  Ewake uses **read-only** PromQL queries. It never writes metrics or modifies your Thanos or Grafana configuration.
</Note>