Connecting Grafana to ClickHouse

Connecting Grafana to a self-hosted ClickHouse cluster uses the signed Grafana Labs ClickHouse plugin, a read-only user and TLS. This page covers the setup sequence, the query builder versus SQL choice and the dashboard settings that keep large tables responsive.

On this page

Connecting Grafana to ClickHouse for dashboards you can trust

A team running a self-hosted ClickHouse cluster that wants Grafana dashboards over event, log or telemetry tables should use the signed ClickHouse data source plugin by Grafana Labs, installed from the Grafana UI. That is the method ClickHouse's own guide documents, and it is the path this section assumes. The plugin lets Grafana send SQL to ClickHouse and render the results as panels, with alerting and templated variables on top. It does not copy data into Grafana, does not add a caching layer between the two, and does not change how ClickHouse stores or indexes your tables.

Because Grafana queries ClickHouse directly, every panel refresh is a query against your cluster. Dashboard load therefore falls on the cluster's CPU, memory and disk, and on the number of users and panels refreshing at once. A dashboard that scans a large MergeTree table on a short refresh interval can be heavier than the ingestion pipeline feeding it. Before you go live, confirm with your ClickHouse administrator which tables the dashboards will hit, which time ranges are typical, and whether a dedicated read-only user and query limits are in place. Check the plugin's own documentation for the connection options and TLS settings your version supports, since these are configured in the Grafana data source and should be verified against the release you install.

The second risk is the Grafana side. Grafana stores its own configuration in a database, so a production instance needs MySQL or PostgreSQL rather than the default SQLite, and high availability requires shared database-backed sessions behind a load balancer. Plugin installation, provisioning files and access control for who can edit data sources all belong in the plan, because a data source with broad credentials is a route into the cluster. Confirm your Grafana version against the current support window, and treat the plugin version as a separate upgrade item to test on a non-production instance first.

What you need before connecting Grafana to ClickHouse

A working Grafana to ClickHouse connection depends on four things set up before the plugin is installed: a Grafana instance with a production-grade configuration database, a ClickHouse cluster on a supported release line, a read-only user that Grafana can log in as, and a network path with TLS that holds up under dashboard load. Each card below is a decision or check to settle first.

Grafana installation method

Grafana ships as packages for Debian and Ubuntu, RHEL and Fedora, SUSE, macOS and Windows, plus Docker images and Helm charts for Kubernetes. Choose the method your team can patch on the Grafana release cadence and keep the installation under configuration management. Small deployments under 25 concurrent users can run on 2 cores and 2 to 4 GB of RAM, but plan capacity for the number of dashboards refreshing against ClickHouse, not just the number of people logged in.

Production configuration database

Grafana stores dashboards, users and data source settings in SQLite 3 by default. The installation docs state SQLite does not scale for production, so use MySQL 8.0 or later or PostgreSQL 12 or later for production and any high availability design. Decide the database before the first dashboard is built, because moving configuration between databases later is extra work that delays the rollout.

Supported ClickHouse release line

Pin the cluster to a release line that still receives security updates. The ClickHouse security policy lists 26.9, 26.8, 26.7 and 26.3 as supported, and all other versions as unsupported. Stable releases suit most production use, while LTS releases ship twice a year and are supported for a year. Confirm the plugin supports your chosen ClickHouse version and your Grafana version before you install anything.

Dedicated read-only database user

Create a dedicated ClickHouse user for Grafana with SELECT grants only on the databases and tables its dashboards need. Do not reuse the default user, which starts with all permissions and should be restricted. Row policies and settings profiles can limit what each dashboard group sees and how much memory a query may use. Record who owns the account, where its password is stored, and how it is rotated.

Network path and firewall rules

Grafana must reach ClickHouse over the HTTP interface, which is where the plugin connects. Map the path from the Grafana servers, through any load balancer or proxy, to the ClickHouse nodes or a dedicated query endpoint. Confirm that only the Grafana subnet can reach the ClickHouse ports, and that browsers reach Grafana, not ClickHouse directly. Write this path down, because it becomes the first place to look when a data source test fails.

TLS certificates and trust chain

Issue certificates for the ClickHouse endpoint that Grafana connects to, and confirm the hostname in the certificate matches the name in the data source settings. Ensure the Grafana host trusts the internal certificate authority that signed it, and plan renewal before expiry. Also decide whether Grafana's own HTTPS and cookie settings will meet your policy, as the security hardening guide covers secure and SameSite cookies and a Content Security Policy.

