2021-08-02 19:51:53 +08:00
< template >
2023-04-26 09:46:09 +08:00
< div class = "explore list-page" : class = "'nz-explore-' + tabIndex" style = "position:relative;" >
2021-08-02 19:51:53 +08:00
< div class = "main-list" >
2023-04-26 09:46:09 +08:00
< div class = "main-container explore-split-box" ref = "exploreScrollbar" @mouseenter ="tableHover = true" @mouseleave ="tableHover = false" >
2021-08-02 19:51:53 +08:00
<!-- 关闭按钮 -- >
< div v-if = "closable" class="explore-close" >
2022-07-01 09:39:20 +08:00
< span @click ="split" > < i class = "nz-icon nz-icon-close" :title = "$t('overall.close')" > < / i > < / span >
2021-08-02 19:51:53 +08:00
< / div >
<!-- 顶部工具栏 -- >
2023-06-14 10:46:19 +08:00
< div class = "top-tools" style = "z-index: 2" >
2021-08-25 10:39:26 +08:00
< el-row class = "block-col-2" style = "width: 300px;" >
< el-col >
< el-dropdown trigger = "click" >
2021-11-17 18:21:56 +08:00
< span class = "el-dropdown-link explore-dropdown__item" >
2021-08-25 10:39:26 +08:00
< span > < i :class = "selectIcon" > < / i > < / span >
< span > { { selectValue } } < / span >
< span > < i class = "el-icon-arrow-down el-icon--right" > < / i > < / span >
< / span >
2021-10-29 12:02:34 +08:00
< el-dropdown-menu style = "width: 118px" class = "el-dropdown__width right-box-select-top right-public-box-dropdown-top" placement = "bottom-end" slot = "dropdown" >
2021-08-25 10:39:26 +08:00
< el-dropdown-item
2021-08-25 13:57:04 +08:00
@ click . native = "selectMetricsLogs(item.label,item.icon, item.value)"
2021-08-25 10:39:26 +08:00
v - for = "item in searchMetrics"
2021-09-06 16:22:05 +08:00
: key = "item.value" > < i class = "nz-icon" :class = "item.icon" style = "margin-right: 5px" / > { { item . label } } < / el-dropdown-item >
2021-08-25 10:39:26 +08:00
< / el-dropdown-menu >
< / el-dropdown >
< / el-col >
< / el-row >
2021-08-02 19:51:53 +08:00
< div class = "top-tool-right" >
2022-03-24 16:37:44 +08:00
< button v-if = "!closable" class="top-tool-btn top-tool-btn--text margin-r-10" style="cursor: pointer;" type="button" @click="split" >
{ { $t ( 'overall.split' ) } } < / button >
2021-08-02 19:51:53 +08:00
< pick-time id = "explore" ref = "pickTime" v-model = "filterTime" :class="{'margin-r-10': showMetrics}" :refresh-data-func="expressionChange" @unitChange="chartUnitChange" >
2022-07-01 15:42:08 +08:00
<!-- < template slot = "added-text" > { { $t ( 'dashboard.metricPreview.runQuery' ) } } < / template > -- >
2021-08-02 19:51:53 +08:00
< template slot = "added-text" > { { $t ( 'overall.query' ) } } < / template >
< / pick-time >
2022-09-14 11:14:45 +08:00
< el-dropdown trigger = "click" :size = "'medium'" >
< button id = "more" class = "top-tool-btn" :title = "$t('overall.more')" >
< i class = "nz-icon nz-icon-more2" > < / i >
< / button >
< el-dropdown-menu slot = "dropdown" class = "right-box-select-top right-public-box-dropdown-top" >
2022-11-25 15:43:22 +08:00
< el-dropdown-item :disabled = "saveDisabled" v-has = "'main_add'" >
2022-09-14 11:14:45 +08:00
< div >
< i class = "nz-icon nz-icon-add" / >
2023-04-26 09:46:09 +08:00
< span
v - if = "showMetrics"
id = "explore-save-chart"
: class = "{'btn-disabled-cursor-not-allowed' : saveDisabled}"
: disabled = "saveDisabled"
class = "top-tool-btn top-tool-btn--text"
type = "button"
@ click = "saveChart" >
{ { $t ( 'dashboard.metric.saveChart' ) } }
2022-09-14 11:14:45 +08:00
< / span >
2023-04-26 09:46:09 +08:00
< span
v - else
id = "explore-save-chart-logs"
: class = "{'btn-disabled-cursor-not-allowed' : saveDisabled}"
: disabled = "saveDisabled"
class = "top-tool-btn top-tool-btn--text"
type = "button"
@ click = "saveChartLogs" >
2022-09-14 11:14:45 +08:00
{ { $t ( 'dashboard.metric.saveChart' ) } }
< / span >
< / div >
< / el-dropdown-item >
< el-dropdown-item >
< div id = "chart-export-html" @click ="exportToHtml" > < i class = "nz-icon nz-icon-kuaizhao" > < / i > { { $t ( 'overall.snapshoot' ) } } < / div >
< / el-dropdown-item >
< / el-dropdown-menu >
< / el-dropdown >
2021-08-02 19:51:53 +08:00
< / div >
< / div >
< div id = "explore-promql-box" class = "top-tools" style = "padding-top: 0; flex-wrap: wrap" >
< template v-if = "showMetrics" >
< promql-input
2021-09-28 16:54:07 +08:00
: from - father - data = "true"
: metricOptionsParent = "metricOptions"
2021-08-02 19:51:53 +08:00
v - for = "index of promqlKeys.length"
2022-07-01 15:42:08 +08:00
: id = "promqlKeys[index-1].id"
2023-05-19 17:55:25 +08:00
: pqid = "promqlKeys[index-1].id"
2022-07-01 15:42:08 +08:00
: key = "promqlKeys[index-1].id"
2021-08-02 19:51:53 +08:00
: ref = "'promql-'+(index-1)"
: expression - list = "expressions"
2022-07-01 17:34:28 +08:00
: state = "promqlKeys[index-1].state"
2021-08-02 19:51:53 +08:00
: index = "index-1"
2022-07-01 15:42:08 +08:00
: plugins = "['metric-selector', 'metric-input', 'add', 'remove', 'copy','enable']"
2021-08-02 19:51:53 +08:00
: styleType = "1"
type = "metric"
2022-07-01 15:42:08 +08:00
@ enableExpression = "enableExpression"
2021-08-02 19:51:53 +08:00
@ addExpression = "addExpression"
@ copyExpression = "copyExpression"
@ removeExpression = "removeExpression"
@ resetExpression = "resetExpression"
> < / promql-input >
< / template >
< template v-else >
< promql-input
v - for = "index of promqlKeys.length"
2022-07-01 15:42:08 +08:00
: id = "promqlKeys[index-1].id"
2023-05-19 17:55:25 +08:00
: pqid = "promqlKeys[index-1].id"
2022-07-01 15:42:08 +08:00
: key = "promqlKeys[index-1].id"
2021-08-02 19:51:53 +08:00
: ref = "'promql-'+(index-1)"
: expression - list = "expressions"
2022-07-01 17:34:28 +08:00
: state = "promqlKeys[index-1].state"
2021-08-02 19:51:53 +08:00
: index = "index-1"
2022-07-01 15:42:08 +08:00
: plugins = "['metric-selector', 'metric-input', 'add', 'remove', 'copy','enable']"
2021-08-02 19:51:53 +08:00
: styleType = "1"
type = "log"
2022-07-01 15:42:08 +08:00
@ enableExpression = "enableExpression"
2021-08-02 19:51:53 +08:00
@ addExpression = "addExpression"
@ copyExpression = "copyExpression"
@ removeExpression = "removeExpression"
@ resetExpression = "resetExpression"
> < / promql-input >
< / template >
< / div >
2023-06-14 10:46:19 +08:00
< div ref = "scrollWrap" style = "position: relative;z-index: 1;height: auto; padding: 0 20px 4px;" >
2021-09-13 15:06:54 +08:00
< el-collapse v-show = "!showIntroduce" v-model="collapseValue" class="explore-collapse" @change="logsCollapseChange" >
2021-08-02 19:51:53 +08:00
<!-- metric -- >
< template v-if = "showMetrics" >
2022-05-30 11:19:51 +08:00
< el-collapse-item name = "1" :title = "$t('explore.graph')" class = "el-collapse-item__height" >
2021-08-02 19:51:53 +08:00
< div class = "chart-room" >
2022-06-01 12:03:23 +08:00
< chart ref = "exploreChart" :unit = "chartUnit" :timeRange = "filterTime" > < / chart >
2021-08-02 19:51:53 +08:00
< / div >
< / el-collapse-item >
2021-09-10 16:44:04 +08:00
< el-collapse-item class = "el-collapse-item__height" name = "2" title = "Table" >
2021-12-27 15:37:14 +08:00
< div slot = "title" class = "explore-table-title" >
2023-03-17 12:46:56 +08:00
{ { $t ( 'dashboard.dashboard.chartForm.typeVal.table.label' ) } }
2021-12-27 17:59:57 +08:00
< i
class = "nz-icon-gear nz-icon"
style = "position: absolute;right: 10px;top: 8px"
@ click . stop = "tools.showCustomTableTitle = true"
2022-07-01 09:39:20 +08:00
: title = "$t('overall.selectColumns')"
2021-12-27 17:59:57 +08:00
> < / i >
<!-- 自定义table列 -- >
2021-12-27 15:37:14 +08:00
< transition name = "el-zoom-in-top" >
< element-set
2023-03-14 10:47:30 +08:00
@ click . stop = "()=>{}"
2021-12-27 15:37:14 +08:00
v - if = "tools.showCustomTableTitle"
: tableId = "tableId"
ref = "customTableTitle"
: custom - table - title = "tools.customTableTitle"
: original - table - title = "tableTitle"
: operation - true = "true"
@ close = "tools.showCustomTableTitle = false"
@ update = "updateCustomTableTitle"
> < / element-set >
< / transition >
< / div >
2021-08-04 17:10:35 +08:00
<!-- 自定义table列 -- >
2022-06-09 13:18:09 +08:00
< div class = "nz-table-list explore-table" >
2021-08-02 19:51:53 +08:00
< el-table ref = "exploreTable"
2022-07-01 15:42:08 +08:00
v - my - loading = "tools.loading"
class = "metric-table"
: data = "tableData"
border
: header - cell - class - name = "({ column }) => column.property === 'gear' ? 'explore-table-gear' : ''"
tooltip - effect = "light" >
2021-08-02 19:51:53 +08:00
< el-table-column
v - for = "(item, index) in tools.customTableTitle"
v - if = "item.show"
: key = "`col-${index}`"
: label = "item.label"
: prop = "item.prop"
: resizable = "false"
min - width = "110px"
show - overflow - tooltip
2021-12-30 19:17:22 +08:00
>
< template slot -scope = " scope " :column = "item" >
2022-03-31 09:55:22 +08:00
< template v-if = "item.prop === 'time'" > {{ timeFormate ( scope.row.time ) }} < / template >
2021-12-30 19:17:22 +08:00
< span v-else-if = "scope.row[item.prop]" > {{ scope.row [ item.prop ] }} < / span >
< template v-else > - < / template >
< / template >
< / el-table-column >
2021-10-25 14:38:43 +08:00
< template slot = "empty" >
2021-10-25 14:45:28 +08:00
< div v-if = "!tools.loading" class="table-no-data" >
2021-10-25 14:38:43 +08:00
< svg class = "icon" aria -hidden = " true " >
< use xlink :href = "#nz-icon-no-data-list" > < / use >
< / svg >
2021-10-28 17:53:27 +08:00
< div class = "table-no-data__title" > No results found < / div >
2021-10-25 14:38:43 +08:00
< / div >
< div v-else > & nbsp ; < / div >
< / template >
2021-08-02 19:51:53 +08:00
< / el-table >
< / div >
2021-12-24 16:31:31 +08:00
< pagination ref = "Pagination" :page-obj = "pageObj" @ pageNo = 'pageNo'
2021-08-04 17:10:35 +08:00
@ pageSize = 'pageSize' > < / pagination >
2021-08-02 19:51:53 +08:00
< / el-collapse-item >
< / template >
<!-- log -- >
2021-09-17 15:49:15 +08:00
< template v-else >
2022-05-30 11:19:51 +08:00
< el-collapse-item v-if = "showTab.indexOf('1') > -1" name="1" :title="$t('explore.graph')" class="el-collapse-item__height" >
2021-08-02 19:51:53 +08:00
< div class = "chart-room" >
2022-06-01 12:03:23 +08:00
< chart ref = "logChart" :unit = "chartUnit" v-my-loading = "chartLoading" :timeRange="filterTime" > < / chart >
2021-08-02 19:51:53 +08:00
< / div >
< / el-collapse-item >
2021-08-04 17:10:35 +08:00
< el-collapse-item v-if = "showTab.indexOf('2') > -1" name="2" title="Logs" >
2022-08-03 11:15:36 +08:00
< log-tab ref = "logDetail" :timeRange = "filterTime" :log-data = "logData" :explore-log-table = "logTabNoData" :explore-item = "true" :tab-index = "tabIndex" @exportLog ="exportLog" @limitChange ="queryLogData" v-my-loading = "chartLoading" > < / log -tab >
2021-08-02 19:51:53 +08:00
< / el-collapse-item >
< / template >
< / el-collapse >
2022-09-27 11:18:55 +08:00
<!-- Metric -- >
2021-08-02 19:51:53 +08:00
< div v-if = "showMetrics" v-show="showIntroduce" class="introduce-view" >
2022-10-24 16:11:36 +08:00
<!-- 英文 -- >
< div class = "info-room title-heard" v-if = "language == 'en'" >
2022-09-27 11:18:55 +08:00
< div class = "col-md-9 logs-content" >
<!-- promql -- >
2022-09-27 14:49:45 +08:00
< h1 class = "page-header" style = "margin-Top:0px" > PromQL : Prometheus Query Language < a class = "header-anchor" href = "https://prometheus.io/docs/prometheus/latest/querying/basics/" rel = "noopener noreferrer" target = "_blank" > < i class = "nz-icon nz-icon-link1" style = "font-size: 16px;" :title = "$t('overall.link')" > < / i > < / a > < / h1 >
2022-09-27 11:18:55 +08:00
< div class = "title-heard__divider" > < / div >
2022-09-27 14:49:45 +08:00
<!-- catalog 目录 -- >
< div class = "catalog" >
< ul class = "catalog-square" >
<!-- Querying prometheus -- >
< li >
< div @click ="jumpClick('#querying-prometheus')" > < span > Querying prometheus < / span > < / div >
< ul class = "catalog-disc" >
< li @click ="jumpClick('#querying-prometheus-examples')" > < span > Examples < / span > < / li >
< li @click ="jumpClick('#expression-language-data-types')" > < span > Expression language data types < / span > < / li >
< li >
< div @click ="jumpClick('#literals')" > < span > Literals < / span > < / div >
< ul >
< li @click ="jumpClick('#string-literals')" > < span > String literals < / span > < / li >
< li @click ="jumpClick('#float-literals')" > < span > Float literals < / span > < / li >
< / ul >
< / li >
< li >
< div @click ="jumpClick('#time-series-selectors')" > < span > Time series Selectors < / span > < / div >
< ul >
< li @click ="jumpClick('#instant-vector-selectors')" > < span > Instant vector selectors < / span > < / li >
< li @click ="jumpClick('#range-vector-selectors')" > < span > Range Vector Selectors < / span > < / li >
< li @click ="jumpClick('#time-durations')" > < span > Time Durations < / span > < / li >
< li @click ="jumpClick('#offset-modifier')" > < span > Offset modifier < / span > < / li >
< li @click ="jumpClick('#time-series-modifier')" > < span > @ modifier < / span > < / li >
< / ul >
< / li >
< li @click ="jumpClick('#querying-prometheus-subquery')" > < span > Subquery < / span > < / li >
< li @click ="jumpClick('#querying-prometheus-operators')" > < span > Operators < / span > < / li >
< li @click ="jumpClick('#querying-prometheus-functions')" > < span > Functions < / span > < / li >
< li @click ="jumpClick('#querying-prometheus-comments')" > < span > Comments < / span > < / li >
< li >
< div @click ="jumpClick('#querying-prometheus-gotchas')" > < span > Gotchas < / span > < / div >
< ul >
< li @click ="jumpClick('#gotchas-staleness')" > < span > Staleness < / span > < / li >
< li @click ="jumpClick('#avoiding-slow-queries-and-overloads')" > < span > Avoiding slow queries and overloads < / span > < / li >
