On this page
Why a custom scrape target
Not every backend has a first-class exporter card. Traefik ingress stats, controller RED metrics, VictoriaMetrics, or a sidecar you already run all speak Prometheus exposition. The Custom Prometheus card scrapes that URL and keeps secrets on your host.
This post mirrors the copy-paste path on [/exporters/custom/scoped-user](/exporters/custom/scoped-user). Use that page when you want the short checklist; stay here for the end-to-end story (URL, labels, optional env auth, private-IP note).
Expose `/metrics` and lock the network
Bind the handler on an interface the agent can reach. Prefer network isolation even when you also enable Bearer or Basic auth.
Check: does `/metrics` answer?
From a host that should reach the target, the first lines should be Prometheus exposition (`# HELP` / `# TYPE` or metric samples).
curl -sS http://TARGET:9100/metrics | headWhat to look for: HTTP 200 with Prometheus text. Connection refused / timeout means fix bind + firewall before adding the exporter.
Fix: NetworkPolicy / firewall before optional auth
Auth is optional. Restrict who can scrape first — same shape as our MongoDB / ClickHouse how-tos.
Verify it worked: # From outside the agent namespace — expect timeout / refused.
curl --max-time 5 http://TARGET:9100/metrics
Note: Full steps live on [/exporters/custom/scoped-user](/exporters/custom/scoped-user).
Add the Custom Prometheus card
In the console: Add Exporter → Custom Prometheus. Paste the URL (path must be `/metrics`; empty path is normalised). Optional interval 15–300s (default 60). Optional static labels attach to every series.
Label keys must match `^[a-zA-Z_][a-zA-Z0-9_]*$` with no `__` prefix. Values are limited to `^[a-zA-Z0-9_./:-]{1,64}$`. Never put credentials in the URL userinfo.
Optional authentication — Bearer or Basic via env
Choose None (default), Bearer (env), or Basic (env). We mint `EXPORTER_<id>_BEARER_TOKEN` or `EXPORTER_<id>_USER` / `_PASSWORD` and store only the names. Set the values on the agent host from the install snippet after save.
# Install snippet excerpt after save (Bearer):
EXPORTER_exp_abc123_BEARER_TOKEN='<your-bearer-token>' \
# or Basic:
EXPORTER_exp_abc123_USER='<your-basic-user>' \
EXPORTER_exp_abc123_PASSWORD='<your-basic-password>' \Verify it worked: # After install, confirm the env names appear on the agent host — never in site-main DB.
Verify series and private-IP policy
Look for `up{job="custom",…}` plus your static labels. Private RFC1918 / link-local / loopback targets are blocked unless `CUSTOM_EXPORTER_ALLOW_PRIVATE` is enabled for platform operators.
Check: series in Explore
Query your Prometheus-compatible Explore view for the custom job and labels.
# Example PromQL:
# up{job="custom",component="traefik"}What to look for: `up` samples at 1 when the scrape succeeds. Auth failures usually show as `up=0` with scrape errors in agent logs.