How to install and configure the ClickHouse plugin in Grafana

This sequence takes a self-hosted Grafana instance from no ClickHouse connectivity to a first working panel on your cluster. Each step ends with a check you can run, so a failure is caught at the step where it was introduced rather than at dashboard build time.

  1. Install the signed ClickHouse plugin

    Install the ClickHouse data source plugin published by Grafana Labs, either from the Grafana UI plugin catalog or by declaring it in your provisioning configuration so the install is repeatable across environments. Confirm the plugin is signed by Grafana Labs in the plugin details before you install it, and record the plugin version alongside your Grafana version, since both change over time. The step is done when the plugin appears as installed on the Plugins page and Grafana restarts cleanly after the change.

  2. Create a read-only ClickHouse user

    On the ClickHouse side, have your database administrator create a dedicated user for Grafana with only the SELECT grants on the databases and tables its dashboards need, and attach a settings profile that limits query memory, execution time and result size. Do not reuse the default user, which starts with all permissions, and do not give Grafana write access it does not need. Confirm the grants by logging in as the new user and attempting an INSERT, which should be refused. The step is done when the restricted user can read the intended tables and cannot modify them.

  3. Enable TLS on the ClickHouse endpoint

    Decide which HTTP interface Grafana will use, typically the HTTPS port with the protocol set to secure in the data source, and confirm that the server presents a certificate that Grafana's host trusts. If your certificate is issued by an internal certificate authority, add that CA to the Grafana host trust store or supply it in the data source TLS settings. Verify the endpoint from the Grafana host with a simple certificate check before configuring Grafana, so that certificate problems are separated from plugin problems. The step is done when the handshake succeeds from the Grafana server itself.

  4. Create the data source with host and port

    In Grafana, add a new ClickHouse data source and enter the server host name, port, protocol, the read-only username and its password, and the default database if you want one. Keep the password in Grafana's secure settings rather than in plain provisioning files, and use the TLS options that match the certificate setup from the previous step. Save the data source and select the test action. The step is done when the test reports a successful connection and the data source is saved without errors.

  5. Verify the connection with a test query

    Open the Explore view with the new data source and run a short query against a system table, such as a count of tables visible to the user, then run a query against a known table in your environment. Compare the returned row count with the figure your data team gives for the same table, allowing for any ingestion lag they can describe. A mismatch usually points to the wrong database, a default database set incorrectly, or a row policy hiding rows from this user. The step is done when the expected row count comes back from a table you already know.

  6. Build the first dashboard panel

    Create a dashboard with one time series panel that reads from a table with a timestamp column, using either the query builder or raw SQL. Filter the query by the dashboard time range, and set a row limit or an aggregation so the panel does not return raw rows for a large table. Check the panel against a value you can reproduce directly in ClickHouse for the same interval, such as a count or sum. The step is done when the panel values match the independent query and the panel loads within the time you expect for your data volume.

Query builder or raw SQL for ClickHouse panels

The visual query builder suits analysts who want a quick aggregation over a known table without learning the schema in depth. It lets them pick a table, choose columns, apply a count, sum or average, group by a field and set a time column. The raw SQL editor suits engineers who know which ordering key, partition and time column the table uses and who need to control exactly what is read. Most teams give analysts the builder for exploration and keep shared operational dashboards in SQL, so the panels that run every few seconds are written by the people who understand their cost.

  • Analyst exploration: the builder is fast for ad hoc counts and breakdowns on small or well-indexed tables.
  • Engineering dashboards: SQL is the default for panels that feed incident response or capacity views.
  • Review path: agree which dashboards may use the builder before they are shared with the wider organization.
  • Schema knowledge: the builder hides the ordering key, so users may not realize a filter is missing.
  • Ownership: name an owner for each shared panel who can explain its query.

Confirm with your Grafana and ClickHouse plugin versions which builder options are available in your release, since the plugin documentation is the reference for supported features.

Mapping ClickHouse tables, users and time fields to Grafana

This table maps each part of a Grafana data source setup to the ClickHouse object it depends on, so the team can see where access, time filtering and dashboard variables are decided. Read it top to bottom when preparing the data source, then check the last rows against the plugin settings in your own environment. The main takeaway is that Grafana only sees what the connected ClickHouse user is allowed to read, so access control belongs in ClickHouse rather than in dashboard design.