< / ul >
< / li >
< / ul >
< / li >
<!-- Operators -- >
< li >
< div @click ="jumpClick('#operators')" > < span > Operators < / span > < / div >
< ul class = "catalog-disc" >
< li >
< div @click ="jumpClick('#binary-operators')" > < span > Binary operators < / span > < / div >
< ul >
< li @click ="jumpClick('#arithmetic-binary-operators')" > < span > Arithmetic binary operators < / span > < / li >
< li @click ="jumpClick('#trigonometric-binary-operators')" > < span > Trigonometric binary operators < / span > < / li >
< li @click ="jumpClick('#comparison-binary-operators')" > < span > Comparison binary operators < / span > < / li >
< li @click ="jumpClick('#Logical-binary-operators')" > < span > Logical / set binary operators < / span > < / li >
< / ul >
< / li >
< li >
< div @click ="jumpClick('#vector-matching')" > < span > Vector matching < / span > < / div >
< ul >
< li @click ="jumpClick('#vector-matching-keywords')" > < span > Vector matching keywords < / span > < / li >
< li @click ="jumpClick('#group-modifiers')" > < span > Group modifiers < / span > < / li >
< li @click ="jumpClick('#one-to-one-vector-matches')" > < span > One - to - one vector matches < / span > < / li >
< li @click ="jumpClick('#many-to-one')" > < span > Many - to - one and one - to - many vector matches < / span > < / li >
< / ul >
< / li >
< li @click ="jumpClick('#aggregation-operators')" > < span > Aggregation operators < / span > < / li >
< li @click ="jumpClick('#binary-operator-precedence')" > < span > Binary operator precedence < / span > < / li >
< / ul >
< / li >
<!-- Functions -- >
< li >
< div @click ="jumpClick('#functions')" > < span > Functions < / span > < / div >
< ul class = "catalog-disc" >
< li @click ="jumpClick('#functions-abs')" > < span > abs ( ) < / span > < / li >
< li @click ="jumpClick('#functions-absent')" > < span > absent ( ) < / span > < / li >
< li @click ="jumpClick('#functions-absent_over_time')" > < span > absent _over _time ( ) < / span > < / li >
< li @click ="jumpClick('#functions-ceil')" > < span > ceil ( ) < / span > < / li >
< li @click ="jumpClick('#functions-changes')" > < span > changes ( ) < / span > < / li >
< li @click ="jumpClick('#functions-clamp')" > < span > clamp ( ) < / span > < / li >
< li @click ="jumpClick('#functions-clamp_max')" > < span > clamp _max ( ) < / span > < / li >
< li @click ="jumpClick('#functions-clamp_min')" > < span > clamp _min ( ) < / span > < / li >
< li @click ="jumpClick('#functions-day_of_month')" > < span > day _of _month ( ) < / span > < / li >
< li @click ="jumpClick('#functions-day_of_week')" > < span > day _of _week ( ) < / span > < / li >
< li @click ="jumpClick('#functions-day_of_year')" > < span > day _of _year ( ) < / span > < / li >
< li @click ="jumpClick('#functions-days_in_month')" > < span > days _in _month ( ) < / span > < / li >
< li @click ="jumpClick('#functions-delta')" > < span > delta ( ) < / span > < / li >
< li @click ="jumpClick('#functions-deriv')" > < span > deriv ( ) < / span > < / li >
< li @click ="jumpClick('#functions-exp')" > < span > exp ( ) < / span > < / li >
< li @click ="jumpClick('#functions-floor')" > < span > floor ( ) < / span > < / li >
< li @click ="jumpClick('#functions-histogram_quantile')" > < span > histogram _quantile ( ) < / span > < / li >
< li @click ="jumpClick('#functions-holt_winters')" > < span > holt _winters ( ) < / span > < / li >
< li @click ="jumpClick('#functions-hour')" > < span > hour ( ) < / span > < / li >
< li @click ="jumpClick('#functions-idelta')" > < span > idelta ( ) < / span > < / li >
< li @click ="jumpClick('#functions-increase')" > < span > increase ( ) < / span > < / li >
< li @click ="jumpClick('#functions-irate')" > < span > irate ( ) < / span > < / li >
< li @click ="jumpClick('#functions-label_join')" > < span > label _join ( ) < / span > < / li >
< li @click ="jumpClick('#functions-label_replace')" > < span > label _replace ( ) < / span > < / li >
< li @click ="jumpClick('#functions-ln')" > < span > ln ( ) < / span > < / li >
< li @click ="jumpClick('#functions-log2')" > < span > log2 ( ) < / span > < / li >
< li @click ="jumpClick('#functions-log10')" > < span > log10 ( ) < / span > < / li >
< li @click ="jumpClick('#functions-minute')" > < span > minute ( ) < / span > < / li >
< li @click ="jumpClick('#functions-month')" > < span > month ( ) < / span > < / li >
< li @click ="jumpClick('#functions-predict_linear')" > < span > predict _linear ( ) < / span > < / li >
< li @click ="jumpClick('#functions-rate')" > < span > rate ( ) < / span > < / li >
< li @click ="jumpClick('#functions-resets')" > < span > resets ( ) < / span > < / li >
< li @click ="jumpClick('#functions-round')" > < span > round ( ) < / span > < / li >
< li @click ="jumpClick('#functions-scalar')" > < span > scalar ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sgn')" > < span > sgn ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sort')" > < span > sort ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sort_desc')" > < span > sort _desc ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sqrt')" > < span > sqrt ( ) < / span > < / li >
< li @click ="jumpClick('#functions-time')" > < span > time ( ) < / span > < / li >
< li @click ="jumpClick('#functions-timestamp')" > < span > timestamp ( ) < / span > < / li >
< li @click ="jumpClick('#functions-vector')" > < span > vector ( ) < / span > < / li >
< li @click ="jumpClick('#functions-year')" > < span > year ( ) < / span > < / li >
< li @click ="jumpClick('#functions-aggregation')" > < span > & lt ; aggregation & gt ; _over _time ( ) < / span > < / li >
< li @click ="jumpClick('#functions-trigonometric')" > < span > Trigonometric Functions < / span > < / li >
< / ul >
< / li >
<!-- QUERY EXAMPLES -- >
< li >
< div @click ="jumpClick('#query-examples')" > < span > Query examples < / span > < / div >
< ul class = "catalog-disc" >
< li @click ="jumpClick('#simple-time-series-selection')" > < span > Simple time series selection < / span > < / li >
< li @click ="jumpClick('#query-examples-subquery')" > < span > Subquery < / span > < / li >
< li @click ="jumpClick('#using-functions')" > < span > Using functions , operators , etc . < / span > < / li >
< / ul >
< / li >
< / ul >
< / div >
2022-09-27 11:18:55 +08:00
<!-- QUERYING PROMETHEUS -- >
<!-- start -- >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content" >
2022-09-27 11:18:55 +08:00
< h1 class = "page-header-one" id = "querying-prometheus" > Querying prometheus < / h1 >
< p > Prometheus provides a functional query language called PromQL ( Prometheus Query Language ) that lets the user select and aggregate time series data in real time . The result of an expression can either be shown as a graph , viewed as tabular data in Prometheus ' s expression browser , or consumed by external systems via the HTTP API . < / p >
< / div >
<!-- Examples -- >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content" >
2022-09-27 11:18:55 +08:00
< h1 class = "page-header-two" id = "querying-prometheus-examples" > Examples < / h1 >
< p > This document is meant as a reference . For learning , it might be easier to start with a couple of < b style = "color: #3C92F1" @click ="jumpClick('#query-examples')" class = "log-link" > examples < / b > . < / p >
< / div >
<!-- Expression language data types -- >
< div >
< h1 class = "page-header-two" id = "expression-language-data-types" > Expression language data types < / h1 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label" >
2022-09-27 11:18:55 +08:00
< p > In Prometheus ' s expression language , an expression or sub - expression can evaluate to one of four types : < / p >
< ul >
< li > < b > Instant vector < / b > - a set of time series containing a single sample for each time series , all sharing the same timestamp < / li >
< li > < b > Range vector < / b > - a set of time series containing a range of data points over time for each time series < / li >
< li > < b > Scalar < / b > - a simple numeric floating point value < / li >
< li > < b > String < / b > - a simple string value ; currently unused < / li >
< / ul >
< p > Depending on the use - case ( e . g . when graphing vs . displaying the output of an expression ) , only some of these types are legal as the result from a user - specified expression . For example , an expression that returns an instant vector is the only type that can be directly graphed . < / p >
< / div >
< / div >
<!-- Literals -- >
< h1 class = "page-header-two" id = "literals" > Literals < / h1 >
< div class = "introduce-view__content" >
< h2 id = "string-literals" > String literals < / h2 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label" >
2022-09-27 11:18:55 +08:00
< p > Strings may be specified as literals in single quotes , double quotes or backticks . < / p >
< p > PromQL follows the same escaping rules as Go . In single or double quotes a backslash begins an escape sequence , which may be followed by < code > a < / code > , < code > b < / code > , < code > f < / code > , < code > n < / code > , < code > r < / code > , < code > t < / code > , < code > v < / code > or < code > \ < / code > . Specific characters can be provided using octal ( < code > \ nnn < / code > ) or hexadecimal ( < code > \ xnn < / code > , < code > \ unnnn < / code > and < code > \ Unnnnnnnn < / code > ) . < / p >
< p > No escaping is processed inside backticks . Unlike Go , Prometheus does not discard newlines inside backticks . < / p >
< p > Example : < / p >
2022-09-27 14:49:45 +08:00
< pre > "this is a string"
2022-09-27 11:18:55 +08:00
'these are unescaped: \n \\ \t'
` these are not unescaped: \ n ' " \ t ` < / pre >
< / div >
< / div >
<!-- Float literals -- >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content" >
2022-09-27 11:18:55 +08:00
< h2 id = "float-literals" > Float literals < / h2 >
< div class = "introduce-view__content-label" >
< p > Scalar float values can be written as literal integer or floating - point numbers in the format ( whitespace only included for better readability ) : < / p >
2022-09-27 14:49:45 +08:00
< pre > [ - + ] ? (
2022-09-27 11:18:55 +08:00
[ 0 - 9 ] * \ . ? [ 0 - 9 ] + ( [ eE ] [ - + ] ? [ 0 - 9 ] + ) ?
| 0 [ xX ] [ 0 - 9 a - fA - F ] +
| [ nN ] [ aA ] [ nN ]
| [ iI ] [ nN ] [ fF ]
) < / pre >
< p > Examples : < / p >
< pre > 23
- 2.43
3.4e-9
0x8f
- Inf
NaN < / pre >
< / div >
< / div >
<!-- Time series Selectors -- >
< h1 class = "page-header-two" id = "time-series-selectors" > Time series Selectors < / h1 >
< div class = "introduce-view__content" >
< h2 id = "instant-vector-selectors" > Instant vector selectors < / h2 >
< div class = "introduce-view__content-label" >
2022-09-27 14:49:45 +08:00
< div >
2022-09-27 11:18:55 +08:00
< p > Instant vector selectors allow the selection of a set of time series and a single sample value for each at a given timestamp ( instant ) : in the simplest form , only a metric name is specified . This results in an instant vector containing elements for all time series that have this metric name . < / p >
< p > This example selects all time series that have the < code > http _requests _total < / code > metric name : < / p >
< pre > http _requests _total < / pre >
< p > It is possible to filter these time series further by appending a comma separated list of label matchers in curly braces ( < code > { } < / code > ) . < / p >
< p > This example selects only those time series with the < code > http _requests _total < / code > metric name that also have the < code > job < / code > label set to < code > prometheus < / code > and their < code > group < / code > label set to < code > canary < / code > : < / p >
< pre > http _requests _total { job = "prometheus" , group = "canary" } < / pre >
< p > It is also possible to negatively match a label value , or to match label values against regular expressions . The following label matching operators exist : < / p >
< ul >
< li > < code > = < / code > : Select labels that are exactly equal to the provided string . < / li >
< li > < code > != < / code > : Select labels that are not equal to the provided string . < / li >
< li > < code > = ~ < / code > : Select labels that regex - match the provided string . < / li >
< li > < code > ! ~ < / code > : Select labels that do not regex - match the provided string . < / li >
< / ul >
< p > Regex matches are fully anchored . A match of < code > env = ~ "foo" < / code > is treated as < code > env = ~ "^foo$" < / code > . < / p >
< p > For example , this selects all < code > http _requests _total < / code > time series for < code > staging < / code > , < code > testing < / code > , and < code > development < / code > environments and HTTP methods other than < code > GET < / code > . < / p >
2022-09-27 14:49:45 +08:00
< pre > http _requests _total { environment = ~ "staging|testing|development" , method != "GET" } < / pre >
2022-09-27 11:18:55 +08:00
< / div >
< p > Label matchers that match empty label values also select all time series that do not have the specific label set at all . It is possible to have multiple matchers for the same label name . < / p >
< p > Vector selectors must either specify a name or at least one label matcher that does not match the empty string . The following expression is illegal : < / p >
< pre > { job = ~ ".*" } # Bad ! < / pre >
< p > In contrast , these expressions are valid as they both have a selector that does not match empty label values . < / p >
< pre > { job = ~ ".+" } # Good !
