ClickHouse

Encrypting network traffic

It is a best practice to encrypt network traffic between the Looker application and your database. Consider one of the options described on the Enabling secure database access documentation page.

To enable SSL encryption on the server side, see the ClickHouse Global Server Settings documentation.

Users and security

First, configure your Looker user on the ClickHouse server. ClickHouse database users are not created with the CREATE USER command. Follow the ClickHouse access rights documentation to configure the users section in the users.xml file. Here is a basic example:

<!-- Users and ACL. -->
<users>
    <looker>
        <password>CHANGEIT</password>
        <networks incl="networks" />
        <profile>default</profile>
        <quota>default</quota>
    </looker>

    <web>
        <password></password>
        <networks incl="networks" />
        <profile>web</profile>
        <quota>default</quota>
        <allow_databases>
           <database>test</database>
        </allow_databases>
        <allow_dictionaries>
           <dictionary>test</dictionary>
        </allow_dictionaries>
    </web>
</users>

Also within this file, configure the appropriate database access.

<allow_databases>
    <database>database_1</database>
    <database>database_2</database>
    <database>database_3</database>
</allow_databases>

Creating the Looker connection to your database

In the Admin section of Looker, select Connections, and then click Add Connection.

Fill out the connection details. The majority of the settings are common to most database dialects. See the Connecting Looker to your database documentation page for information. Some of the settings are described next:

  • Dialect: ClickHouse.
  • Host: Reachable hostname.
  • Port: Port on which the ClickHouse service is reachable over HTTP(S).
    • By default, HTTP connections will use 8123, and HTTPS will use 8443.
    • Port 9000 and 9440 are by default used by the ClickHouse command line client, but these ports cannot be used by Looker to connect to ClickHouse.
    • Your ClickHouse administrator may have chosen alternate ports with the http_port/https_port settings in the ClickHouse configuration. Ask your ClickHouse admin for the settings appropriate to your local configuration.
  • Database: Database name (must be one of the databases allowed in the users.xml file).
  • Username: Database username.
  • Password: Database password.
  • Additional JDBC parameters: (Optional) Additional JDBC string parameters.
  • Datagroup and PDT Maintenance Schedule: ClickHouse does not support PDTs, so this can be ignored.
  • SSL: Check to connect to ClickHouse over SSL.
  • Verify SSL: (Optional) Check to enforce strict hostname verification on the ClickHouse server. Check this only if you are using an SSL certificate that is signed by a generally trusted Certificate Authority. If you are using a self-signed SSL certificate, leave it unchecked.

To verify that the connection is successful, click Test. See the Testing database connectivity documentation page for troubleshooting information.

To save these settings, click Connect.

Feature support

For Looker to support some features, your database dialect must also support them.

ClickHouse supports the following features as of Looker 24.12:

Feature Supported?
Support Level
Supported
Looker (Google Cloud core)
Yes
Symmetric Aggregates
No
Derived Tables
Yes
Persistent SQL Derived Tables
No
Persistent Native Derived Tables
No
Stable Views
No
Query Killing
Yes
SQL-based Pivots
No
Timezones
No
SSL
Yes
Subtotals
No
JDBC Additional Params
Yes
Case Sensitive
Yes
Location Type
Yes
List Type
Yes
Percentile
Yes
Distinct Percentile
No
SQL Runner Show Processes
Yes
SQL Runner Describe Table
Yes
SQL Runner Show Indexes
No
SQL Runner Select 10
Yes
SQL Runner Count
Yes
SQL Explain
No
Oauth Credentials
No
Context Comments
Yes
Connection Pooling
No
HLL Sketches
No
Aggregate Awareness
No
Incremental PDTs
No
Milliseconds
No
Microseconds
No
Materialized Views
No
Approximate Count Distinct
No