Grafana settingClickHouse objectWhat to decide or confirm
Default database and tablesDatabase and MergeTree tablesPoint panels at tables built for dashboard queries, and confirm each table name and database in the plugin's query editor.
Time columnDateTime or DateTime64 column in the ordering keyFilter on the time column that leads the ORDER BY key, so range scans on large tables read fewer granules.
Dashboard variablesFiltered columns in the tableMap each variable to a column that appears early in the ordering key, so variable filters prune data instead of scanning it.
Data source credentialsDedicated read-only ClickHouse userCreate a separate user with SELECT grants only, and do not reuse the default user, which starts with all permissions.
Team visibilityRoles and row policiesGrant roles per team and use row policies to restrict rows, so each Grafana team sees only the data its users are entitled to.
Connection securityHTTPS or native TLS endpointConfirm that the plugin connects over TLS and that the certificate chain is trusted by the Grafana server.
Query limitsSettings profiles and quotasAttach a settings profile and quota to the Grafana user so that heavy dashboard queries cannot exhaust the cluster.
Plugin versionSigned ClickHouse plugin by Grafana LabsConfirm the installed plugin version against the one your Grafana release supports before connecting production data.

Keeping dashboards fast on large ClickHouse tables

Dashboards over billions of rows stay fast only when every panel reads a bounded slice of the table. The first control is a time filter on the column that leads the table's ordering key, so ClickHouse can skip the parts and granules outside the requested window instead of scanning the full history. In the Grafana ClickHouse data source, use the macros for time range filtering in the query builder or in SQL mode, and confirm that the filter lands on the ordering key column by checking the query plan for the table you actually query. A panel that filters only on a non-key column, or that omits the time condition, will scan far more data than the chart shows.

The second control is moving repeated work out of panels. Panels that compute the same daily or hourly aggregate on every refresh are candidates for a materialized view that writes pre-aggregated rows into a summary table, which the dashboard then reads. Set a row limit on table panels and cap the number of points returned to a time series panel, so a single panel cannot pull millions of rows into the Grafana server. Refresh intervals should not be shorter than the interval at which data arrives, because refreshing faster than new rows land only repeats identical queries. Ask the team that owns the ClickHouse cluster which summary tables exist and which retention applies to them before you publish a dashboard.

Query cost lands on the ClickHouse cluster, not on Grafana, so the number of panels and their refresh rates are capacity decisions. Each dashboard with twenty panels refreshing every few seconds multiplies load across every viewer who keeps it open. Agree on a panel budget per dashboard, use the read-only user and its settings profile or quotas to bound what Grafana can consume, and test the heaviest dashboards against a representative dataset before release. Tuning the schema, skip indexes and resource controls is covered in the ClickHouse performance tuning and schema design topic, and the metrics that show dashboard load on the cluster are covered in the ClickHouse monitoring and operations topic.

Security settings for the Grafana to ClickHouse connection

Grafana sits between your users and your ClickHouse cluster, so it needs its own database identity, encrypted transport and a locked-down Grafana server. The cards below cover the ClickHouse side of the connection, the Grafana web layer and the authentication choice that depends on your Grafana edition.

Dedicated read-only ClickHouse user

Create a separate ClickHouse user for Grafana with only the SELECT grants its dashboards need, and assign it through a role rather than granting rights directly. Add a settings profile that caps query memory and execution time, and a quota that limits queries per time window, so one dashboard refresh cannot exhaust the cluster. Confirm the exact settings and quota fields in your ClickHouse version before you deploy, because a dashboard that works for an administrator may fail under these limits and needs tuning, not a loosened profile.

TLS on the Grafana to ClickHouse path

Enable TLS on the ClickHouse HTTP interface and configure the Grafana data source to verify the server certificate against your internal certificate authority. Do not disable certificate verification to get a connection working, because that leaves the database credentials exposed on the network. Check that the certificate names match the host name Grafana uses, and plan certificate renewal alongside the rest of your cluster certificates so dashboards do not fail on expiry.

Restricting the ClickHouse default user

ClickHouse ships with a default user that starts with all permissions, so a Grafana connection that falls back to it would have full administrative reach. Restrict or disable the default user, and confirm that no Grafana data source, provisioning file or environment variable uses it. Test this by attempting a privileged statement with the Grafana credentials and expecting a permission error.

Row policies for tenant separation

If several teams or customers share one table, use ClickHouse row policies to filter rows by user or role, so the same dashboard returns only the tenant's data. Build the policy on the identity that Grafana actually connects with, and remember that a single shared Grafana data source connects as one database user, so per-viewer separation needs separate data sources or a different identity model. Verify each policy with test users and a known row set before you rely on it.