{ job = ~ ".*" , method = "get" } # Good ! < / pre >
< p > Label matchers can also be applied to metric names by matching against the internal < code > _ _name _ _ < / code > label . For example , the expression < code > http _requests _total < / code > is equivalent to < code > { _ _name _ _ = "http_requests_total" } < / code > . Matchers other than < code > = < / code > ( < code > != < / code > , < code > = ~ < / code > , < code > ! ~ < / code > ) may also be used . The following expression selects all metrics that have a name starting with < code > job : < / code > : < / p >
< pre > { _ _name _ _ = ~ "job:.*" } < / pre >
< p > The metric name must not be one of the keywords < code > bool < / code > , < code > on < / code > , < code > ignoring < / code > , < code > group _left < / code > and < code > group _right < / code > . The following expression is illegal : < / p >
< pre > on { } # Bad ! < / pre >
< p > A workaround for this restriction is to use the < code > _ _name _ _ < / code > label : < / p >
< pre > { _ _name _ _ = "on" } # Good ! < / pre >
< p > All regular expressions in Prometheus use RE2 syntax . < / p >
< / div >
< / div >
<!-- Range Vector Selectors -- >
< div class = "introduce-view__content" >
< h2 id = "range-vector-selectors" > Range Vector Selectors < / h2 >
< div class = "introduce-view__content-label" >
< p > Range vector literals work like instant vector literals , except that they select a range of samples back from the current instant . Syntactically , a < b style = "color: #3C92F1" @click ="jumpClick('#time-durations')" class = "log-link" > time duration < / b > is appended in square brackets ( < code > [ ] < / code > ) at the end of a vector selector to specify how far back in time values should be fetched for each resulting range vector element . < / p >
< p > In this example , we select all the values we have recorded within the last 5 minutes for all time series that have the metric name < code > http _requests _total < / code > and a < code > job < / code > label set to < code > prometheus < / code > : < / p >
< pre > http _requests _total { job = "prometheus" } [ 5 m ] < / pre >
< / div >
< / div >
<!-- Time Durations -- >
< div class = "introduce-view__content" >
< h2 id = "time-durations" > Time Durations < / h2 >
< div class = "introduce-view__content-label" >
< p > Time durations are specified as a number , followed immediately by one of the following units : < / p >
< ul >
< li > < code > ms < / code > - milliseconds < / li >
< li > < code > s < / code > - seconds < / li >
< li > < code > m < / code > - minutes < / li >
< li > < code > h < / code > - hours < / li >
< li > < code > d < / code > - days - assuming a day has always 24 h < / li >
< li > < code > w < / code > - weeks - assuming a week has always 7 d < / li >
< li > < code > y < / code > - years - assuming a year has always 365 d < / li >
< / ul >
< p > Time durations can be combined , by concatenation . Units must be ordered from the longest to the shortest . A given unit must only appear once in a time duration . < / p >
< p > Here are some examples of valid time durations : < / p >
< pre > 5 h
1 h30m
5 m
10 s < / pre >
< / div >
< / div >
<!-- Offset modifier -- >
< div class = "introduce-view__content" >
< h2 id = "offset-modifier" > Offset modifier < / h2 >
< div class = "introduce-view__content-label" >
< p > The < code > offset < / code > modifier allows changing the time offset for individual instant and range vectors in a query . < / p >
< p > For example , the following expression returns the value of < code > http _requests _total < / code > 5 minutes in the past relative to the current query evaluation time : < / p >
< pre > http _requests _total offset 5 m < / pre >
< p > Note that the < code > offset < / code > modifier always needs to follow the selector immediately , i . e . the following would be correct : < / p >
< pre > sum ( http _requests _total { method = "GET" } offset 5 m ) // GOOD.</pre>
< p > While the following would be < i > incorrect < / i > : < / p >
< pre > sum ( http _requests _total { method = "GET" } ) offset 5 m // INVALID.</pre>
< p > The same works for range vectors . This returns the 5 - minute rate that < code > http _requests _total < / code > had a week ago : < / p >
< pre > rate ( http _requests _total [ 5 m ] offset 1 w ) < / pre >
< p > For comparisons with temporal shifts forward in time , a negative offset can be specified : < / p >
< pre > rate ( http _requests _total [ 5 m ] offset - 1 w ) < / pre >
< p > Note that this allows a query to look ahead of its evaluation time . < / p >
< / div >
< / div >
<!-- @ modifier -- >
< div class = "introduce-view__content" >
< h2 id = "time-series-modifier" > @ modifier < / h2 >
< div class = "introduce-view__content-label" >
< p > The < code > @ < / code > modifier allows changing the evaluation time for individual instant and range vectors in a query . The time supplied to the < code > @ < / code > modifier is a unix timestamp and described with a float literal . < / p >
< p > For example , the following expression returns the value of < code > http _requests _total < / code > at < code > 2021 - 01 - 04 T07 : 40 : 00 + 00 : 00 < / code > : < / p >
< pre > http _requests _total @ 1609746000 < / pre >
< p > Note that the < code > @ < / code > modifier always needs to follow the selector immediately , i . e . the following would be correct : < / p >
< pre > sum ( http _requests _total { method = "GET" } @ 1609746000 ) // GOOD.</pre>
< p > While the following would be < i > incorrect < / i > : < / p >
< pre > sum ( http _requests _total { method = "GET" } ) @ 1609746000 // INVALID.</pre>
< p > The same works for range vectors . This returns the 5 - minute rate that < code > http _requests _total < / code > had at < code > 2021 - 01 - 04 T07 : 40 : 00 + 00 : 00 < / code > : < / p >
< pre > rate ( http _requests _total [ 5 m ] @ 1609746000 ) < / pre >
< p > The < code > @ < / code > modifier supports all representation of float literals described above within the limits of < code > int64 < / code > . It can also be used along with the < code > offset < / code > modifier where the offset is applied relative to the < code > @ < / code > modifier time irrespective of which modifier is written first . These 2 queries will produce the same result . < / p >
< pre > # offset after @
http _requests _total @ 1609746000 offset 5 m
# offset before @
http _requests _total offset 5 m @ 1609746000 < / pre >
< p > Additionally , < code > start ( ) < / code > and < code > end ( ) < / code > can also be used as values for the < code > @ < / code > modifier as special values . < / p >
< p > For a range query , they resolve to the start and end of the range query respectively and remain the same for all steps . < / p >
< p > For an instant query , < code > start ( ) < / code > and < code > end ( ) < / code > both resolve to the evaluation time . < / p >
< pre > http _requests _total @ start ( )
rate ( http _requests _total [ 5 m ] @ end ( ) ) < / pre >
< p > Note that the < code > @ < / code > modifier allows a query to look ahead of its evaluation time . < / p >
< / div >
< / div >
<!-- Subquery -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-subquery" > Subquery < / h1 >
< div class = "introduce-view__content-label" >
< p > Subquery allows you to run an instant query for a given range and resolution . The result of a subquery is a range vector . < / p >
< p > Syntax : < code > & lt ; instant _query & gt ; '[' & lt ; range & gt ; ':' [ & lt ; resolution & gt ; ] ']' [ @ & lt ; float _literal & gt ; ] [ offset & lt ; duration & gt ; ] < / code > < / p >
< ul >
< li > < code > & lt ; resolution & gt ; < / code > is optional . Default is the global evaluation interval . < / li >
< / ul >
< / div >
< / div >
<!-- Operators -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-operators" > Operators < / h1 >
< div class = "introduce-view__content-label" >
< p > Prometheus supports many binary and aggregation operators . These are described in detail in the < b style = "color: #3C92F1" @click ="jumpClick('#operators')" class = "log-link" > expression language operators < / b > page . < / p >
< / div >
< / div >
<!-- Functions -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-functions" > Functions < / h1 >
< div class = "introduce-view__content-label" >
< p > Prometheus supports several functions to operate on data . These are described in detail in the < b style = "color: #3C92F1" @click ="jumpClick('#functions')" class = "log-link" > expression language functions < / b > page . < / p >
< / div >
< / div >
<!-- Comments -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-comments" > Comments < / h1 >
< div class = "introduce-view__content-label" >
< p > PromQL supports line comments that start with < code > # < / code > . Example : < / p >
< pre > # This is a comment < / pre >
< / div >
< / div >
<!-- Gotchas -- >
< h1 class = "page-header-two" id = "querying-prometheus-gotchas" > Gotchas < / h1 >
< div class = "introduce-view__content" >
< h2 id = "gotchas-staleness" > Staleness < / h2 >
< div class = "introduce-view__content-label" >
< p > When queries are run , timestamps at which to sample data are selected independently of the actual present time series data . This is mainly to support cases like aggregation ( < code > sum < / code > , < code > avg < / code > , and so on ) , where multiple aggregated time series do not exactly align in time . Because of their independence , Prometheus needs to assign a value at those timestamps for each relevant time series . It does so by simply taking the newest sample before this timestamp . < / p >
< p > If a target scrape or rule evaluation no longer returns a sample for a time series that was previously present , that time series will be marked as stale . If a target is removed , its previously returned time series will be marked as stale soon afterwards . < / p >
< p > If a query is evaluated at a sampling timestamp after a time series is marked stale , then no value is returned for that time series . If new samples are subsequently ingested for that time series , they will be returned as normal . < / p >
< p > If no sample is found ( by default ) 5 minutes before a sampling timestamp , no value is returned for that time series at this point in time . This effectively means that time series "disappear" from graphs at times where their latest collected sample is older than 5 minutes or after they are marked stale . < / p >
< p > Staleness will not be marked for time series that have timestamps included in their scrapes . Only the 5 minute threshold will be applied in that case . < / p >
< / div >
< / div >
<!-- Avoiding slow queries and overloads -- >
< div class = "introduce-view__content" >
< h2 id = "avoiding-slow-queries-and-overloads" > Avoiding slow queries and overloads < / h2 >
< div class = "introduce-view__content-label" >
< p > If a query needs to operate on a very large amount of data , graphing it might time out or overload the server or browser . Thus , when constructing queries over unknown data , always start building the query in the tabular view of Prometheus ' s expression browser until the result set seems reasonable ( hundreds , not thousands , of time series at most ) . Only when you have filtered or aggregated your data sufficiently , switch to graph mode . If the expression still takes too long to graph ad - hoc , pre - record it via a recording rule . < / p >
< p > This is especially relevant for Prometheus ' s query language , where a bare metric name selector like < code > api _http _requests _total < / code > could expand to thousands of time series with different labels . Also keep in mind that expressions which aggregate over many time series will generate load on the server even if the output is only a small number of time series . This is similar to how it would be slow to sum all values of a column in a relational database , even if the output value is only a single number . < / p >
< / div >
< / div >
<!-- OPERATORS -- >
< h1 class = "page-header-one" id = "operators" > Operators < / h1 >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "binary-operators" > Binary operators < / h1 >
< p > Prometheus 's query language supports basic logical and arithmetic operators. For operations between two instant vectors, the <b style="color: #3C92F1" @click="jumpClick(' # vector - matching ' ) " class=" log - link " > matching behavior < / b > can be modified . < / p >
< / div >
<!-- Arithmetic binary operators -- >
< div class = "introduce-view__content" >
< h2 id = "arithmetic-binary-operators" > Arithmetic binary operators < / h2 >
< div class = "introduce-view__content-label" >
< p > The following binary arithmetic operators exist in Prometheus : < / p >
< ul >
< li > < code > + < / code > ( addition ) < / li >
< li > < code > - < / code > ( subtraction ) < / li >
< li > < code > * < / code > ( multiplication ) < / li >
< li > < code > / < / code > ( division ) < / li >
< li > < code > % < / code > ( modulo ) < / li >
< li > < code > ^ < / code > ( power / exponentiation ) < / li >
< / ul >
< p > Binary arithmetic operators are defined between scalar / scalar , vector / scalar , and vector / vector value pairs . < / p >
< p > < b > Between two scalars < / b > , the behavior is obvious : they evaluate to another scalar that is the result of the operator applied to both scalar operands . < / p >
< p > < b > Between an instant vector and a scalar < / b > , the operator is applied to the value of every data sample in the vector . E . g . if a time series instant vector is multiplied by 2 , the result is another vector in which every sample value of the original vector is multiplied by 2. The metric name is dropped . < / p >
< p > < b > Between two instant vectors < / b > , a binary arithmetic operator is applied to each entry in the left - hand side vector and its matching element in the right - hand vector . The result is propagated into the result vector with the grouping labels becoming the output label set . The metric name is dropped . Entries for which no matching entry in the right - hand vector can be found are not part of the result . < / p >
< / div >
< / div >
<!-- Trigonometric binary operators -- >
< div class = "introduce-view__content" >
< h2 id = "trigonometric-binary-operators" > Trigonometric binary operators < / h2 >
< div class = "introduce-view__content-label" >
< p > The following trigonometric binary operators , which work in radians , exist in Prometheus : < / p >
< ul >
< li > < code > atan2 < / code > ( based on https : //pkg.go.dev/math#Atan2)</li>
< / ul >
< p > Trigonometric operators allow trigonometric functions to be executed on two vectors using vector matching , which isn ' t available with normal functions . They act in the same manner as arithmetic operators . < / p >
< / div >
< / div >
<!-- Comparison binary operators -- >
< div class = "introduce-view__content" >
< h2 id = "comparison-binary-operators" > Comparison binary operators < / h2 >
< div class = "introduce-view__content-label" >
< p > The following binary comparison operators exist in Prometheus : < / p >
< ul >
< li > < code > == < / code > ( equal ) < / li >
< li > < code > != < / code > ( not - equal ) < / li >
< li > < code > & gt ; < / code > ( greater - than ) < / li >
< li > < code > & lt ; < / code > ( less - than ) < / li >
< li > < code > & gt ; = < / code > ( greater - or - equal ) < / li >
< li > < code > & lt ; = < / code > ( less - or - equal ) < / li >
< / ul >
< p > Comparison operators are defined between scalar / scalar , vector / scalar , and vector / vector value pairs . By default they filter . Their behavior can be modified by providing < code > bool < / code > after the operator , which will return < code > 0 < / code > or < code > 1 < / code > for the value rather than filtering . < / p >
< p > < b > Between two scalars < / b > , the < code > bool < / code > modifier must be provided and these operators result in another scalar that is either < code > 0 < / code > ( < code > false < / code > ) or < code > 1 < / code > ( < code > true < / code > ) , depending on the comparison result . < / p >
< p > < b > Between an instant vector and a scalar < / b > , these operators are applied to the value of every data sample in the vector , and vector elements between which the comparison result is < code > false < / code > get dropped from the result vector . If the < code > bool < / code > modifier is provided , vector elements that would be dropped instead have the value < code > 0 < / code > and vector elements that would be kept have the value < code > 1 < / code > . The metric name is dropped if the < code > bool < / code > modifier is provided . < / p >
< p > < b > Between two instant vectors < / b > , these operators behave as a filter by default , applied to matching entries . Vector elements for which the expression is not true or which do not find a match on the other side of the expression get dropped from the result , while the others are propagated into a result vector with the grouping labels becoming the output label set . If the < code > bool < / code > modifier is provided , vector elements that would have been dropped instead have the value < code > 0 < / code > and vector elements that would be kept have the value < code > 1 < / code > , with the grouping labels again becoming the output label set . The metric name is dropped if the < code > bool < / code > modifier is provided . < / p >
< / div >
< / div >
<!-- Logical / set binary operators -- >
< div class = "introduce-view__content" >
< h2 id = "Logical-binary-operators" > Logical / set binary operators < / h2 >
< div class = "introduce-view__content-label" >
< p > These logical / set binary operators are only defined between instant vectors : < / p >
< ul >
< li > < code > and < / code > ( intersection ) < / li >
< li > < code > or < / code > ( union ) < / li >
< li > < code > unless < / code > ( complement ) < / li >
< / ul >
< p > < code > vector1 and vector2 < / code > results in a vector consisting of the elements of < code > vector1 < / code > for which there are elements in < code > vector2 < / code > with exactly matching label sets . Other elements are dropped . The metric name and values are carried over from the left - hand side vector . < / p >
< p > < code > vector1 or vector2 < / code > results in a vector that contains all original elements ( label sets + values ) of < code > vector1 < / code > and additionally all elements of < code > vector2 < / code > which do not have matching label sets in < code > vector1 < / code > . < / p >
< p > < code > vector1 unless vector2 < / code > results in a vector consisting of the elements of < code > vector1 < / code > for which there are no elements in < code > vector2 < / code > with exactly matching label sets . All matching elements in both vectors are dropped . < / p >
< / div >
< / div >
<!-- Vector matching -- >
< h1 class = "page-header-two" id = "vector-matching" > Vector matching < / h1 >
< div class = "introduce-view__content" >
< div class = "introduce-view__content-label" >
< p > Operations between vectors attempt to find a matching element in the right - hand side vector for each entry in the left - hand side . There are two basic types of matching behavior : One - to - one and many - to - one / one - to - many . < / p >
< / div >
< / div >
<!-- Vector matching keywords -- >
< div class = "introduce-view__content" >
< h2 id = "vector-matching-keywords" > Vector matching keywords < / h2 >
< div class = "introduce-view__content-label" >
< p > These vector matching keywords allow for matching between series with different label sets providing : < / p >
< ul >
