Correlations

Row-level deep links take an enriched NetBox row back to the NetBox web UI. Grafana Correlations go the other way: from any datasource's results (a Prometheus series, a Loki log line) into a NetBox query, pre-filtered to the thing you clicked. Navigation, not value-join: no transform chain, no dashboard required.

Where they appear

Correlations render in Explore only (table and logs visualizations), not on dashboard panels. Grafana shows a link button on the configured results field; clicking it runs the target NetBox query in a split pane. For the dashboard-side equivalent, see Dashboard drill-downs below.

Provisioning recipe

Correlations are instance-level Grafana configuration (a plugin cannot bundle them), so you declare them in datasource provisioning, on the source datasource entry. Two gotchas:

1. correlations: sits at the top level of the datasource entry, a sibling of jsonData, not inside it.
2. Provisioning files interpolate ${VAR} from the environment at load time. Escape correlation variables as $${device} so Grafana receives the literal ${device}.

The demo stack ships these, plus a dst_ip twin of the source-IP hop (see provisioning/datasources/datasources.yml):

datasources:
  - name: Prometheus
    type: prometheus
    uid: prometheus
    url: http://prometheus:9090
    correlations:
      # Metric label `device` -> NetBox device details.
      - targetUID: netbox # your NetBox datasource uid
        label: 'NetBox: device details'
        type: query
        config:
          field: device # the results field that gets the link
          target:
            queryType: objects
            objectType: dcim/devices
            filters:
              - field: name
                operator: ''
                value: $${device} # literal ${device} after provisioning
            limit: 10
      # Flow label `src_ip` -> longest-prefix IPAM context.
      - targetUID: netbox
        label: 'NetBox: source IP context'
        type: query
        config:
          field: src_ip
          target:
            queryType: ip-enrichment
            ips: $${src_ip}

config.target is this datasource's own query model, the same JSON the query editor produces (queryType, objectType, filters: [{field, operator, value}], ips, …). The clicked row's field values are available as ${<field name>} variables.

Logs (Loki): extract the host from stream labels

Loki log frames carry stream labels in a labels field, which Grafana JSON-stringifies before applying correlation transformations (the regex is a raw JS pattern, no surrounding slashes). Extract the label you need into a variable:

- name: Loki
  type: loki
  uid: loki
  url: http://loki:3100
  correlations:
    - targetUID: netbox
      label: 'NetBox: device details'
      type: query
      config:
        field: labels
        transformations:
          - type: regex
            field: labels
            expression: '"host":\s*"([^"]+)"'
            mapValue: host
        target:
          queryType: objects
          objectType: dcim/devices
          filters:
            - field: name
              operator: ''
              value: $${host}
          limit: 10

If your log lines carry key=value pairs instead, use the logfmt transformation on the Line field; every pair becomes a variable.

Dashboard drill-downs (data links)

Correlations don't render on dashboard panels; the complement there is a data link that opens Explore with a pre-filled NetBox query. On a table panel, attach it to the device column as a field override and interpolate the row value:

/explore?schemaVersion=1&panes={"nb":{"datasource":"<netbox-uid>","queries":[{"refId":"A","queryType":"objects","objectType":"dcim/devices","filters":[{"field":"name","operator":"","value":"${__data.fields.Device}"}],"limit":10}]}}

• Use the dot form ${__data.fields.Device}. Grafana resolves field paths with lodash's property(), which does not parse quoted bracket paths; keep the column name free of ., } and :.
• Percent-encode the panes JSON but leave $ { } raw so the variable interpolates at click time.
• The demo dashboard ships this on its device tables, generated by demo/mkdash2.py (netbox_device_link), which is the easiest starting point to copy.

Demo

./demo/run.sh provisions all of the above. Try it:

1. Explore → Prometheus → device_up (table view) → click the link on a device value → the NetBox devices query opens filtered to that device.
2. Explore → Prometheus → flow_bytes_total → links on src_ip/dst_ip run IP enrichment (longest-prefix match) for the clicked IP.
3. Explore → Loki → {job="syslog"} → expand a log line → the correlation on its labels jumps to the emitting device.
4. Dashboard → "Device CPU" or "Top talkers" table → click a device name → Explore opens pre-filtered.