PromQL

PromQL

PromeQL prometheus is built-in data query language that supports data-rich query time series, the polymerization ability and logical operations. And is widely used in everyday applications prometheus among includes data query, visualization, alarm handling them, grafana prometheus inside of the drawing is the use of the PromQLfunction

Query time series

When prometheus sample data collected from monitoring indicators corresponding through exporter, we can carry out the monitoring by promQL sample data query,
when we directly use the name query monitoring metrics that can query the index below the all-time series, for example,

prometheus_http_requests_total  #等同于prometheus_http_requests_total{}
#得到的就是countr类型

PromQL supports user to filter according to the time series pattern matching label time series, mainly supports two modes match: 完全匹配and 正则匹配.

Exact match

PromeQL supports =and !=two completely matching patterns
Let's head for the request to filter out /statusthe number of times:

prometheus_http_requests_total{handler="/status"}

Then filtering is not included in the request header /statusand /apithe

prometheus_http_requests_total{handler!="/status",handle!="/api"}

Regular expressions as a filter table

PromQL may also support the use of regular expressions as the matching conditions, among a plurality of expressions ｜separated:

• Use label=~regxrepresent those selected label in line with the time series regular expression defined
• On the contrary the use of label!~regxexclusion

Note that
when we use regular expressions, which must specify an expression that can be fully matched value, and a regular expression;

prometheus_http_requests_total{handler=~"/api/v1/.*"} #不合法
prometheus_http_requests_total{handler=~"/api/v1/.*",job="prometheus"} # 合法

Range queries

直接通过类似于PromQL表达式prometheus_http_requests_total查询时间序列时，返回值中只会包含该时间序列中的最新的一个样本值，这样的返回结果我们称之为瞬时向量，而相应的这样的表达式称之为瞬时向量表达式。
而我们如果想得到过去一段时间范围内的样本数据时，我们则需要使用区间向量表达式，区间向量表达式和瞬时向量表达式之间的差异在于区间向量表达式中我们需要定义时间选择的范围，是假范围通过时间范围选择器[] 来定义。

prometheus_http_requests_total{code="200"}[5m]

该表达式将会返回查询到的时间序列中最近5分钟的所有样本数据

通过区间向量表达式查询到的结果我们成为区间向量
支持的单位：

• s 秒
• m 分钟
• h 小时
• d 天
• w 周
• y 年

时间位移操作

在瞬间向量表达式或者区间向量表达式中，都是以当前时间为基准的：

prometheus_http_requests_total{} #瞬间向量表达式，选择当前最新的数据
prometheus_http_requests_total{}[5m] #区间向量表达式，选择以当前时间为基准，5分钟内的数据

而如果我们想查询，5分钟前的瞬时样本数据，或昨天一天的区间内的样本数据呢? 这个时候我们就可以使用位移操作，位移操作的关键字为offset。
可以使用offset时间位移操作：

prometheus_http_requests_total{} offset 5m
prometheus_http_requests_total{}[1d] offset 1d

PromQL函数

sum求和函数

一般来说，如果描述样本特征的标签(label)在并非唯一的情况下，通过PromQL查询数据，会返回多条满足这些特征维度的时间序列。而PromQL提供的聚合操作可以用来对这些时间序列进行处理，形成一条新的时间序列：

sum(prometheus_http_requests_total{code=~"400|200",instance="192.168.1.56:9090"}) by (code)

说明：by关键字按照什么什么分组

min 求最小值

min(sum(prometheus_http_requests_total{instance="192.168.1.56:9090"}) by(code))

在上述求和的过程过选择出最小的值

max 求最大值

max(sum(prometheus_http_requests_total{instance="192.168.1.56:9090"}) by(code))

avg 求平均值

avg(sum(prometheus_http_requests_total{instance="192.168.1.56:9090"}) by(code))

count 记数

count(sum(prometheus_http_requests_total{instance="192.168.1.56:9090"}) by(code))

得到当前统计的值的数值

increase(v range-vector)增长率

其中参数v 是一个区间向量，increase函数获取区间向量中的第一个和最后一个样本并返回其增长量。

increase(node_cpu_seconds_total{cpu="0"}[2m])/120

This by node_cpu_seconds_totaltotal acquisition time sequence using the cpu time two minutes into the all samples, increase the amount of nearly two minutes to calculate the increase, and finally divided by the time 120s get node_cpu_seconds_totalaverage.

growth rate averaging

function can be directly calculated range rate vector v average growth rate within the time window. Accordingly, the same function can be obtained with the increase of the junction by the following expression

rate(node_cpu_seconds_total{cpu="0"}[2m])

Note that the use rate or increase function to calculate the average growth rate of the sample, is easy to fall into the "long tail problem" which, it can not react in unexpected changes in a time window of sample data. For example, for the host in 2 minutes time window may be in one or views because other problems leading to consume 100% of the CPU, but by calculating the average rate within the time window can not reflect the problem.

irate averaging

To solve the above problems, PromQL further provides a higher sensitivity function irate (v range-vector). Also irate section for calculating the rate of vector calculations, but the reaction rate is instantaneous. irate growth rate is a function of a vector calculation section by section two last two vector data. This may avoid the time window within the range of "long tail problem", and reflects better sensitivity, transient changes in status icon irate plotted as a function of the reaction to better sample data.

irate function compared to the rate function provides higher sensitivity, but when you need to analyze long-term trends or alarm rules, irate this sensitivity but likely to cause interference. So in the long-term trend analysis or more recommended rate alarm function.

Mathematical Operators

Basic operators

• • plus
• • Less
• • Multiply
• / Division
• % Remainder
• ^ Exponentiation

Boolean operators

• == (equal)
• ! = (Not equal)
• > (Greater than)
• <(Less than)
• > = (Greater than or equal)
• <= (Less than or equal)

Set operator

• and (and)
• or (or)
• unless (excluded)

Operator precedence

PromQL operator precedence operator Low

1. ^
2. *, /, %
3. +, -
4. ==, !=, <=, <, >=, >
5. and, unless
6. or