< li > < code > on < / code > < / li >
< li > < code > ignoring < / code > < / li >
< / ul >
< p > Label lists provided to matching keywords will determine how vectors are combined . Examples can be found in < b style = "color: #3C92F1" @click ="jumpClick('#one-to-one-vector-matches')" class = "log-link" > One - to - one vector matches < / b > and in < b style = "color: #3C92F1" @click ="jumpClick('#many-to-one')" class = "log-link" > Many - to - one and one - to - many vector matches < / b > < / p >
< / div >
< / div >
<!-- Group modifiers -- >
< div class = "introduce-view__content" >
< h2 id = "group-modifiers" > Group modifiers < / h2 >
< div class = "introduce-view__content-label" >
< p > These group modifiers enable many - to - one / one - to - many vector matching : < / p >
< ul >
< li > < code > group _left < / code > < / li >
< li > < code > group _right < / code > < / li >
< / ul >
< p > Label lists can be provided to the group modifier which contain labels from the "one" - side to be included in the result metrics . < / p >
< p style = "font-style:italic;" > Many - to - one and one - to - many matching are advanced use cases that should be carefully considered . Often a proper use of < code > ignoring ( & lt ; labels & gt ; ) < / code > provides the desired outcome . < / p >
< p style = "font-style:italic;" > Grouping modifiers can only be used for < b style = "color: #3C92F1" @click ="jumpClick('#comparison-binary-operators')" class = "log-link" > comparison < / b > and < b style = "color: #3C92F1" @click ="jumpClick('#arithmetic-binary-operators')" class = "log-link" > arithmetic < / b > . Operations as < code > and < / code > , < code > unless < / code > and < code > or < / code > operations match with all possible entries in the right vector by default . < / p >
< / div >
< / div >
<!-- One - to - one vector matches -- >
< div class = "introduce-view__content" >
< h2 id = "one-to-one-vector-matches" > One - to - one vector matches < / h2 >
< div class = "introduce-view__content-label" >
< p > < b > One - to - one < / b > finds a unique pair of entries from each side of the operation . In the default case , that is an operation following the format < code > vector1 & lt ; operator & gt ; vector2 < / code > . Two entries match if they have the exact same set of labels and corresponding values . The < code > ignoring < / code > keyword allows ignoring certain labels when matching , while the < code > on < / code > keyword allows reducing the set of considered labels to a provided list : < / p >
< pre > & lt ; vector expr & gt ; & lt ; bin - op & gt ; ignoring ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
& lt ; vector expr & gt ; & lt ; bin - op & gt ; on ( & lt ; label list & gt ; ) & lt ; vector expr & gt ; < / pre >
< p > Example input : < / p >
< pre > method _code : http _errors : rate5m { method = "get" , code = "500" } 24
method _code : http _errors : rate5m { method = "get" , code = "404" } 30
method _code : http _errors : rate5m { method = "put" , code = "501" } 3
method _code : http _errors : rate5m { method = "post" , code = "500" } 6
method _code : http _errors : rate5m { method = "post" , code = "404" } 21
2021-08-02 19:51:53 +08:00
2022-09-27 11:18:55 +08:00
method : http _requests : rate5m { method = "get" } 600
method : http _requests : rate5m { method = "del" } 34
method : http _requests : rate5m { method = "post" } 120 < / pre >
< p > Example query : < / p >
2022-09-27 14:49:45 +08:00
< pre > method _code : http _errors : rate5m { code = "500" } / ignoring ( code ) method : http _requests : rate5m < / pre >
2022-09-27 11:18:55 +08:00
< p > This returns a result vector containing the fraction of HTTP requests with status code of 500 for each method , as measured over the last 5 minutes . Without < code > ignoring ( code ) < / code > there would have been no match as the metrics do not share the same set of labels . The entries with methods < code > put < / code > and < code > del < / code > have no match and will not show up in the result : < / p >
< pre > { method = "get" } 0.04 // 24 / 600
{ method = "post" } 0.05 // 6 / 120</pre>
< / div >
< / div >
<!-- Many - to - one and one - to - many vector matches -- >
< div class = "introduce-view__content" >
< h2 id = "many-to-one" > Many - to - one and one - to - many vector matches < / h2 >
< div class = "introduce-view__content-label" >
< p > < b > Many - to - one < / b > and < b > one - to - many < / b > matchings refer to the case where each vector element on the "one" - side can match with multiple elements on the "many" - side . This has to be explicitly requested using the < code > group _left < / code > or < code > group _right < / code > modifiers , where left / right determines which vector has the higher cardinality . < / p >
2022-09-27 14:49:45 +08:00
< pre > & lt ; vector expr > & lt ; bin - op & gt ; ignoring ( & lt ; label list & gt ; ) group _left ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
2022-09-27 11:18:55 +08:00
& lt ; vector expr & gt ; & lt ; bin - op & gt ; ignoring ( & lt ; label list & gt ; ) group _right ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
& lt ; vector expr & gt ; & lt ; bin - op & gt ; on ( & lt ; label list & gt ; ) group _left ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
& lt ; vector expr & gt ; & lt ; bin - op & gt ; on ( & lt ; label list & gt ; ) group _right ( & lt ; label list & gt ; ) & lt ; vector expr & gt ; < / pre >
< p > The label list provided with the group modifier contains additional labels from the "one" - side to be included in the result metrics . For < code > on < / code > a label can only appear in one of the lists . Every time series of the result vector must be uniquely identifiable . < / p >
< p > Example query : < / p >
2022-09-27 14:49:45 +08:00
< pre > method _code : http _errors : rate5m / ignoring ( code ) group _left method : http _requests : rate5m < / pre >
2022-09-27 11:18:55 +08:00
< p > In this case the left vector contains more than one entry per < code > method < / code > label value . Thus , we indicate this using < code > group _left < / code > . The elements from the right side are now matched with multiple elements with the same < code > method < / code > label on the left : < / p >
< pre > { method = "get" , code = "500" } 0.04 // 24 / 600
{ method = "get" , code = "404" } 0.05 // 30 / 600
{ method = "post" , code = "500" } 0.05 // 6 / 120
{ method = "post" , code = "404" } 0.175 // 21 / 120</pre>
< / div >
< / div >
<!-- Aggregation operators -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "aggregation-operators" > Aggregation operators < / h1 >
< div class = "introduce-view__content-label" >
< p > Prometheus supports the following built - in aggregation operators that can be used to aggregate the elements of a single instant vector , resulting in a new vector of fewer elements with aggregated values : < / p >
< ul >
< li > < code > sum < / code > ( calculate sum over dimensions ) < / li >
< li > < code > min < / code > ( select minimum over dimensions ) < / li >
< li > < code > max < / code > ( select maximum over dimensions ) < / li >
< li > < code > avg < / code > ( calculate the average over dimensions ) < / li >
< li > < code > group < / code > ( all values in the resulting vector are 1 ) < / li >
< li > < code > stddev < / code > ( calculate population standard deviation over dimensions ) < / li >
< li > < code > stdvar < / code > ( calculate population standard variance over dimensions ) < / li >
< li > < code > count < / code > ( count number of elements in the vector ) < / li >
< li > < code > count _values < / code > ( count number of elements with the same value ) < / li >
< li > < code > bottomk < / code > ( smallest k elements by sample value ) < / li >
< li > < code > topk < / code > ( largest k elements by sample value ) < / li >
< li > < code > quantile < / code > ( calculate φ - quantile ( 0 ≤ φ ≤ 1 ) over dimensions ) < / li >
< / ul >
< p > These operators can either be used to aggregate over < b > all < / b > label dimensions or preserve distinct dimensions by including a < code > without < / code > or < code > by < / code > clause . These clauses may be used before or after the expression . < / p >
< pre > & lt ; aggr - op & gt ; [ without | by ( & lt ; label list & gt ; ) ] ( [ parameter , ] & lt ; vector expression & gt ; ) < / pre >
< p > or < / p >
< pre > & lt ; aggr - op & gt ; ( [ parameter , ] & lt ; vector expression & gt ; ) [ without | by ( & lt ; label list & gt ; ) ] < / pre >
< p > < code > label list < / code > is a list of unquoted labels that may include a trailing comma , i . e . both < code > ( label1 , label2 ) < / code > and < code > ( label1 , label2 , ) < / code > are valid syntax . < / p >
< p > < code > without < / code > removes the listed labels from the result vector , while all other labels are preserved in the output . < code > by < / code > does the opposite and drops labels that are not listed in the < code > by < / code > clause , even if their label values are identical between all elements of the vector . < / p >
< p > < code > parameter < / code > is only required for < code > count _values < / code > , < code > quantile < / code > , < code > topk < / code > and < code > bottomk < / code > . < / p >
< p > < code > count _values < / code > outputs one time series per unique sample value . Each series has an additional label . The name of that label is given by the aggregation parameter , and the label value is the unique sample value . The value of each time series is the number of times that sample value was present . < / p >
< p > < code > topk < / code > and < code > bottomk < / code > are different from other aggregators in that a subset of the input samples , including the original labels , are returned in the result vector . < code > by < / code > and < code > without < / code > are only used to bucket the input vector . < / p >
< p > < code > quantile < / code > calculates the φ - quantile , the value that ranks at number φ * N among the N metric values of the dimensions aggregated over . φ is provided as the aggregation parameter . For example , < code > quantile ( 0.5 , ... ) < / code > calculates the median , < code > quantile ( 0.95 , ... ) < / code > the 95 th percentile . For φ = < code > NaN < / code > , < code > NaN < / code > is returned . For φ & lt ; 0 , - Inf is returned . For φ > 1 , < code > + Inf < / code > is returned . < / p >
< p > Example : < / p >
< p > If the metric < code > http _requests _total < / code > had time series that fan out by < code > application < / code > , < code > instance < / code > , and < code > group < / code > labels , we could calculate the total number of seen HTTP requests per application and group over all instances via : < / p >
< pre > sum without ( instance ) ( http _requests _total ) < / pre >
< p > Which is equivalent to : < / p >
< pre > sum by ( application , group ) ( http _requests _total ) < / pre >
< p > If we are just interested in the total of HTTP requests we have seen in < b > all < / b > applications , we could simply write : < / p >
< pre > sum ( http _requests _total ) < / pre >
< p > To count the number of binaries running each build version we could write : < / p >
< pre > count _values ( "version" , build _version ) < / pre >
< p > To get the 5 largest HTTP requests counts across all instances we could write : < / p >
< pre > topk ( 5 , http _requests _total ) < / pre >
< / div >
< / div >
<!-- Binary operator precedence -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "binary-operator-precedence" > Binary operator precedence < / h1 >
< div class = "introduce-view__content-label binary-operator-precedence" >
< p > The following list shows the precedence of binary operators in Prometheus , from highest to lowest . < / p >
< ul >
< li > < code > ^ < / code > < / li >
< li > < code > * < / code > , < code > / < / code > , < code > % < / code > , < code > atan2 < / code > < / li >
< li > < code > + < / code > , < code > - < / code > < / li >
< li > < code > == < / code > , < code > != < / code > , < code > & lt ; = < / code > , < code > & lt ; < / code > , < code > & gt ; = < / code > , < code > & gt ; < / code > < / li >
< li > < code > and < / code > , < code > unless < / code > < / li >
< li > < code > or < / code > < / li >
< / ul >
< p > Operators on the same precedence level are left - associative . For example , < code > 2 * 3 % 2 < / code > is equivalent to < code > ( 2 * 3 ) % 2 < / code > . However < code > ^ < / code > is right associative , so < code > 2 ^ 3 ^ 2 < / code > is equivalent to < code > 2 ^ ( 3 ^ 2 ) < / code > . < / p >
< / div >
< / div >
<!-- FUNCTIONS -- >
< h1 class = "page-header-one" id = "functions" > Functions < / h1 >
< div class = "introduce-view__content" >
< div class = "introduce-view__content-label" >
< p > Some functions have default arguments , e . g . < code > year ( v = vector ( time ( ) ) instant - vector ) < / code > . This means that there is one argument v which is an instant vector , which if not provided it will default to the value of the expression < code > vector ( time ( ) ) < / code > . < / p >
< / div >
< / div >
<!-- abs ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-abs" > abs ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > abs ( v instant - vector ) < / code > returns the input vector with all sample values converted to their absolute value . < / p >
< / div >
< / div >
<!-- absent ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-absent" > absent ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > absent ( v instant - vector ) < / code > returns an empty vector if the vector passed to it has any elements and a 1 - element vector with the value 1 if the vector passed to it has no elements . < / p >
< p > This is useful for alerting on when no time series exist for a given metric name and label combination . < / p >
< pre > absent ( nonexistent { job = "myjob" } )
# => { job = "myjob" }
2021-08-02 19:51:53 +08:00
2022-09-27 11:18:55 +08:00
absent ( nonexistent { job = "myjob" , instance = ~ ".*" } )
# => { job = "myjob" }
2021-08-02 19:51:53 +08:00
2022-09-27 11:18:55 +08:00
absent ( sum ( nonexistent { job = "myjob" } ) )
# => { } < / pre >
< p > In the first two examples , < code > absent ( ) < / code > tries to be smart about deriving labels of the 1 - element output vector from the input vector . < / p >
< / div >
< / div >
<!-- absent _over _time ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-absent_over_time" > absent _over _time ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > absent _over _time ( v range - vector ) < / code > returns an empty vector if the range vector passed to it has any elements and a 1 - element vector with the value 1 if the range vector passed to it has no elements . < / p >
< p > This is useful for alerting on when no time series exist for a given metric name and label combination for a certain amount of time . < / p >
< pre > absent _over _time ( nonexistent { job = "myjob" } [ 1 h ] )
# => { job = "myjob" }
2021-08-02 19:51:53 +08:00
2022-09-27 11:18:55 +08:00
absent _over _time ( nonexistent { job = "myjob" , instance = ~ ".*" } [ 1 h ] )
# => { job = "myjob" }
2021-08-02 19:51:53 +08:00
2022-09-27 11:18:55 +08:00
absent _over _time ( sum ( nonexistent { job = "myjob" } ) [ 1 h : ] )
# => { } < / pre >
< p > In the first two examples , < code > absent _over _time ( ) < / code > tries to be smart about deriving labels of the 1 - element output vector from the input vector . < / p >
< / div >
< / div >
<!-- ceil ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-ceil" > ceil ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > ceil ( v instant - vector ) < / code > rounds the sample values of all elements in < code > v < / code > up to the nearest integer . < / p >
< / div >
< / div >
<!-- changes ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-changes" > changes ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > For each input time series , < code > changes ( v range - vector ) < / code > returns the number of times its value has changed within the provided time range as an instant vector . < / p >
< / div >
< / div >
<!-- clamp ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-clamp" > clamp ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > clamp ( v instant - vector , min scalar , max scalar ) < / code > clamps the sample values of all elements in < code > v < / code > to have a lower limit of < code > min < / code > and an upper limit of < code > max < / code > . < / p >
< p > Special cases : - Return an empty vector if < code > min > max < / code > - Return < code > NaN < / code > if < code > min < / code > or < code > max < / code > is < code > NaN < / code > < / p >
< / div >
< / div >
<!-- clamp _max ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-clamp_max" > clamp _max ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > clamp _max ( v instant - vector , max scalar ) < / code > clamps the sample values of all elements in < code > v < / code > to have an upper limit of < code > max < / code > . < / p >
< / div >
< / div >
<!-- clamp _min ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-clamp_min" > clamp _min ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > clamp _min ( v instant - vector , min scalar ) < / code > clamps the sample values of all elements in < code > v < / code > to have a lower limit of < code > min < / code > . < / p >
< / div >
< / div >
<!-- day _of _month ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-day_of_month" > day _of _month ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > day _of _month ( v = vector ( time ( ) ) instant - vector ) < / code > returns the day of the month for each of the given times in UTC . Returned values are from 1 to 31. < / p >
< / div >
< / div >
<!-- day _of _week ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-day_of_week" > day _of _week ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > day _of _week ( v = vector ( time ( ) ) instant - vector ) < / code > returns the day of the week for each of the given times in UTC . Returned values are from 0 to 6 , where 0 means Sunday etc . < / p >
< / div >
< / div >
<!-- day _of _year ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-day_of_year" > day _of _year ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > day _of _year ( v = vector ( time ( ) ) instant - vector ) < / code > returns the day of the year for each of the given times in UTC . Returned values are from 1 to 365 for non - leap years , and 1 to 366 in leap years . < / p >
< / div >
< / div >
<!-- days _in _month ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-days_in_month" > days _in _month ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > days _in _month ( v = vector ( time ( ) ) instant - vector ) < / code > returns number of days in the month for each of the given times in UTC . Returned values are from 28 to 31. < / p >
< / div >
< / div >
<!-- delta ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-delta" > delta ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > delta ( v range - vector ) < / code > calculates the difference between the first and last value of each time series element in a range vector < code > v < / code > , returning an instant vector with the given deltas and equivalent labels . The delta is extrapolated to cover the full time range as specified in the range vector selector , so that it is possible to get a non - integer result even if the sample values are all integers . < / p >
< p > The following example expression returns the difference in CPU temperature between now and 2 hours ago : < / p >
