"multi": false,
        "name": "service",
        "options": [],
        "query": "query_result(sum(istio_requests_total{}) by (destination_service) or sum(istio_tcp_sent_bytes_total{}) by (destination_service))",
        "refresh": 1,
        "regex": "/.*destination_service=\"([^\"]*).*/",
        "skipUrlSync": false,
        "sort": 0,
        "tagValuesQuery": "",
        "tagsQuery": "",

          "format": "time_series",
          "hide": false,
          "intervalFactor": 1,
          "legendFormat": "{{ destination_service }}",

    source_workload=~\\\"$workload\\\",response_code!~\\\"5.*\\\", destination_service=~\\\"$dstsvc\\\"}[5m]))
    by (destination_service) / sum(irate(istio_requests_total{reporter=\\\"source\\\",
    connection_security_policy=\\\"mutual_tls\\\", source_workload_namespace=~\\\"$namespace\\\",
    source_workload=~\\\"$workload\\\", destination_service=~\\\"$dstsvc\\\"}[5m]))

    content: |
      Host header fallback for determining values for Prometheus `destination_service` labels has been disabled for all incoming traffic.
      Previously, this was disabled *only* for traffic arriving at Gateways. If you are relying on host header fallback behavior to properly
      label the `destination_service` in Prometheus metrics for traffic originating from out-of-mesh workloads, then you will need to update the telemetry

, source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\",response_code!~\"5.*\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service) / sum(irate(istio_requests_total{reporter=\"source\", connection_security_policy=\"mutual_tls\", source_workload_namespace=~\"$namespace\", source_workload=~\"$workload\", destination_service=~\"$dstsvc\"}[5m])) by (destination_service)", "format": "time_series", "hide": false, "intervalFactor": 1, "legendFormat": "{{ destination_service...

              {
                "id": "custom.align"
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "destination_service"
            },
            "properties": [
              {
                "id": "displayName",
                "value": "Service"
              },
              {

						"reporter":                 "source",
						"destination_service_name": "BlackHoleCluster",
						"source_workload":          "client-v1",
					},
				},
			},
		},
	}

	// destination_service="BlackHoleCluster" does not get filled in when using sidecar scoping
	RunExternalRequest(t, cases, prom, RegistryOnly)

	labels := map[string]string{
		"request_protocol":               "http",
		"response_code":                  "200",
		"destination_app":                "b",
		"destination_version":            "v1",
		"destination_service":            "b." + ns.Name() + ".svc.cluster.local",
		"destination_service_name":       "b",
		"destination_workload_namespace": ns.Name(),
		"destination_service_namespace":  ns.Name(),

	labels := map[string]string{
		"request_protocol":               "http",
		"response_code":                  "2xx",
		"destination_app":                "b",
		"destination_version":            "v1",
		"destination_service":            "b." + apps.Namespace.Name() + ".svc.cluster.local",
		"destination_service_name":       "b",
		"destination_workload_namespace": apps.Namespace.Name(),
		"destination_service_namespace":  apps.Namespace.Name(),

		"response_flags":                 "-",
		"connection_security_policy":     "mutual_tls",
		"destination_canonical_service":  dst.ServiceName(),
		"destination_canonical_revision": dst.Config().Version,
		"destination_service":            fmt.Sprintf("%s.%s.svc.cluster.local", dst.Config().Service, destns),
		"destination_principal":          fmt.Sprintf("spiffe://cluster.local/ns/%v/sa/%s", destns, dst.Config().AccountName()),