// file included in the following:
//
// record-encryption-guide/assembly-monitoring-record-encryption-filter.adoc

[id='con-monitoring-record-encryption-filter-{context}']
= Record Encryption filter metrics

[role="_abstract"]

The filter emits metrics that provide insights into its interactions with the configured KMS.
They indicate the load the filter places on the KMS infrastructure and how often its interactions with the KMS fail.

The filter emits metrics that count the number of records that are being encrypted.
This can help you verify that the filter is configured properly and encrypting specific topics as intended.

These metrics are made available automatically once metrics are enabled in the proxy.

== KMS metrics

KMS metrics track and count the following types of interactions:

* Generating DEK pairs
* Decrypting EDEKs
* Resolving KEK aliases

.KMS metrics
|===
|Metric Name |Type |Labels|Description

|`kroxylicious_kms_operation_attempt_total`
|Counter
|`operation`
|Count of the number of KMS operations attempted.

|`kroxylicious_kms_operation_outcome_total`
|Counter
|`operation`, `outcome`
|Count of the number of KMS operations grouped by outcome.
|===

.Labels used on the KMS metrics
|===
|Label|Domain|Description

|`operation`
|`generate_dek_pair`, `decrypt_edek`, `resolve_alias`
|Type of operation performed.

|`outcome`
|`SUCCESS`, `EXCEPTION`, `NOT_FOUND`
|Result of the operation.
|===

== Encryption accounting metrics

Encryption accounting metrics count the number of records sent to topics that are encrypted and the number of records sent to topics that are not configured for encryption.
These metrics are discriminated by topic name.
Use these metrics to confirm you configuration is having the effect you desired.

.Encryption accounting metrics
|===
|Metric Name |Type |Labels|Description

|`kroxylicious_filter_record_encryption_encrypted_records`
|Counter
|`topic_name`
|Count of the number of records encrypted by the filter.

|`kroxylicious_filter_record_encryption_plain_records`
|Counter
|`topic_name`
|Count of the number of records _not_ encrypted by the filter.
|===