< pre > delta ( cpu _temp _celsius { host = "zeus" } [ 2 h ] ) < / pre >
< p > < code > delta < / code > should only be used with gauges . < / p >
< / div >
< / div >
<!-- deriv ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-deriv" > deriv ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > deriv ( v range - vector ) < / code > calculates the per - second derivative of the time series in a range vector < code > v < / code > , using simple linear regression . The range vector must have at least two samples in order to perform the calculation . When < code > + Inf < / code > or < code > - Inf < / code > are found in the range vector , the slope and offset value calculated will be < code > NaN < / code > . < / p >
< p > < code > deriv < / code > should only be used with gauges . < / p >
< / div >
< / div >
<!-- exp ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-exp" > exp ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > exp ( v instant - vector ) < / code > calculates the exponential function for all elements in < code > v < / code > . Special cases are : < / p >
< ul >
< li > < code > Exp ( + Inf ) = + Inf < / code > < / li >
< li > < code > Exp ( NaN ) = NaN < / code > < / li >
< / ul >
< / div >
< / div >
<!-- floor ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-floor" > floor ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > floor ( v instant - vector ) < / code > rounds the sample values of all elements in < code > v < / code > down to the nearest integer . < / p >
< / div >
< / div >
<!-- histogram _quantile ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-histogram_quantile" > histogram _quantile ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > histogram _quantile ( φ scalar , b instant - vector ) < / code > calculates the φ - quantile ( 0 ≤ φ ≤ 1 ) from the buckets < code > b < / code > of a histogram . ( See histograms and summaries for a detailed explanation of φ - quantiles and the usage of the histogram metric type in general . ) The samples in b are the counts of observations in each bucket . Each sample must have a label < code > le < / code > where the label value denotes the inclusive upper bound of the bucket . ( Samples without such a label are silently ignored . ) The histogram metric type automatically provides time series with the < code > _bucket < / code > suffix and the appropriate labels . < / p >
< p > Use the < code > rate ( ) < / code > function to specify the time window for the quantile calculation . < / p >
< p > Example : A histogram metric is called < code > http _request _duration _seconds < / code > . To calculate the 90 th percentile of request durations over the last 10 m , use the following expression : < / p >
< pre > histogram _quantile ( 0.9 , rate ( http _request _duration _seconds _bucket [ 10 m ] ) ) < / pre >
< p > The quantile is calculated for each label combination in < code > http _request _duration _seconds < / code > . To aggregate , use the < code > sum ( ) < / code > aggregator around the < code > rate ( ) < / code > function . Since the < code > le < / code > label is required by < code > histogram _quantile ( ) < / code > , it has to be included in the < code > by < / code > clause . The following expression aggregates the 90 th percentile by < code > job < / code > : < / p >
2022-09-27 14:49:45 +08:00
< pre > histogram _quantile ( 0.9 , sum by ( job , le ) ( rate ( http _request _duration _seconds _bucket [ 10 m ] ) ) ) < / pre >
2022-09-27 11:18:55 +08:00
< p > To aggregate everything , specify only the < code > le < / code > label : < / p >
2022-09-27 14:49:45 +08:00
< pre > histogram _quantile ( 0.9 , sum by ( le ) ( rate ( http _request _duration _seconds _bucket [ 10 m ] ) ) ) < / pre >
2022-09-27 11:18:55 +08:00
< p > The < code > histogram _quantile ( ) < / code > function interpolates quantile values by assuming a linear distribution within a bucket . The highest bucket must have an upper bound of < code > + Inf < / code > . ( Otherwise , < code > NaN < / code > is returned . ) If a quantile is located in the highest bucket , the upper bound of the second highest bucket is returned . A lower limit of the lowest bucket is assumed to be 0 if the upper bound of that bucket is greater than 0. In that case , the usual linear interpolation is applied within that bucket . Otherwise , the upper bound of the lowest bucket is returned for quantiles located in the lowest bucket . < / p >
< p > If < code > b < / code > has 0 observations , < code > NaN < / code > is returned . If < code > b < / code > contains fewer than two buckets , < code > NaN < / code > is returned . For φ < 0 , < code > - Inf < / code > is returned . For φ > 1 , < code > + Inf < / code > is returned . For φ = < code > NaN < / code > , < code > NaN < / code > is returned . < / p >
< / div >
< / div >
<!-- holt _winters ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-holt_winters" > holt _winters ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > holt _winters ( v range - vector , sf scalar , tf scalar ) < / code > produces a smoothed value for time series based on the range in < code > v < / code > . The lower the smoothing factor < code > sf < / code > , the more importance is given to old data . The higher the trend factor < code > tf < / code > , the more trends in the data is considered . Both < code > sf < / code > and tf must be between 0 and 1. < / p >
< p > < code > holt _winters < / code > should only be used with gauges . < / p >
< / div >
< / div >
<!-- hour ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-hour" > hour ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > hour ( v = vector ( time ( ) ) instant - vector ) < / code > returns the hour of the day for each of the given times in UTC . Returned values are from 0 to 23. < / p >
< / div >
< / div >
<!-- idelta ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-idelta" > idelta ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > idelta ( v range - vector ) < / code > calculates the difference between the last two samples in the range vector < code > v < / code > , returning an instant vector with the given deltas and equivalent labels . < / p >
< p > < code > idelta < / code > should only be used with gauges . < / p >
< / div >
< / div >
<!-- increase ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-increase" > increase ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > increase ( v range - vector ) < / code > calculates the increase in the time series in the range vector . Breaks in monotonicity ( such as counter resets due to target restarts ) are automatically adjusted for . The increase is extrapolated to cover the full time range as specified in the range vector selector , so that it is possible to get a non - integer result even if a counter increases only by integer increments . < / p >
< p > The following example expression returns the number of HTTP requests as measured over the last 5 minutes , per time series in the range vector : < / p >
< pre > increase ( http _requests _total { job = "api-server" } [ 5 m ] ) < / pre >
< p > < code > increase < / code > should only be used with counters . It is syntactic sugar for < code > rate ( v ) < / code > multiplied by the number of seconds under the specified time range window , and should be used primarily for human readability . Use < code > rate < / code > in recording rules so that increases are tracked consistently on a per - second basis . < / p >
< / div >
< / div >
<!-- irate ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-irate" > irate ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > irate ( v range - vector ) < / code > calculates the per - second instant rate of increase of the time series in the range vector . This is based on the last two data points . Breaks in monotonicity ( such as counter resets due to target restarts ) are automatically adjusted for . < / p >
< p > The following example expression returns the per - second rate of HTTP requests looking up to 5 minutes back for the two most recent data points , per time series in the range vector : < / p >
< pre > irate ( http _requests _total { job = "api-server" } [ 5 m ] ) < / pre >
< p > < code > irate < / code > should only be used when graphing volatile , fast - moving counters . Use < code > rate < / code > for alerts and slow - moving counters , as brief changes in the rate can reset the < code > FOR < / code > clause and graphs consisting entirely of rare spikes are hard to read . < / p >
< p > Note that when combining < code > irate ( ) < / code > with an aggregation operator ( e . g . < code > sum ( ) < / code > ) or a function aggregating over time ( any function ending in < code > _over _time < / code > ) , always take a < code > irate ( ) < / code > first , then aggregate . Otherwise < code > irate ( ) < / code > cannot detect counter resets when your target restarts . < / p >
< / div >
< / div >
<!-- label _join ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-label_join" > label _join ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > For each timeseries in < code > v < / code > , < code > label _join ( v instant - vector , dst _label string , separator string , src _label _1 string , src _label _2 string , ... ) < / code > joins all the values of all the < code > src _labels < / code > using < code > separator < / code > and returns the timeseries with the label < code > dst _label < / code > containing the joined value . There can be any number of < code > src _labels < / code > in this function . < / p >
< p > This example will return a vector with each time series having a < code > foo < / code > label with the value < code > a , b , c < / code > added to it : < / p >
2022-09-27 14:49:45 +08:00
< pre > label _join ( up { job = "api-server" , src1 = "a" , src2 = "b" , src3 = "c" } , "foo" , "," , "src1" , "src2" , "src3" ) < / pre >
2022-09-27 11:18:55 +08:00
< / div >
< / div >
<!-- label _replace ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-label_replace" > label _replace ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > For each timeseries in < code > v < / code > , < code > label _replace ( v instant - vector , dst _label string , replacement string , src _label string , regex string ) < / code > matches the regular expression < code > regex < / code > against the value of the label < code > src _label < / code > . If it matches , the value of the label < code > dst _label < / code > in the returned timeseries will be the expansion of < code > replacement < / code > , together with the original labels in the input . Capturing groups in the regular expression can be referenced with < code > $1 < / code > , < code > $2 < / code > , etc . If the regular expression doesn ' t match then the timeseries is returned unchanged . < / p >
< p > This example will return timeseries with the values < code > a : c < / code > at label < code > service < / code > and < code > a < / code > at label < code > foo < / code > : < / p >
2022-09-27 14:49:45 +08:00
< pre > label _replace ( up { job = "api-server" , service = "a:c" } , "foo" , "$1" , "service" , "(.*):.*" ) < / pre >
2022-09-27 11:18:55 +08:00
< / div >
< / div >
<!-- ln ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-ln" > ln ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > ln ( v instant - vector ) < / code > calculates the natural logarithm for all elements in < code > v < / code > . Special cases are : < / p >
< ul >
< li > < code > ln ( + Inf ) = + Inf < / code > < / li >
< li > < code > ln ( 0 ) = - Inf < / code > < / li >
< li > < code > ln ( x & lt ; 0 ) = NaN < / code > < / li >
< li > < code > ln ( NaN ) = NaN < / code > < / li >
< / ul >
< / div >
< / div >
<!-- log2 ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-log2" > log2 ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > log2 ( v instant - vector ) < / code > calculates the binary logarithm for all elements in < code > v < / code > . The special cases are equivalent to those in < code > ln < / code > . < / p >
< / div >
< / div >
<!-- log10 ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-log10" > log10 ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > log10 ( v instant - vector ) < / code > calculates the decimal logarithm for all elements in < code > v < / code > . The special cases are equivalent to those in < code > ln < / code > . < / p >
< / div >
< / div >
<!-- minute ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-minute" > minute ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > minute ( v = vector ( time ( ) ) instant - vector ) < / code > returns the minute of the hour for each of the given times in UTC . Returned values are from 0 to 59. < / p >
< / div >
< / div >
<!-- month ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-month" > month ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > month ( v = vector ( time ( ) ) instant - vector ) < / code > returns the month of the year for each of the given times in UTC . Returned values are from 1 to 12 , where 1 means January etc . < / p >
< / div >
< / div >
<!-- predict _linear ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-predict_linear" > predict _linear ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > predict _linear ( v range - vector , t scalar ) < / code > predicts the value of time series < code > t < / code > seconds from now , based on the range vector < code > v < / code > , using simple linear regression . The range vector must have at least two samples in order to perform the calculation . When < code > + Inf < / code > or < code > - Inf < / code > are found in the range vector , the slope and offset value calculated will be < code > NaN < / code > . < / p >
< p > < code > predict _linear < / code > should only be used with gauges . < / p >
< / div >
< / div >
<!-- rate ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-rate" > rate ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > rate ( v range - vector ) < / code > calculates the per - second average rate of increase of the time series in the range vector . Breaks in monotonicity ( such as counter resets due to target restarts ) are automatically adjusted for . Also , the calculation extrapolates to the ends of the time range , allowing for missed scrapes or imperfect alignment of scrape cycles with the range ' s time period . < / p >
< p > The following example expression returns the per - second rate of HTTP requests as measured over the last 5 minutes , per time series in the range vector : < / p >
< pre > rate ( http _requests _total { job = "api-server" } [ 5 m ] ) < / pre >
< p > < code > rate < / code > should only be used with counters . It is best suited for alerting , and for graphing of slow - moving counters . < / p >
< p > Note that when combining < code > rate ( ) < / code > with an aggregation operator ( e . g . < code > sum ( ) < / code > ) or a function aggregating over time ( any function ending in < code > _over _time < / code > ) , always take a < code > rate ( ) < / code > first , then aggregate . Otherwise < code > rate ( ) < / code > cannot detect counter resets when your target restarts . < / p >
< / div >
< / div >
<!-- resets ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-resets" > resets ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > For each input time series , < code > resets ( v range - vector ) < / code > returns the number of counter resets within the provided time range as an instant vector . Any decrease in the value between two consecutive samples is interpreted as a counter reset . < / p >
< p > < code > resets < / code > should only be used with counters . < / p >
< / div >
< / div >
<!-- round ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-round" > round ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > round ( v instant - vector , to _nearest = 1 scalar ) < / code > rounds the sample values of all elements in < code > v < / code > to the nearest integer . Ties are resolved by rounding up . The optional < code > to _nearest < / code > argument allows specifying the nearest multiple to which the sample values should be rounded . This multiple may also be a fraction . < / p >
< / div >
< / div >
<!-- scalar ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-scalar" > scalar ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > Given a single - element input vector , < code > scalar ( v instant - vector ) < / code > returns the sample value of that single element as a scalar . If the input vector does not have exactly one element , < code > scalar < / code > will return < code > NaN < / code > . < / p >
< / div >
< / div >
<!-- sgn ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sgn" > sgn ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > sgn ( v instant - vector ) < / code > returns a vector with all sample values converted to their sign , defined as this : 1 if v is positive , - 1 if v is negative and 0 if v is equal to zero . < / p >
< / div >
< / div >
<!-- sort ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sort" > sort ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > sort ( v instant - vector ) < / code > returns vector elements sorted by their sample values , in ascending order . < / p >
< / div >
< / div >
<!-- sort _desc ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sort_desc" > sort _desc ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > Same as < code > sort < / code > , but sorts in descending order . < / p >
< / div >
< / div >
<!-- sqrt ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sqrt" > sqrt ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > sqrt ( v instant - vector ) < / code > calculates the square root of all elements in < code > v < / code > . < / p >
< / div >
< / div >
<!-- time ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-time" > time ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > time ( ) < / code > returns the number of seconds since January 1 , 1970 UTC . Note that this does not actually return the current time , but the time at which the expression is to be evaluated . < / p >
< / div >
< / div >
<!-- timestamp ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-timestamp" > timestamp ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > timestamp ( v instant - vector ) < / code > returns the timestamp of each of the samples of the given vector as the number of seconds since January 1 , 1970 UTC . < / p >
< / div >
< / div >
<!-- vector ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-vector" > vector ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > vector ( s scalar ) < / code > returns the scalar < code > s < / code > as a vector with no labels . < / p >
< / div >
< / div >
<!-- year ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-year" > year ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > year ( v = vector ( time ( ) ) instant - vector ) < / code > returns the year for each of the given times in UTC . < / p >
< / div >
< / div >
<!-- < aggregation > _over _time ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-aggregation" > & lt ; aggregation & gt ; _over _time ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > The following functions allow aggregating each series of a given range vector over time and return an instant vector with per - series aggregation results : < / p >
< ul >
< li > < code > avg _over _time ( range - vector ) : < / code > the average value of all points in the specified interval . < / li >
< li > < code > min _over _time ( range - vector ) : < / code > the minimum value of all points in the specified interval . < / li >
< li > < code > max _over _time ( range - vector ) : < / code > the maximum value of all points in the specified interval . < / li >