Grafana cookie and content security hardening

Set secure and SameSite cookies, enable a Content Security Policy and Trusted Types, hide the Grafana version from unauthenticated users, and require authentication for the metrics endpoint. Also confirm domain verification is in place against DNS rebinding. Apply these in the Grafana configuration file and test the plugin page, since a strict policy can block parts of the ClickHouse plugin UI until its needed sources are allowed.

Authentication options by Grafana edition

LDAP, generic OAuth, Entra ID, Okta, GitHub, GitLab, Google OAuth, auth proxy and JWT are available in all editions. SAML, team sync, active sync and SCIM provisioning are available only in Grafana Enterprise and Grafana Cloud, so if your identity policy requires SAML or SCIM, confirm the edition and its licensing terms before design. Decide early whether Grafana or your identity provider owns role assignment, because that choice determines which users can reach which data sources.

Common Grafana to ClickHouse connection and dashboard failures

This table lists the failures teams most often hit when Grafana reads a self-hosted ClickHouse cluster, with the likely cause and the fix for each. Use it as a triage sheet after install, during first connection tests, and when dashboards slow down as panels are added. Confirm plugin and ClickHouse version pairing against the plugin documentation before changing anything else.

SymptomLikely causeFix
Plugin not found after installThe plugin was installed on a different Grafana host, the container was not restarted, or the plugin folder path differs from the one Grafana loadsConfirm the plugin appears in the Grafana plugin list on the instance serving users, restart Grafana, and check the server log for plugin load errors
Data source test fails on TLS or certificate trustGrafana does not trust the CA that signed the ClickHouse HTTPS certificate, or the hostname does not match the certificateAdd the internal CA to the Grafana host trust store, match the server name to the certificate subject, then retest from the Grafana host itself
Authentication error from the read-only userThe user lacks grants on the database or table, the password is wrong, or the user is restricted to an address Grafana does not connect fromGrant SELECT only on the needed databases, check the user's allowed host settings, and test the same credentials with a client run from the Grafana host
Timeouts on wide time rangesQueries scan many parts because the time filter is missing, the table ordering key does not lead with time, or the panel's time range macro is not appliedEnsure every panel filters on the time column, confirm the ordering key supports that filter, and cap default ranges on heavy dashboards
Panels return no rows because of time zoneGrafana renders in the browser time zone while ClickHouse stores or returns DateTime values in server or column time zoneSet the same time zone in the data source and panel settings, and compare one sample row in Explore against a direct query
Panels return no rows because of DateTime type mismatchThe time column is a String or a Date type where a DateTime or DateTime64 is expected, so the macro-generated filter compares the wrong typesConvert the column in the query or view, use the time column type the plugin expects, and verify the filter with a SQL editor query first
Dashboard load spikes after adding panelsEach panel sends its own query on every refresh, and short refresh intervals multiply load across many concurrent viewersReduce refresh frequency, aggregate in materialized views where possible, and review query count per dashboard before publishing
Query builder output differs from hand-written SQLThe builder generates a general form that may not use the best ordering key or skip index that a tuned SQL query wouldSwitch the panel to SQL mode for heavy queries and review the generated statement with EXPLAIN before reuse

Questions buyers ask about connecting Grafana to ClickHouse

How long does it take to connect Grafana to a self-hosted ClickHouse cluster?

The plugin install and a first query can be done in a short session, but a production connection takes longer because the work depends on how many users, dashboards and tables are involved. Duration is driven by four things: whether Grafana already runs in a supported database-backed setup, how many read-only ClickHouse users and roles you need, whether TLS is enforced end to end, and how much dashboard tuning your largest tables require. No duration is quoted here. Ask any partner, including DeployOpen, for a timeline tied to a written scope that lists these items.

Can our own team connect Grafana to ClickHouse without a partner?

Yes, many teams do. The ClickHouse guide installs the signed ClickHouse plugin by Grafana Labs from the Grafana UI, and the connection itself is standard configuration. The harder parts are access design, TLS, and keeping dashboards fast on large tables, which need someone who understands ClickHouse table layout and query cost. A partner is most useful when you want those decisions made and documented before dashboards spread across teams.

What does our staff need to provide for the engagement?

Plan for access and knowledge rather than heavy effort from your staff. You will need someone who can create ClickHouse users and roles, someone who manages the Grafana server and its configuration, and a person who knows the business meaning of the main tables and the questions dashboards must answer. Confirm who approves production changes and where Grafana configuration is kept, since provisioning files are typically reviewed like any other code.

What does a DeployOpen engagement cover for Grafana and ClickHouse, and how is it quoted?

