Acquaintance PromQL

Prometheus by Index Name (metrics name) and a corresponding set of labels (labelset) uniquely defining a time series. Index name reflects the basic identity monitoring samples, and the label on this basic feature provides a variety of feature dimensions as the data collected. The user can filter based on these feature dimensions, polymerization time statistics to produce a new sequence of calculations.

Prometheus is built PromQL data query language that supports data-rich query time series, the polymerization ability and logical operations. And it is widely used in everyday applications among Prometheus, including data query, visualization, alarm processing them. So to speak, PromQL Prometheus is the basis for all scenarios, understand and master PromQL is the first lesson the entry of Prometheus.

Query time series

When Prometheus corresponding monitoring indicators collected sample data by Exporter, we can query data by monitoring sample PromQL.

When we use the direct monitoring index name query, you can query for all time series in the index. Such as:

http_requests_total

Equivalent to:

http_requests_total{}

该表达式会返回指标名称为http_requests_total的所有时间序列：

http_requests_total{code="200",handler="alerts",instance="localhost:9090",job="prometheus",method="get"}=(20889@1518096812.326)
http_requests_total{code="200",handler="graph",instance="localhost:9090",job="prometheus",method="get"}=(21287@1518096812.326)

PromQL supports user to filter according to the time series pattern matching label time series, mainly two match pattern: regular match and exact match.

PromQL supports =and !=two completely match mode:

By using label=valuemay be selected to meet the time tag sequence expression those defined above;
Conversely used label!=valuemay be excluded under the label matches the time series;

For example, if we only need to query all http_requests_total time series to meet the label instance is localhost: 9090 time series, you can use the following expression:

http_requests_total{instance="localhost:9090"}

Conversely using instance!="localhost:9090"the time-series may be excluded:

http_requests_total{instance!="localhost:9090"}

Except exact match filter time series manner, PromQL may also support the use of regular expressions as the matching conditions, among a plurality of expressions |separated:

Use label=~regxrepresent those selected label in line with the time series regular expressions defined;
Conversely using label!~regxexclusion;

For example, if you want the time sequence in the query multiple links can use the following expression:

http_requests_total{environment=~"staging|testing|development",method!="GET"}

Range queries

PromQL similar expressions directly through HTTP Requests query time series, the return value will contain only the latest in a sample value in the time series of the total, so we call return results instantaneously vector . And the corresponding expression of such vectors is called __ transient expression .

And if we want to sample data over a period of time, we will need to use the interval expression vector . The difference between the instantaneous interval and expression vectors comprising an expression vector expression vector in the section we need to define a selected time range, time range by the time range selector []is defined. For example, all the sample data can be selected within the last five minutes by the following expression:

http_request_total{}[5m]

An expression that returns to query all of the time series sample data in the last five minutes:

http_requests_total{code="200",handler="alerts",instance="localhost:9090",job="prometheus",method="get"}=[
    1@1518096812.326
    1@1518096817.326
    1@1518096822.326
    1@1518096827.326
    1@1518096832.326
    1@1518096837.325
]
http_requests_total{code="200",trades ="graph",instance="localhost:9090",job="prometheus",method="get"}=[
    4 @1518096812.326
    4@1518096817.326
    4@1518096822.326
    4@1518096827.326
    4@1518096832.326
    4@1518096837.325
]

Queried by the interval result of the expression vector we call the interval vector .

Except that m represents minute, PromQL time range selector support other time units:

s - s
m - min
h - h
d - Day
w - Week
y - Year

Time shift operation

In the transient expression vector or expression vector range, are based on the current time as a reference:

http_request_total {} # transient expression vector, select the most current data 
http_request_total {} [5m] # interval expression vectors, the current time is selected as a reference, the data within five minutes

And if we want to query, five minutes before the instantaneous sample data or sample data within the interval day yesterday? This time we can use shift operation, key shift operation is offset .

Shift operation time offset may be used:

http_request_total{} offset 5m
http_request_total{}[1d] offset 1d

Use polymerization operation

Generally, if the sample characteristics of label (label) is not the only described in the case where, PromQL query the data, the time series will return to meet these plurality of feature dimensions. PromQL the polymerization operation may be used to provide these time series, to form a new time series:

The total amount of all http request query system # 
SUM (http_request_total) 
# mode calculated according to the average usage time of the host CPU 
AVG (node_cpu) by (mode) 
# query by host CPU usage of each host 
sum (sum (irate (node_cpu { mode ! = ' IDLE ' } [5m])) / SUM (irate (node_cpu [5m]))) by (instance)

Scalar and string

In addition to using a transient expression vector and the section other than the expression vector, PromQL also directly provide the user with a scalar (the Scalar) and string (String).

Scalar (Scalar): a floating-point numeric value

A scalar has only one number, no timing.

E.g:

Note that, when using the expression count (http_requests_total), the type of data returned, still instantaneous vector. A single user can instantaneously through built-in functions Scalar Vector () will be converted to a scalar.

String (String): A simple string value

Direct use of strings, as PromQL expression, it will directly return the string.

"this is a string"
'these are unescaped: \n \\ \t'
`these are not unescaped: \n ' " \t`

Legitimate expression of PromQL

All PromQL expression must contain at least one metric name (e.g. http_request_total), or a tag to the filter will not match the empty string (e.g., {code = "200"}).

So in two ways, both legal expression:

http_request_total # legitimate 
http_request_total {} # legitimate 
{Method = " GET " } # legitimate

The following expression, it is not legitimate:

Job ~ = { " . * " } # unlawful

Meanwhile, in addition to the use of <metric name>{label=value}other than form, we can also use the built-in __name__tag to specify the name of the monitoring indicators:

{__name__=~"http_request_total"} # 合法
{__name__=~"node_disk_bytes_read|node_disk_bytes_written"} # 合法