< li > < code > sum _over _time ( range - vector ) : < / code > the sum of all values in the specified interval . < / li >
< li > < code > count _over _time ( range - vector ) : < / code > the count of all values in the specified interval . < / li >
< li > < code > quantile _over _time ( scalar , range - vector ) : < / code > the φ - quantile ( 0 ≤ φ ≤ 1 ) of the values in the specified interval . < / li >
< li > < code > stddev _over _time ( range - vector ) : < / code > the population standard deviation of the values in the specified interval . < / li >
< li > < code > stdvar _over _time ( range - vector ) : < / code > the population standard variance of the values in the specified interval . < / li >
< li > < code > last _over _time ( range - vector ) : < / code > the most recent point value in specified interval . < / li >
< li > < code > present _over _time ( range - vector ) : < / code > the value 1 for any series in the specified interval . < / li >
< / ul >
< p > Note that all values in the specified interval have the same weight in the aggregation even if the values are not equally spaced throughout the interval . < / p >
< / div >
< / div >
<!-- Trigonometric Functions -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-trigonometric" > Trigonometric Functions < / h1 >
< div class = "introduce-view__content-label" >
< p > The trigonometric functions work in radians : < / p >
< ul >
< li > < code > acos ( v instant - vector ) : < / code > calculates the arccosine of all elements in v ( special cases ) . < / li >
< li > < code > acosh ( v instant - vector ) : < / code > calculates the inverse hyperbolic cosine of all elements in v ( special cases ) . < / li >
< li > < code > asin ( v instant - vector ) : < / code > calculates the arcsine of all elements in v ( special cases ) . < / li >
< li > < code > asinh ( v instant - vector ) : < / code > calculates the inverse hyperbolic sine of all elements in v ( special cases ) . < / li >
< li > < code > atan ( v instant - vector ) : < / code > calculates the arctangent of all elements in v ( special cases ) . < / li >
< li > < code > atanh ( v instant - vector ) : < / code > calculates the inverse hyperbolic tangent of all elements in v ( special cases ) . < / li >
< li > < code > cos ( v instant - vector ) : < / code > calculates the cosine of all elements in v ( special cases ) . < / li >
< li > < code > cosh ( v instant - vector ) : < / code > calculates the hyperbolic cosine of all elements in v ( special cases ) . < / li >
< li > < code > sin ( v instant - vector ) : < / code > calculates the sine of all elements in v ( special cases ) . < / li >
< li > < code > sinh ( v instant - vector ) : < / code > calculates the hyperbolic sine of all elements in v ( special cases ) . < / li >
< li > < code > tan ( v instant - vector ) : < / code > calculates the tangent of all elements in v ( special cases ) . < / li >
< li > < code > tanh ( v instant - vector ) : < / code > calculates the hyperbolic tangent of all elements in v ( special cases ) . < / li >
< / ul >
< p > The following are useful for converting between degrees and radians : < / p >
< ul >
< li > < code > deg ( v instant - vector ) < / code > : converts radians to degrees for all elements in < code > v < / code > . < / li >
< li > < code > pi ( ) < / code > : returns pi . < / li >
< li > < code > rad ( v instant - vector ) < / code > : converts degrees to radians for all elements in < code > v < / code > . < / li >
< / ul >
< / div >
< / div >
<!-- QUERY EXAMPLES -- >
< h1 class = "page-header-one" id = "query-examples" > Query examples < / h1 >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "simple-time-series-selection" > Simple time series selection < / h1 >
< div class = "introduce-view__content-label" >
< p > Return all time series with the metric < code > http _requests _total < / code > : < / p >
< pre > http _requests _total < / pre >
< p > Return all time series with the metric < code > http _requests _total < / code > and the given < code > job < / code > and < code > handler < / code > labels : < / p >
< pre > http _requests _total { job = "apiserver" , handler = "/api/comments" } < / pre >
< p > Return a whole range of time ( in this case 5 minutes up to the query time ) for the same vector , making it a < b style = "color: #3C92F1" @click ="jumpClick('#range-vector-selectors')" class = "log-link" > range vector < / b > : < / p >
< pre > http _requests _total { job = "apiserver" , handler = "/api/comments" } [ 5 m ] < / pre >
< p > Note that an expression resulting in a range vector cannot be graphed directly , but viewed in the tabular ( "Console" ) view of the expression browser . < / p >
< p > Using regular expressions , you could select time series only for jobs whose name match a certain pattern , in this case , all jobs that end with < code > server < / code > : < / p >
< pre > http _requests _total { job = ~ ".*server" } < / pre >
< p > All regular expressions in Prometheus use RE2 syntax . < / p >
< p > To select all HTTP status codes except 4 xx ones , you could run : < / p >
< pre > http _requests _total { status ! ~ "4.." } < / pre >
< / div >
< / div >
<!-- Subquery -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "query-examples-subquery" > Subquery < / h1 >
< div class = "introduce-view__content-label" >
< p > Return the 5 - minute rate of the < code > http _requests _total < / code > metric for the past 30 minutes , with a resolution of 1 minute . < / p >
< pre > rate ( http _requests _total [ 5 m ] ) [ 30 m : 1 m ] < / pre >
< p > This is an example of a nested subquery . The subquery for the < code > deriv < / code > function uses the default resolution . Note that using subqueries unnecessarily is unwise . < / p >
< pre > max _over _time ( deriv ( rate ( distance _covered _total [ 5 s ] ) [ 30 s : 5 s ] ) [ 10 m : ] ) < / pre >
< / div >
< / div >
<!-- Using functions , operators , etc . -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "using-functions" > Using functions , operators , etc . < / h1 >
< div class = "introduce-view__content-label" >
< p > Return the per - second rate for all time series with the < code > http _requests _total < / code > metric name , as measured over the last 5 minutes : < / p >
< pre > rate ( http _requests _total [ 5 m ] ) < / pre >
< p > Assuming that the < code > http _requests _total < / code > time series all have the labels < code > job < / code > ( fanout by job name ) and < code > instance < / code > ( fanout by instance of the job ) , we might want to sum over the rate of all instances , so we get fewer output time series , but still preserve the < code > job < / code > dimension : < / p >
< pre > sum by ( job ) (
rate ( http _requests _total [ 5 m ] )
) < / pre >
< p > If we have two different metrics with the same dimensional labels , we can apply binary operators to them and elements on both sides with the same label set will get matched and propagated to the output . For example , this expression returns the unused memory in MiB for every instance ( on a fictional cluster scheduler exposing these metrics about the instances it runs ) : < / p >
< pre > ( instance _memory _limit _bytes - instance _memory _usage _bytes ) / 1024 / 1024 < / pre >
< p > The same expression , but summed by application , could be written like this : < / p >
< pre > sum by ( app , proc ) (
instance _memory _limit _bytes - instance _memory _usage _bytes
) / 1024 / 1024 < / pre >
< p > If the same fictional cluster scheduler exposed CPU usage metrics like the following for every instance : < / p >
2022-09-27 14:49:45 +08:00
< pre > instance _cpu _time _ns { app = "lion" , proc = "web" , rev = "34d0f99" , env = "prod" , job = "cluster-manager" }
2021-08-02 19:51:53 +08:00
instance _cpu _time _ns { app = "elephant" , proc = "worker" , rev = "34d0f99" , env = "prod" , job = "cluster-manager" }
instance _cpu _time _ns { app = "turtle" , proc = "api" , rev = "4d3a513" , env = "prod" , job = "cluster-manager" }
instance _cpu _time _ns { app = "fox" , proc = "widget" , rev = "4d3a513" , env = "prod" , job = "cluster-manager" }
2022-09-27 11:18:55 +08:00
... < / pre >
< p > ... we could get the top 3 CPU users grouped by application ( < code > app < / code > ) and process type ( < code > proc < / code > ) like this : < / p >
< pre > topk ( 3 , sum by ( app , proc ) ( rate ( instance _cpu _time _ns [ 5 m ] ) ) ) < / pre >
< p > Assuming this metric contains one time series per running instance , you could count the number of running instances per application like this : < / p >
< pre > count by ( app ) ( instance _cpu _time _ns ) < / pre >
< / div >
< / div >
< / div >
2022-10-24 16:11:36 +08:00
< / div >
<!-- 中文 -- >
< div class = "info-room title-heard" v-else >
< div class = "col-md-9 logs-content" >
<!-- promql -- >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header" style = "margin-Top:0px" > PromQL : Prometheus 查询语言 < a class = "header-anchor" href = "https://prometheus.io/docs/prometheus/latest/querying/basics/" rel = "noopener noreferrer" target = "_blank" > < i class = "nz-icon nz-icon-link1" style = "font-size: 16px;" :title = "$t('overall.link')" > < / i > < / a > < / h1 >
2022-10-24 16:11:36 +08:00
< div class = "title-heard__divider" > < / div >
<!-- catalog 目录 -- >
< div class = "catalog" >
< ul class = "catalog-square" >
<!-- Querying prometheus -- >
< li >
< div @click ="jumpClick('#querying-prometheus')" > < span > 查询 Prometheus < / span > < / div >
< ul class = "catalog-disc" >
< li @click ="jumpClick('#querying-prometheus-examples')" > < span > 示例 < / span > < / li >
< li @click ="jumpClick('#expression-language-data-types')" > < span > 表达式语言数据类型 < / span > < / li >
< li >
< div @click ="jumpClick('#literals')" > < span > 字面量 < / span > < / div >
< ul >
< li @click ="jumpClick('#string-literals')" > < span > 字符串字面量 < / span > < / li >
< li @click ="jumpClick('#float-literals')" > < span > 浮点字面量 < / span > < / li >
< / ul >
< / li >
< li >
< div @click ="jumpClick('#time-series-selectors')" > < span > 时间序列选择器 < / span > < / div >
< ul >
< li @click ="jumpClick('#instant-vector-selectors')" > < span > 即时向量选择器 < / span > < / li >
< li @click ="jumpClick('#range-vector-selectors')" > < span > 范围向量选择器 < / span > < / li >
< li @click ="jumpClick('#time-durations')" > < span > 时间长度 < / span > < / li >
< li @click ="jumpClick('#offset-modifier')" > < span > offset 修饰符 < / span > < / li >
< li @click ="jumpClick('#time-series-modifier')" > < span > @ 修饰符 < / span > < / li >
< / ul >
< / li >
< li @click ="jumpClick('#querying-prometheus-subquery')" > < span > 子查询 < / span > < / li >
< li @click ="jumpClick('#querying-prometheus-operators')" > < span > 运算符 < / span > < / li >
< li @click ="jumpClick('#querying-prometheus-functions')" > < span > 函数 < / span > < / li >
< li @click ="jumpClick('#querying-prometheus-comments')" > < span > 注释 < / span > < / li >
< li >
< div @click ="jumpClick('#querying-prometheus-gotchas')" > < span > 陷阱 < / span > < / div >
< ul >
< li @click ="jumpClick('#gotchas-staleness')" > < span > 过时 < / span > < / li >
< li @click ="jumpClick('#avoiding-slow-queries-and-overloads')" > < span > 避免缓慢的查询和过载 < / span > < / li >
< / ul >
< / li >
< / ul >
< / li >
<!-- Operators -- >
< li >
< div @click ="jumpClick('#operators')" > < span > 运算符 < / span > < / div >
< ul class = "catalog-disc" >
< li >
< div @click ="jumpClick('#binary-operators')" > < span > 二进制运算符 < / span > < / div >
< ul >
< li @click ="jumpClick('#arithmetic-binary-operators')" > < span > 二进制算术运算符 < / span > < / li >
< li @click ="jumpClick('#trigonometric-binary-operators')" > < span > 三角二进制运算符 < / span > < / li >
< li @click ="jumpClick('#comparison-binary-operators')" > < span > 比较二进制运算符 < / span > < / li >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#Logical-binary-operators')" > < span > 逻辑 / 集合二进制运算符 < / span > < / li >
2022-10-24 16:11:36 +08:00
< / ul >
< / li >
< li >
< div @click ="jumpClick('#vector-matching')" > < span > 向量匹配 < / span > < / div >
< ul >
< li @click ="jumpClick('#vector-matching-keywords')" > < span > 向量匹配关键词 < / span > < / li >
< li @click ="jumpClick('#group-modifiers')" > < span > 分组修饰符 < / span > < / li >
< li @click ="jumpClick('#one-to-one-vector-matches')" > < span > 一对一向量匹配 < / span > < / li >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#many-to-one')" > < span > 多对一 / 一对多向量匹配 < / span > < / li >
2022-10-24 16:11:36 +08:00
< / ul >
< / li >
< li @click ="jumpClick('#aggregation-operators')" > < span > 聚合运算符 < / span > < / li >
< li @click ="jumpClick('#binary-operator-precedence')" > < span > 二进制运算符优先级 < / span > < / li >
< / ul >
< / li >
<!-- Functions -- >
< li >
< div @click ="jumpClick('#functions')" > < span > 函数 < / span > < / div >
< ul class = "catalog-disc" >
< li @click ="jumpClick('#functions-abs')" > < span > abs ( ) < / span > < / li >
< li @click ="jumpClick('#functions-absent')" > < span > absent ( ) < / span > < / li >
< li @click ="jumpClick('#functions-absent_over_time')" > < span > absent _over _time ( ) < / span > < / li >
< li @click ="jumpClick('#functions-ceil')" > < span > ceil ( ) < / span > < / li >
< li @click ="jumpClick('#functions-changes')" > < span > changes ( ) < / span > < / li >
< li @click ="jumpClick('#functions-clamp')" > < span > clamp ( ) < / span > < / li >
< li @click ="jumpClick('#functions-clamp_max')" > < span > clamp _max ( ) < / span > < / li >
< li @click ="jumpClick('#functions-clamp_min')" > < span > clamp _min ( ) < / span > < / li >
< li @click ="jumpClick('#functions-day_of_month')" > < span > day _of _month ( ) < / span > < / li >
< li @click ="jumpClick('#functions-day_of_week')" > < span > day _of _week ( ) < / span > < / li >
< li @click ="jumpClick('#functions-day_of_year')" > < span > day _of _year ( ) < / span > < / li >
< li @click ="jumpClick('#functions-days_in_month')" > < span > days _in _month ( ) < / span > < / li >
< li @click ="jumpClick('#functions-delta')" > < span > delta ( ) < / span > < / li >
< li @click ="jumpClick('#functions-deriv')" > < span > deriv ( ) < / span > < / li >
< li @click ="jumpClick('#functions-exp')" > < span > exp ( ) < / span > < / li >
< li @click ="jumpClick('#functions-floor')" > < span > floor ( ) < / span > < / li >
< li @click ="jumpClick('#functions-histogram_quantile')" > < span > histogram _quantile ( ) < / span > < / li >
< li @click ="jumpClick('#functions-holt_winters')" > < span > holt _winters ( ) < / span > < / li >
< li @click ="jumpClick('#functions-hour')" > < span > hour ( ) < / span > < / li >
< li @click ="jumpClick('#functions-idelta')" > < span > idelta ( ) < / span > < / li >
< li @click ="jumpClick('#functions-increase')" > < span > increase ( ) < / span > < / li >
< li @click ="jumpClick('#functions-irate')" > < span > irate ( ) < / span > < / li >
< li @click ="jumpClick('#functions-label_join')" > < span > label _join ( ) < / span > < / li >
< li @click ="jumpClick('#functions-label_replace')" > < span > label _replace ( ) < / span > < / li >
< li @click ="jumpClick('#functions-ln')" > < span > ln ( ) < / span > < / li >
< li @click ="jumpClick('#functions-log2')" > < span > log2 ( ) < / span > < / li >
< li @click ="jumpClick('#functions-log10')" > < span > log10 ( ) < / span > < / li >
< li @click ="jumpClick('#functions-minute')" > < span > minute ( ) < / span > < / li >
< li @click ="jumpClick('#functions-month')" > < span > month ( ) < / span > < / li >
< li @click ="jumpClick('#functions-predict_linear')" > < span > predict _linear ( ) < / span > < / li >
< li @click ="jumpClick('#functions-rate')" > < span > rate ( ) < / span > < / li >
< li @click ="jumpClick('#functions-resets')" > < span > resets ( ) < / span > < / li >
< li @click ="jumpClick('#functions-round')" > < span > round ( ) < / span > < / li >
< li @click ="jumpClick('#functions-scalar')" > < span > scalar ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sgn')" > < span > sgn ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sort')" > < span > sort ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sort_desc')" > < span > sort _desc ( ) < / span > < / li >
< li @click ="jumpClick('#functions-sqrt')" > < span > sqrt ( ) < / span > < / li >
< li @click ="jumpClick('#functions-time')" > < span > time ( ) < / span > < / li >
< li @click ="jumpClick('#functions-timestamp')" > < span > timestamp ( ) < / span > < / li >
< li @click ="jumpClick('#functions-vector')" > < span > vector ( ) < / span > < / li >
< li @click ="jumpClick('#functions-year')" > < span > year ( ) < / span > < / li >
< li @click ="jumpClick('#functions-aggregation')" > < span > & lt ; aggregation & gt ; _over _time ( ) < / span > < / li >
< li @click ="jumpClick('#functions-trigonometric')" > < span > 三角函数 < / span > < / li >
< / ul >
< / li >
<!-- QUERY EXAMPLES -- >
< li >
< div @click ="jumpClick('#query-examples')" > < span > 查询示例 < / span > < / div >
< ul class = "catalog-disc" >
< li @click ="jumpClick('#simple-time-series-selection')" > < span > 简单的时间序列选择 < / span > < / li >
< li @click ="jumpClick('#query-examples-subquery')" > < span > Subquery 子查询 < / span > < / li >
< li @click ="jumpClick('#using-functions')" > < span > 使用函数 、 运算符等 < / span > < / li >
< / ul >
< / li >
< / ul >
< / div >
<!-- QUERYING PROMETHEUS -- >
<!-- start -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-one" id = "querying-prometheus" > 查询 Prometheus < / h1 >
< p > Prometheus 提供一种名为 PromQL （ Prometheus Query Language ） 的函数式查询语言 ， 允许用户实时选择和聚合时间序列数据 。 表达式的结果可以显示为图形 ， 也可以作为表格数据在 Prometheus 表达式浏览器中查看 ， 或通过 HTTP API 由外部系统使用 。 < / p >
< / div >
<!-- Examples -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-examples" > 示例 < / h1 >
2022-10-25 14:47:47 +08:00
< p > 本文件可作为参考 。 首先了解一些 < b style = "color: #3C92F1" @click ="jumpClick('#query-examples')" class = "log-link" > 示例 < / b > 会对学习有帮助 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
<!-- Expression language data types -- >
2022-10-25 14:47:47 +08:00
< div >
2022-10-24 16:11:36 +08:00
< h1 class = "page-header-two" id = "expression-language-data-types" > 表达式语言数据类型 < / h1 >
< div class = "introduce-view__content-label" >
< p > 在 Prometheus 的表达式语言中 ， 表达式或子表达式可以分为以下四种类型 ： < / p >
< ul >
< li > < b > 即时向量 ： < / b > 一组时间序列 ， 包含每个时间序列的单个样本 ， 所有样本的时间戳相同 < / li >
< li > < b > 范围向量 ： < / b > 一组时间序列 ， 包含每个时间序列在一段时间内的一系列数据点 < / li >
< li > < b > 标量 ： < / b > 简单的数字浮点值 < / li >
< li > < b > 字符串 ： < / b > 简单的字符串值 ； 当前未使用 < / li >
< / ul >
< p > 根据使用情况 （ 例如绘制或显示表达式输出结果时 ) ， 这些类型中只有一部分可以作为用户指定表达式的结果 。 例如 ， 返回即时向量的表达式是唯一可以直接绘图的类型 。 < / p >
< / div >
< / div >
<!-- Literals -- >
< h1 class = "page-header-two" id = "literals" > 字面量 < / h1 >
< div class = "introduce-view__content" >
< h2 id = "string-literals" > 字符串字面量 < / h2 >
< div class = "introduce-view__content-label" >
< p > 字符串可以在单引号 、 双引号或反引号中指定为字面量 。 < / p >
< p > PromQL 遵循与 Go 相同的 转义规则 。 在单引号或双引号中 ， 转义序列以反斜杠开头 ， 其后可以是 < code > a < / code > , < code > b < / code > , < code > f < / code > , < code > n < / code > , < code > r < / code > , < code > t < / code > , < code > v < / code > 或 < code > \ < / code > 。 可以使用八进制 ( < code > \ nnn < / code > ) 十六进制 ( < code > \ xnn < / code > , < code > \ unnnn < / code > 和 < code > \ Unnnnnnnn < / code > ) 来提供特定字符 。 < / p >
< p > 反引号内不处理任何转义 。 与 Go 不同 ， Prometheus 不丢弃反斜杠内的换行符 。 < / p >
< p > 示例 : < / p >
< pre > "this is a string"
'these are unescaped: \n \\ \t'
` these are not unescaped: \ n ' " \ t ` < / pre >
< / div >
< / div >
<!-- Float literals -- >
< div class = "introduce-view__content" >
< h2 id = "float-literals" > 浮点字面量 < / h2 >
< div class = "introduce-view__content-label" >
< p > 标量浮点值可以按以下格式写成整数字面量或浮点数 （ 空白的目的是提供更好的可读性 ） ： < / p >
< pre > [ - + ] ? (
[ 0 - 9 ] * \ . ? [ 0 - 9 ] + ( [ eE ] [ - + ] ? [ 0 - 9 ] + ) ?
