Querying as a Tenant Admin
Tenant administrators need to scope all observability queries to their tenant's data. This page covers how to use dashboard template variables and direct LogQL/PromQL queries to see only your tenant's executions, logs, metrics, and HIL backlog.
Using Dashboard Variables for Tenant Scoping
All pre-built BizFirstGO dashboards include a $tenant template variable in the top bar:
Open any BizFirstGO dashboard
Navigate to Dashboards → BizFirstGO folder → Flow Studio Overview (or any other dashboard).
Set the $tenant variable
In the top bar, find the tenant dropdown. Click it and select your tenant ID (e.g., "tenant-abc"). All panels immediately refresh to show only your tenant's data.
Set the $environment variable
Select your environment (production, staging) from the environment dropdown. For a tenant admin, this is typically always "production".
Tenant-Scoped LogQL Queries
# All queries must include tenant_id label to see only your tenant's data:
# Find all error logs for your tenant in the last hour:
{job="processengine", tenant_id="tenant-abc", level="error"} | json
# Find all executions for your tenant:
{job="processengine", tenant_id="tenant-abc"} | json | message =~ ".*Execution.*"
# Find your tenant's HIL pending tasks:
{job="processengine", tenant_id="tenant-abc"} | json | hilStatus = "pending"
# Count your tenant's log volume over time:
sum(count_over_time({tenant_id="tenant-abc"}[5m]))Tenant-Scoped PromQL Queries
# All metric queries should filter by tenant_id:
# Your tenant's current workflow execution rate:
sum(rate(bizfirst_workflow_executions_total{tenant_id="tenant-abc"}[5m]))
# Your tenant's error rate:
sum(rate(bizfirst_workflow_executions_total{tenant_id="tenant-abc", status="failed"}[5m]))
/
sum(rate(bizfirst_workflow_executions_total{tenant_id="tenant-abc"}[5m]))
* 100
# Your tenant's HIL backlog:
bizfirst_hil_pending_count{tenant_id="tenant-abc"}
# Your tenant's P99 workflow execution latency:
histogram_quantile(0.99,
sum(rate(bizfirst_workflow_executions_duration_seconds_bucket{tenant_id="tenant-abc"}[5m]))
by (le)
)What Tenant Admins Cannot See
| Data | Accessible to Tenant Admin? | Why |
|---|---|---|
| Other tenants' log streams | No | Loki multi-tenancy enforcement (X-Scope-OrgID) |
| Other tenants' metrics | No (with Grafana access control) | Tenant-scoped Grafana data source or dashboard folder access control |
| Platform-level metrics (CPU, memory) | No | Infrastructure dashboard restricted to platform-team role |
| Other tenants' traces | No | Tempo does not natively support multi-tenancy; span attributes contain tenant_id for post-query filtering |
| Grafana audit logs | No | Admin-only data source |
Grafana dashboard URLs include the current variable state. After setting $tenant=tenant-abc and $environment=production, copy the browser URL and save it as a bookmark. Sharing this URL with your team opens the dashboard pre-scoped to your tenant — no manual variable selection required.