overview of monitoring
Change-Id: I56d4697f8cdad716b48fce36cf99b1854493671b
diff --git a/images/diag_overview.png b/images/diag_overview.png
new file mode 100644
index 0000000..9a059c8
--- /dev/null
+++ b/images/diag_overview.png
Binary files differ
diff --git a/operating_cord/diag.md b/operating_cord/diag.md
index 6f45f4c..5e717d0 100644
--- a/operating_cord/diag.md
+++ b/operating_cord/diag.md
@@ -1,5 +1,25 @@
# Monitoring and Logging
CORD is usually configured with monitoring and logging capabilities,
-built around Prometheus and ELK Stack, respectively. Both work on
-events/logs posted to Kafka and display results on a Kibana dashboard.
+built around Prometheus and ELK Stack, respectively. Both consume
+events/metrics/logs posted to Kafka. The data they collect can be
+viewed on their respective dashboards:
+
+* **Metrics:** Collected by [Prometheus](https://prometheus.io/)
+ and viewable using [Grafana](http://docs.grafana.org/) at port 31300.
+
+* **Logs:** Collected by [Elk Stack](https://www.elastic.co/elk-stack)
+ and viewable using
+ [Kibana](https://www.elastic.co/guide/en/kibana/current/index.html)
+ at port 30601.
+
+The following figure give a high-level overview of the monitoring and
+logging system.
+
+
+
+The monitoring and logging pipelines both share a Kafka bus, with
+event topics assigned accordingly (e.g., `component.kpis.*` and
+`component.log.*`). Components also post other events to Kafka,
+but their topics are currently ad hoc and rapidly evolving.
+Rationalizing the event schema is on the near-term roadmap.