| 0 [ xX ] [ 0 - 9 a - fA - F ] +
| [ nN ] [ aA ] [ nN ]
| [ iI ] [ nN ] [ fF ]
) < / pre >
< p > 示例 : < / p >
< pre > 23
- 2.43
3.4e-9
0x8f
- Inf
NaN < / pre >
< / div >
< / div >
<!-- Time series Selectors -- >
< h1 class = "page-header-two" id = "time-series-selectors" > 时间序列选择器 < / h1 >
< div class = "introduce-view__content" >
< h2 id = "instant-vector-selectors" > 即时向量选择器 < / h2 >
< div class = "introduce-view__content-label" >
< div >
< p > 即时向量选择器允许选择一组时间序列和在每个给定时间戳 （ 即时 ） 的单个样本值 ： 在最简单的形式中 ， 只需指定一个度量名称 。 这将产生一个即时向量 ， 其中包含具有该度量名称的所有时间序列的元素 。 < / p >
< p > 此示例选择具有 < code > http _requests _total < / code > 度量名称的所有时间序列 ： < / p >
< pre > http _requests _total < / pre >
< p > 通过在大括号 ( < code > { } < / code > ) 中附加一个逗号分隔的标签匹配器列表 ， 可以进一步过滤这些时间序列 。 < / p >
< p > 此示例仅选择度量名称为 < code > http _requests _total < / code > ， 且 < code > job < / code > 标签设置为 < code > prometheus < / code > 、 < code > group < / code > 标签设置为 < code > canary < / code > 的时间序列 ： < / p >
< pre > http _requests _total { job = "prometheus" , group = "canary" } < / pre >
< p > 也能负匹配标签值 ， 或者根据正则表达式匹配标签值 。 有以下标签匹配运算符 ： < / p >
< ul >
< li > < code > = < / code > : 选择与提供的字符串完全相同的标签 。 < / li >
< li > < code > != < / code > : 选择与提供的字符串不相同的标签 。 < / li >
< li > < code > = ~ < / code > : 选择与提供的字符串正则表达式匹配的标签 。 < / li >
< li > < code > ! ~ < / code > : 选择与提供的字符串正则表达式不匹配的标签 。 < / li >
< / ul >
< p > 正则表达式匹配是完全锚定的 。 < code > env = ~ "foo" < / code > 匹配被视为 < code > env = ~ "^foo$" < / code > 。 < / p >
< p > 本示例将为 < code > staging < / code > 、 < code > testing < / code > and < code > development < / code > 环境和除 < code > GET < / code > 之外的 HTTP 方法选择所有 < code > http _requests _total < / code > 的时间序列 。 < / p >
< pre > http _requests _total { environment = ~ "staging|testing|development" , method != "GET" } < / pre >
< / div >
< p > 匹配空标签值的标签匹配器还能选择没有特定标签集的所有时间序列 。 同一个标签名称可以有多个匹配器 。 < / p >
< p > 向量选择器必须指定一个名称或至少一个与空字符串不匹配的标签匹配器 。 下面的表达式是非法的 ： < / p >
< pre > { job = ~ ".*" } # Bad ! < / pre >
< p > 相反 ， 下面这些表达式则是有效的 ， 因为它们有与空标签值不匹配的选择器 。 < / p >
< pre > { job = ~ ".+" } # Good !
{ job = ~ ".*" , method = "get" } # Good ! < / pre >
< p > 标签匹配器也可以通过与内部 < code > _ _name _ _ < / code > 标签进行匹配而应用于指标名称 。 例如 ， 表达式 < code > http _requests _total < / code > 等效于 < code > { _ _name _ _ = "http_requests_total" } < / code > 。 除 < code > = < / code > ( < code > != < / code > , < code > = ~ < / code > , < code > ! ~ < / code > ) 以外的匹配器也可以使用 。 以下表达式选择名称以 < code > job : < / code > 开头的所有度量 ： < / p >
< pre > { _ _name _ _ = ~ "job:.*" } < / pre >
< p > 度量名称不能为 < code > bool < / code > 、 < code > on < / code > 、 < code > ignoring < / code > 、 < code > group _left < / code > 、 < code > group _right < / code > 等关键字 ， 下面的表达式是非法的 ： < / p >
< pre > on { } # Bad ! < / pre >
< p > 使用 < code > _ _name _ _ < / code > 标签可以规避这一限制 ： < / p >
< pre > { _ _name _ _ = "on" } # Good ! < / pre >
< p > Prometheus 中的所有正则表达式都使用 RE2 语法 。 < / p >
< / div >
< / div >
<!-- Range Vector Selectors -- >
< div class = "introduce-view__content" >
< h2 id = "range-vector-selectors" > 范围向量选择器 < / h2 >
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 范围向量字面量的使用与即时向量字面量类似 ， 只是前者从当前的即时选择一个范围的样本 。 从语法上来说 ， 在向量选择器的末尾 ， 方括号 ( < code > [ ] < / code > ) 中会附加一个 < b style = "color: #3C92F1" @click ="jumpClick('#time-durations')" class = "log-link" > 时间长度 < / b > ， 以指定为每个结果范围向量元素获取过去多久的时间值 。 < / p >
2022-10-24 16:11:36 +08:00
< p > 在以下示例中 ， 我们选择在过去5分钟内为度量名称为 < code > http _requests _total < / code > 、 < code > job < / code > 标签为 < code > prometheus < / code > 的时间序列记录的所有值 ： < / p >
< pre > http _requests _total { job = "prometheus" } [ 5 m ] < / pre >
< / div >
< / div >
<!-- Time Durations -- >
< div class = "introduce-view__content" >
< h2 id = "time-durations" > 时间长度 < / h2 >
< div class = "introduce-view__content-label" >
< p > 时间长度指定为一个数字 ， 其后单位如下 ： < / p >
< ul >
< li > < code > ms < / code > - 毫秒 < / li >
< li > < code > s < / code > - 秒 < / li >
< li > < code > m < / code > - 分钟 < / li >
< li > < code > h < / code > - 小时 < / li >
< li > < code > d < / code > - 天 - 假设一天恒定为24小时 < / li >
< li > < code > w < / code > - 周 - 假设一周恒定为7天 < / li >
< li > < code > y < / code > - 年 - 假设一年恒定为365天 < / li >
< / ul >
2022-10-25 14:47:47 +08:00
< p > 时间长度可以连接组合 ， 单位必须从大到小排序 ， 给定的单位在一个时间长度里只能出现一次 。 < / p >
2022-10-24 16:11:36 +08:00
< p > 以下是一些有效的时间长度 ： < / p >
< pre > 5 h
1 h30m
5 m
10 s < / pre >
< / div >
< / div >
<!-- Offset modifier -- >
< div class = "introduce-view__content" >
< h2 id = "offset-modifier" > offset 修饰符 < / h2 >
< div class = "introduce-view__content-label" >
< p > < code > offset < / code > （ 偏移 ） 修饰符可以改变查询中各个即时向量和范围向量的时间偏移 。 < / p >
< p > 例如 ， 以下表达式返回相对于当前查询评估时间的过去5分钟内 < code > http _requests _total < / code > 的值 ： < / p >
< pre > http _requests _total offset 5 m < / pre >
< p > 注意 < code > offset < / code > 修饰符需要紧跟选择器 ， 以下表达式是正确的 ： < / p >
< pre > sum ( http _requests _total { method = "GET" } offset 5 m ) // GOOD.</pre>
< p > 而以下表达式则是的 < i > 错误 < / i > ： < / p >
< pre > sum ( http _requests _total { method = "GET" } ) offset 5 m // INVALID.</pre>
< p > 范围向量也是一样 。 以下表达式返回一周前 < code > http _requests _total < / code > 的5分钟速率 ： < / p >
< pre > rate ( http _requests _total [ 5 m ] offset 1 w ) < / pre >
< p > 为了与时间上的时间前移进行比较 ， 可以指定负偏移 ： < / p >
< pre > rate ( http _requests _total [ 5 m ] offset - 1 w ) < / pre >
< p > 注意 ： 该表达式允许查询超过评估时间的数据 。 < / p >
< / div >
< / div >
<!-- @ modifier -- >
< div class = "introduce-view__content" >
< h2 id = "time-series-modifier" > @ 修饰符 < / h2 >
< div class = "introduce-view__content-label" >
< p > < code > @ < / code > 修饰符允许改变查询中各个即时和范围向量的评估时间 。 提供给 < code > @ < / code > 修饰符的时间是一个 unix 时间戳 ， 用浮点字面量描述 。 < / p >
< p > 例如 ， 以下表达式返回 < code > http _requests _total < / code > 在 < code > 2021 - 01 - 04 T07 : 40 : 00 + 00 : 00 < / code > 的值 ： < / p >
< pre > http _requests _total @ 1609746000 < / pre >
< p > 注意 < code > @ < / code > 修饰符需要紧跟选择器 ， 以下表达式是正确的 ： < / p >
< pre > sum ( http _requests _total { method = "GET" } @ 1609746000 ) // GOOD.</pre>
< p > 以下表达式则是 < i > 错误 < / i > 的 ： < / p >
< pre > sum ( http _requests _total { method = "GET" } ) @ 1609746000 // INVALID.</pre>
< p > 范围向量也是一样 。 以下的表达式返回 < code > http _requests _total < / code > 在 < code > 2021 - 01 - 04 T07 : 40 : 00 + 00 : 00 < / code > 的五分钟速率 ： < / p >
< pre > rate ( http _requests _total [ 5 m ] @ 1609746000 ) < / pre >
< p > < code > @ < / code > 修饰符支持上述浮点字面量在 < code > int64 < / code > 范围内的所有表示 。 它还可以与 < code > offset < / code > 修饰符一起使用 ， 一起使用时 ， 不论先写哪个修饰符 ， 将应用相对于 < code > @ < / code > 修饰符时间的偏移 。 以下两个查询将产生相同的结果 。 < / p >
< pre > # offset after @
http _requests _total @ 1609746000 offset 5 m
# offset before @
http _requests _total offset 5 m @ 1609746000 < / pre >
< p > 此外 ， < code > start ( ) < / code > 和 < code > end ( ) < / code > 也可以作为特殊值用作 < code > @ < / code > 修饰符的值 。 < / p >
< p > 对于范围查询 ， 它们分别解析到范围查询的开始时间和结束时间 ， 并在所有步骤中保持不变 。 < / p >
< p > 对于即时查询 ， < code > start ( ) < / code > 和 < code > end ( ) < / code > 都解析到评估时间 。 < / p >
< pre > http _requests _total @ start ( )
rate ( http _requests _total [ 5 m ] @ end ( ) ) < / pre >
< p > 请注意 ， < code > @ < / code > 修饰符允许查询超过评估时间的数据 。 < / p >
< / div >
< / div >
<!-- Subquery -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-subquery" > 子查询 < / h1 >
< div class = "introduce-view__content-label" >
< p > 子查询允许您针对给定的范围和分辨率运行即时查询 。 子查询的结果是一个范围向量 。 < / p >
< p > 语法 ： < code > & lt ; instant _query & gt ; '[' & lt ; range & gt ; ':' [ & lt ; resolution & gt ; ] ']' [ @ & lt ; float _literal & gt ; ] [ offset & lt ; duration & gt ; ] < / code > < / p >
< ul >
< li > < code > & lt ; resolution & gt ; < / code > 为选填 。 默认为全局评估时间间隔 。 < / li >
< / ul >
< / div >
< / div >
<!-- Operators -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-operators" > 运算符 < / h1 >
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > Prometheus 支持许多二进制和聚合运算符 ， 这些运算符在 < b style = "color: #3C92F1" @click ="jumpClick('#operators')" class = "log-link" > 表达式语言运算符 < / b > 页面中有详细描述 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
< / div >
<!-- Functions -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-functions" > 函数 < / h1 >
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > Prometheus 支持一些对数据进行运算的函数 ， 这些函数在 < b style = "color: #3C92F1" @click ="jumpClick('#functions')" class = "log-link" > 表达式语言函数 < / b > 页面有详细描述 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
< / div >
<!-- Comments -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "querying-prometheus-comments" > 注释 < / h1 >
< div class = "introduce-view__content-label" >
< p > PromQL 支持以 < code > # < / code > 开头的行注释 。 示例 ： < / p >
< pre > # This is a comment < / pre >
< / div >
< / div >
<!-- Gotchas -- >
< h1 class = "page-header-two" id = "querying-prometheus-gotchas" > 陷阱 < / h1 >
< div class = "introduce-view__content" >
< h2 id = "gotchas-staleness" > 过时 < / h2 >
< div class = "introduce-view__content-label" >
< p > 当查询运行时 ， 独立于当前实际时间序列数据来选择采样数据的时间戳 。 这主要是为了支持聚合 ( < code > sum < / code > , < code > avg < / code > , 等 ) ， 其中多个聚合的时间序列在时间上不完全一致 。 由于其独立性 ， Prometheus 需要在这些时间戳上为每个相关的时间序列赋值 ， 这一赋值是通过简单地获取该时间戳之前的最新样本来实现的 。 < / p >
< p > 如果目标抓取或规则评估不再返回先前存在的时间序列的样本 ， 则该时间序列会被标记为过时 。 如果一个目标被删除 ， 其先前返回的时间序列将很快被标记为过时 。 < / p >
< p > 如果在某个时间序列被标记为过时后 ， 在采样时间戳处对查询进行评估 ， 则不会为该时间序列返回任何值 。 如果该时间序列随后摄入了新样本 ， 会正常返回值 。 < / p >
< p > 如果在采样时间戳之前5分钟 （ 默认 ） 没有找到样本 ， 则不会为该时间点的时间序列返回任何值 。 这意味着当时间序列的最新收集样本超过5分钟或被标记为过时时 ， 时间序列就会从图表中 “ 消失 ” 。 < / p >
< p > 在抓取中包含时间戳的时间序列不会被标记为过时 ， 而将只应用5分钟阈值 。 < / p >
< / div >
< / div >
<!-- Avoiding slow queries and overloads -- >
< div class = "introduce-view__content" >
< h2 id = "avoiding-slow-queries-and-overloads" > 避免缓慢的查询和过载 < / h2 >
< div class = "introduce-view__content-label" >
< p > 如果一个查询需要对大量数据进行操作 ， 那么绘图可能会超时或者导致服务器或浏览器过载 。 因此 ， 当对未知数据构建查询时 ， 应总是在 Prometheus 表达式浏览器的表格视图中开始构建查询 ， 直到结果集是合理的 （ 最多几百个 ， 而不是几千个时间序列 ） 。 在充分过滤或聚合数据后 ， 才能切换到图表模式 。 如果表达式仍然需要很长时间来绘制 ， 则通过记录规则预先记录 。 < / p >
< p > 这对 Prometheus 的查询语言尤其重要 ， 在 Prometheus 的查询语言中 ， 像 < code > api _http _requests _total < / code > 这样简单的度量名称选择器可以扩展成数千个带有不同标签的时间序列 。 还要注意 ， 即使只输出了少量的时间序列 ， 聚合多个时间序列的表达式也会在服务器上产生负载 ； 就像在关系数据库中 ， 即使输出值只是一个数字 ， 对一列中的所有值求和也会很慢 。 < / p >
< / div >
< / div >
<!-- OPERATORS -- >
< h1 class = "page-header-one" id = "operators" > 运算符 < / h1 >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "binary-operators" > 二进制运算符 < / h1 >
2022-10-25 14:47:47 +08:00
< p > Prometheus 的查询语言支持基本的逻辑和算术运算符 。 对于两个即时向量之间的运算 ， 可以修改 < b style = "color: #3C92F1" @click ="jumpClick('#vector-matching')" class = "log-link" > 匹配行为 < / b > 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
<!-- Arithmetic binary operators -- >
< div class = "introduce-view__content" >
< h2 id = "arithmetic-binary-operators" > 二进制算术运算符 < / h2 >
< div class = "introduce-view__content-label" >
< p > Prometheus 中有以下二进制算术运算符 ： < / p >
< ul >
< li > < code > + < / code > ( 加法 ) < / li >
< li > < code > - < / code > ( 减法 ) < / li >
< li > < code > * < / code > ( 乘法 ) < / li >
< li > < code > / < / code > ( 除法 ) < / li >
< li > < code > % < / code > ( 取模 ) < / li >
< li > < code > ^ < / code > ( 幂 ) < / li >
< / ul >
2022-10-25 14:47:47 +08:00
< p > 二进制算术运算符支持标量 / 标量 、 向量 / 标量 、 以及向量 / 向量之间的运算 。 < / p >
< p > < b > 标量 / 标量 < / b > , 行为是显而易见的 ： 它们评估另一个标量 ， 该标量是运算符应用于两个标量操作数的结果 。 < / p >
< p > < b > 即时向量 / 标量 < / b > , 将运算符应用于向量中每个数据样本的值 。 例如 ， 如果时间序列即时向量乘以2 ， 则结果是另一个将原始向量的每个样本值乘以2的向量 。 度量名称被删除 。 < / p >
< p > < b > 即时向量 / 即时向量 < / b > , 二进制算术运算符应用于左侧向量中的每个条目及其右侧向量中的匹配元素 。 结果将传播到结果向量中 ， 分组标签成为输出标签集 。 度量名称被删除 。 结果不包含在右侧向量中找不到匹配条目的条目 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
< / div >
<!-- Trigonometric binary operators -- >