Most DeployOpen engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. For this topic, a written scope would typically name the Grafana version and deployment method, the ClickHouse users and roles to create, the TLS configuration, the provisioning approach, the dashboards to tune and the handover. DeployOpen does not publish a price list, so the quote follows from that written scope. Ask for the deliverables list and what is excluded before comparing offers.

Do we need Grafana Enterprise to connect Grafana to ClickHouse?

No. The ClickHouse data source plugin is installed from the Grafana UI and does not depend on the Enterprise edition. Enterprise matters for other features: according to the Grafana authentication docs, SAML, team sync, active sync and SCIM provisioning are available only in Grafana Enterprise and Grafana Cloud, while LDAP, generic OAuth, Entra ID, Okta and similar options are available in all editions. Grafana Enterprise is a commercial option, and Grafana's licensing page describes the AGPLv3 license that applies to Grafana itself. Check your identity requirements before deciding.

How are upgrades of Grafana and the ClickHouse plugin handled?

Treat Grafana and the plugin as separate components with their own release cadence. According to Grafana's upgrade guidance, major releases come once a year in April or May, minor releases every other month and patch releases at least monthly, with each minor release supported for 9 months and the last minor release of a major version for 15 months. Before any upgrade, read the changelog, test the plugin version against a copy of your dashboards and a representative ClickHouse user, and keep provisioning files under version control so a rollback is a known action.

Will dashboards on very large ClickHouse tables stay fast?

They can, but only if queries are designed for the table. Dashboards that scan raw event tables on every refresh are the most common cause of slow panels. Good practice includes filtering on the table's ordering key, using time range variables, limiting refresh rates, and querying aggregated tables or materialized views for high-level panels. Ask your partner or your own team to review the top queries against the cluster's system tables before dashboards go to all users.

Official sources for the Grafana and ClickHouse integration

Start with the ClickHouse data source plugin guide from ClickHouse's documentation, because it describes the plugin that connects Grafana to your cluster and the installation steps the rest of this page builds on. Read it alongside the Grafana installation documentation, which covers the packages and container images available for your platform, and the Grafana high availability documentation, which sets out what a shared database and multiple Grafana servers require. If you plan to run more than one Grafana node, the high availability guidance is the document that determines your database choice, so read it before you install anything. Keep the ClickHouse data source plugin guide open while you work through the rest of this page.

Then read the Grafana security hardening documentation before you expose the instance to users. It covers cookie settings, a Content Security Policy, hiding the version from unauthenticated visitors, requiring authentication for the metrics endpoint and domain verification against DNS rebinding. Each of these is a configuration decision you will need to make and record, not a default you can assume is already set. Also confirm the plugin's own requirements in its guide, including the ClickHouse protocol and TLS settings it expects, since those determine how you create the read-only user described later.

Finally, check the release notes for the exact Grafana and plugin versions you run, not just the latest line. Grafana publishes major, minor and patch releases on different schedules, and its upgrade guidance states how long each minor release is supported, so confirm which lines are still receiving fixes before you standardize on one. Record the versions you tested in your change log, and repeat this check whenever you upgrade either Grafana or the ClickHouse plugin, because a plugin update can change how queries are built or how the data source is configured.

How DeployOpen scopes and delivers the Grafana and ClickHouse connection

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For this connection, we start from a written scope covering the Grafana installation, the ClickHouse users and TLS settings, and the dashboards your teams need, then build and test it in your environment before handover.

How we scope

  • Inventory the Grafana version, hosting model, and the ClickHouse clusters and databases each dashboard reads from.
  • Agree in writing which read-only ClickHouse users, TLS settings and provisioning files are in scope.
  • Define which dashboards, query builder panels and raw SQL panels are delivered, and who reviews them.

How we build

  • Install the signed ClickHouse data source plugin from Grafana Labs on your Grafana servers and record the plugin version.
  • Configure restricted ClickHouse users, TLS to the cluster, and data source definitions loaded through provisioning files.
  • Test dashboard load on representative large tables and tune panel time ranges and query patterns before release.

How we hand over

  • Provide the written configuration, provisioning files, user and grant inventory, and the dashboard catalog.
  • Document upgrade steps for Grafana and the ClickHouse plugin, including how to confirm compatibility before upgrading.
  • Walk your operators through credential rotation, adding dashboards, and the checks used to confirm the connection works.

How we support

  • Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the build.
  • Retainers can cover plugin and Grafana patch updates, dashboard reviews and periodic restore and access checks.
  • Confirm with DeployOpen during scoping which support hours, response expectations and upgrade cycles apply to your environment.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.