< div class = "introduce-view__content" >
< h2 id = "trigonometric-binary-operators" > 三角二进制运算符 < / h2 >
< div class = "introduce-view__content-label" >
< p > Prometheus 中有以下采用弧度制的三角二进制运算符 ： < / p >
< ul >
< li > < code > atan2 < / code > ( 基于 https : //pkg.go.dev/math#Atan2)</li>
< / ul >
< p > 三角运算符允许使用向量匹配对两个向量运行三角函数 ， 普通函数则不允许 。 三角运算符的运算方式与算术运算符相同 。 < / p >
< / div >
< / div >
<!-- Comparison binary operators -- >
< div class = "introduce-view__content" >
< h2 id = "comparison-binary-operators" > 比较二进制运算符 < / h2 >
< div class = "introduce-view__content-label" >
< p > Prometheus 中有以下比较二进制运算符有 ： < / p >
< ul >
< li > < code > == < / code > ( 等于 ) < / li >
< li > < code > != < / code > ( 不等于 ) < / li >
< li > < code > & gt ; < / code > ( 大于 ) < / li >
< li > < code > & lt ; < / code > ( 小于 ) < / li >
< li > < code > & gt ; = < / code > ( 大于等于 ) < / li >
< li > < code > & lt ; = < / code > ( 小于等于 ) < / li >
< / ul >
2022-10-25 14:47:47 +08:00
< p > 比较二进制运算符支持标量 / 标量 、 向量 / 标量 、 以及向量 / 向量之间的运算 。 默认情况下过滤 。 可以通过在运算符之后提供 < code > bool < / code > 来修改其行为 ， 从而为值返回 < code > 0 < / code > 或 < code > 1 < / code > 而不是过滤 。 < / p >
< p > < b > 标量 / 标量 < / b > , 必须提供 < code > bool < / code > 修饰符 ， 这些运算符会产生另一个 < code > 0 < / code > ( < code > 假 < / code > ) 或 < code > 1 < / code > ( < code > 真 < / code > ) 的标量 ， 具体取决于比较结果 。 < / p >
< p > < b > 即时向量 / 标量 < / b > , 将这些运算符应用于向量中的每个数据样本的值 ， 并且从结果向量中删除比较结果为 < code > false < / code > 的向量元素 。 如果提供了 < code > bool < / code > 修饰符 ， 则将被删除的向量元素的值为 < code > 0 < / code > ， 将保留的向量元素的值为 < code > 1 < / code > 。 如果提供了 < code > bool < / code > 修饰符 ， 度量名称将被删除 。 < / p >
< p > < b > 即时向量 / 即时向量 < / b > , 这些运算符默认表现为过滤器 ， 应用于匹配条目 。 表达式不正确或在表达式的另一侧找不到匹配项的向量元素会被从结果中删除 ， 其他元素则传播到结果向量中 ， 分组标签成为输出标签集 。 如果提供了 < code > bool < / code > 修饰符 ， 则将被删除的向量元素的值为 < code > 0 < / code > ， 将保留的向量元素的值为 < code > 1 < / code > , 分组标签再次成为输出标签集 。 如果提供了 < code > bool < / code > 修饰符 ， 度量名称将被删除 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
< / div >
<!-- Logical / set binary operators -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "Logical-binary-operators" > 逻辑 / 集合二进制运算符 < / h2 >
2022-10-24 16:11:36 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 逻辑 / 集合二进制运算符只支持即时向量之间的操作 ： < / p >
2022-10-24 16:11:36 +08:00
< ul >
< li > < code > and < / code > ( 交集 ) < / li >
< li > < code > or < / code > ( 并集 ) < / li >
< li > < code > unless < / code > ( 补集 ) < / li >
< / ul >
< p > < code > vector1 and vector2 < / code > 得到一个由 < code > vector1 < / code > 元素组成的向量 ， 其中 < code > vector2 < / code > 中的元素具有完全匹配的标签集 。 其他元素被删除 。 度量名称和值从左侧向量转移 。 < / p >
< p > < code > vector1 or vector2 < / code > 得到包含 < code > vector1 < / code > 的所有原始元素 （ 标签集 + 值 ） 的向量 ， 以及在 < code > vector1 < / code > 中没有匹配标签集的 < code > vector2 < / code > 的所有元素 。 < / p >
< p > < code > vector1 unless vector2 < / code > 得到一个由 < code > vector1 < / code > 元素组成的向量 ， < code > vector2 < / code > 中没有元素的标签集与该向量完全匹配 。 两个向量中的所有匹配元素都被删除 。 < / p >
< / div >
< / div >
<!-- Vector matching -- >
< h1 class = "page-header-two" id = "vector-matching" > 向量匹配 < / h1 >
< div class = "introduce-view__content" >
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 向量之间的操作尝试在左侧的每个条目的右侧向量中找到匹配元素 。 有两种基本匹配行为 ： 一对一和多对一 / 一对多 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
< / div >
<!-- Vector matching keywords -- >
< div class = "introduce-view__content" >
< h2 id = "vector-matching-keywords" > 向量匹配关键词 < / h2 >
< div class = "introduce-view__content-label" >
< p > 向量匹配关键词允许具有不同标签集的序列之间的匹配 ， 关键词有 ： < / p >
< ul >
< li > < code > on < / code > < / li >
< li > < code > ignoring < / code > < / li >
< / ul >
2022-10-25 14:47:47 +08:00
< p > 提供给匹配关键词的标签列表将决定向量的组合方式 。 可以在 < b style = "color: #3C92F1" @click ="jumpClick('#one-to-one-vector-matches')" class = "log-link" > 一对一向量匹配 < / b > 和 < b style = "color: #3C92F1" @click ="jumpClick('#many-to-one')" class = "log-link" > 多对一 / 一对多向量匹配 < / b > 中找到示例 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
< / div >
<!-- Group modifiers -- >
< div class = "introduce-view__content" >
< h2 id = "group-modifiers" > 分组修饰符 < / h2 >
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 这些分组修饰符支持多对一 / 一对多向量匹配 ： < / p >
2022-10-24 16:11:36 +08:00
< ul >
< li > < code > group _left < / code > < / li >
< li > < code > group _right < / code > < / li >
< / ul >
< p > 可以提供标签列表给分组修饰符 ， 分组修饰符包含来自 “ 一 ” 方的标签 ， 以将其纳入结果度量中 。 < / p >
2022-10-25 14:47:47 +08:00
< p style = "font-style:italic;" > 多对一 / 一对多匹配是应该仔细考虑的高级用例 。 通常 ， 正确使用 < code > ignoring ( & lt ; labels & gt ; ) < / code > 可以令您得到想要的结果 。 < / p >
< p style = "font-style:italic;" > 分组修饰符只能用于 < b style = "color: #3C92F1" @click ="jumpClick('#comparison-binary-operators')" class = "log-link" > 比较 < / b > 和 < b style = "color: #3C92F1" @click ="jumpClick('#arithmetic-binary-operators')" class = "log-link" > 算术 < / b > 。 像 < code > and < / code > 、 < code > unless < / code > 和 < code > or < / code > 这样的运算默认情况下与右向量中所有可能的条目匹配 。 < / p >
2022-10-24 16:11:36 +08:00
< / div >
< / div >
<!-- One - to - one vector matches -- >
< div class = "introduce-view__content" >
< h2 id = "one-to-one-vector-matches" > 一对一向量匹配 < / h2 >
< div class = "introduce-view__content-label" >
< p > < b > 一对一 < / b > 从操作的每一侧找到一对唯一条目 。 在默认情况下是格式 < code > vector1 & lt ; operator & gt ; vector2 < / code > 之后的运算 。 如果两个条目具有完全相同的标签集和相应的值 ， 则这两个条目匹配 。 < code > ignoring < / code > 关键词允许在匹配时忽略某些标签 ， 而 < code > on < / code > 关键词允许将所考虑的标签集减少为提供的列表 ： < / p >
< pre > & lt ; vector expr & gt ; & lt ; bin - op & gt ; ignoring ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
& lt ; vector expr & gt ; & lt ; bin - op & gt ; on ( & lt ; label list & gt ; ) & lt ; vector expr & gt ; < / pre >
< p > 输入示例 ： < / p >
< pre > method _code : http _errors : rate5m { method = "get" , code = "500" } 24
method _code : http _errors : rate5m { method = "get" , code = "404" } 30
method _code : http _errors : rate5m { method = "put" , code = "501" } 3
method _code : http _errors : rate5m { method = "post" , code = "500" } 6
method _code : http _errors : rate5m { method = "post" , code = "404" } 21
method : http _requests : rate5m { method = "get" } 600
method : http _requests : rate5m { method = "del" } 34
method : http _requests : rate5m { method = "post" } 120 < / pre >
< p > 查询示例 ： < / p >
< pre > method _code : http _errors : rate5m { code = "500" } / ignoring ( code ) method : http _requests : rate5m < / pre >
< p > 这将为每个方法返回一个结果向量 ， 包含在过去的5分钟内状态代码为500的 HTTP 请求部分 。 没有 < code > ignoring ( code ) < / code > 就没有匹配 ， 因为度量不共享同一组标签 。 方法 < code > put < / code > 和 < code > del < / code > 的条目没有匹配 ， 不会在结果中显示 ： < / p >
< pre > { method = "get" } 0.04 // 24 / 600
{ method = "post" } 0.05 // 6 / 120</pre>
< / div >
< / div >
<!-- Many - to - one and one - to - many vector matches -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "many-to-one" > 多对一 / 一对多向量匹配 < / h2 >
2022-10-24 16:11:36 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > < b > 多对一 < / b > / < b > 一对多 < / b > 匹配指 “ 一 ” 侧的每个向量元素都可以与 “ 多 ” 侧的多个元素匹配 。 必须使用 < code > group _left < / code > 或 < code > group _right < / code > 修饰符明确请求 ， 其中 left / right 确定有更高基数的向量 。 < / p >
2022-10-24 16:11:36 +08:00
< pre > & lt ; vector expr > & lt ; bin - op & gt ; ignoring ( & lt ; label list & gt ; ) group _left ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
& lt ; vector expr & gt ; & lt ; bin - op & gt ; ignoring ( & lt ; label list & gt ; ) group _right ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
& lt ; vector expr & gt ; & lt ; bin - op & gt ; on ( & lt ; label list & gt ; ) group _left ( & lt ; label list & gt ; ) & lt ; vector expr & gt ;
& lt ; vector expr & gt ; & lt ; bin - op & gt ; on ( & lt ; label list & gt ; ) group _right ( & lt ; label list & gt ; ) & lt ; vector expr & gt ; < / pre >
< p > 随分组修饰符提供的标签列表包含来自 “ 一 ” 侧的其他标签 ， 以将其纳入结果度量中 。 对于 < code > on < / code > ， 一个标签只能出现在其中一个列表中 。 每次结果向量的序列都必须是唯一可识别的 。 < / p >
< p > 查询示例 ： < / p >
< pre > method _code : http _errors : rate5m / ignoring ( code ) group _left method : http _requests : rate5m < / pre >
< p > 在这种情况下 ， 左向量每个 < code > method < / code > 标签值包含多个条目 。 因此 ， 我们使用 < code > group _left < / code > 来表明这一点 。 右侧的元素现在与左侧具有相同的 < code > method < / code > 标签的多个元素匹配 ： < / p >
< pre > { method = "get" , code = "500" } 0.04 // 24 / 600
{ method = "get" , code = "404" } 0.05 // 30 / 600
{ method = "post" , code = "500" } 0.05 // 6 / 120
{ method = "post" , code = "404" } 0.175 // 21 / 120</pre>
< / div >
< / div >
<!-- Aggregation operators -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "aggregation-operators" > 聚合运算符 < / h1 >
< div class = "introduce-view__content-label" >
< p > Prometheus 支持以下内置聚合运算符 ， 这些运算符可用于聚合单个即时向量的元素 ， 生成具有聚合值的更少元素的新向量 ： < / p >
< ul >
< li > < code > sum < / code > ( 在维度上求和 ) < / li >
< li > < code > min < / code > ( 在维度上选择最小值 ) < / li >
< li > < code > max < / code > ( 在维度上选择最大值 ) < / li >
< li > < code > avg < / code > ( 在维度上求平均值 ) < / li >
< li > < code > group < / code > ( 结果向量中的所有值都是1 ) < / li >
< li > < code > stddev < / code > ( 在维度上求总体标准偏差 ) < / li >
< li > < code > stdvar < / code > ( 在维度上求总体标准方差 ) < / li >
< li > < code > count < / code > ( 统计向量元素的数量 ) < / li >
< li > < code > count _values < / code > ( 统计有相同数据值的元素数量 ) < / li >
< li > < code > bottomk < / code > ( 样本值最大的 k 个元素 ) < / li >
< li > < code > topk < / code > ( 样本值最大的 k 个元素 ) < / li >
< li > < code > quantile < / code > ( 在维度上统计 φ 分位数 （ 0 ≤ φ ≤ 1 ） ) < / li >
< / ul >
< p > 这些运算符可以用于聚合 < b > 所有 < / b > 标签维度 ， 也可以通过包含 < code > without < / code > 或 < code > by < / code > 子句来保留不同的维度 。 这些子句可以在表达式之前或之后使用 。 < / p >
< pre > & lt ; aggr - op & gt ; [ without | by ( & lt ; label list & gt ; ) ] ( [ parameter , ] & lt ; vector expression & gt ; ) < / pre >
< p > 或 < / p >
< pre > & lt ; aggr - op & gt ; ( [ parameter , ] & lt ; vector expression & gt ; ) [ without | by ( & lt ; label list & gt ; ) ] < / pre >
< p > < code > label list < / code > 是可以包括尾部逗号的 、 未加引号的标签列表 ， 即 < code > ( label1 , label2 ) < / code > 和 < code > ( label1 , label2 , ) < / code > 都是有效的语法 。 < / p >
< p > < code > without < / code > 从结果向量中删除列出的标签 ， 而其他标签都保留在输出中 。 < code > by < / code > 则相反 ， 它会删除 < code > by < / code > 子句中未列出的标签 ， 即使其标签值在向量的所有元素之间是相同的 。 < / p >
2022-10-25 14:47:47 +08:00
< p > < code > parameter < / code > 仅用于 < code > count _values < / code > 、 < code > quantile < / code > 、 < code > topk < / code > 和 < code > bottomk < / code > 。 < / p >
2022-10-24 16:11:36 +08:00
< p > < code > count _values < / code > 为每个唯一样本值输出一个时间序列 。 每个序列都有一个额外的标签 ， 该标签的名称由聚合参数给出 ， 该标签的值是唯一的样本值 。 每个时间序列的值是样本值出现的次数 。 < / p >
< p > < code > topk < / code > 和 < code > bottomk < / code > 与其他聚合器的不同之处在于它们在结果向量中返回输入样本的子集 （ 包括原始标签 ） 。 < code > by < / code > 和 < code > without < / code > 仅用于存储输入向量 。 < / p >
< p > < code > quantile < / code > 计算 φ 分位数 ， 即在聚合维度的 N 个度量值中排名第 φ * N 的值 。 提供 φ 作为聚合参数 。 例如 ， < code > quantile ( 0.5 , ... ) < / code > 计算中位数 ， < code > quantile ( 0.95 , ... ) < / code > 计算第 95 个百分位数 。 如果 φ = < code > NaN < / code > , 返回 < code > NaN < / code > 如果 φ & lt ; 0 , 返回 - Inf ； 如果 φ > 1 , 返回 < code > + Inf < / code > 。 < / p >
< p > 示例 ： < / p >
< p > 如果度量 < code > http _requests _total < / code > 具有按 < code > application < / code > 、 < code > instance < / code > 以及 < code > group < / code > 扇出的时间序列 ， 我们可以通过以下方式 ， 计算每个应用程序和分组在所有实例上看到的 HTTP 请求总数 ： < / p >
< pre > sum without ( instance ) ( http _requests _total ) < / pre >
< p > 等价于 ： < / p >
< pre > sum by ( application , group ) ( http _requests _total ) < / pre >
< p > 如果我们只想得到在 < b > 所有 < / b > 应用程序中看到的 HTTP 请求总数 ， 我们可以写成 ： < / p >
< pre > sum ( http _requests _total ) < / pre >
< p > 要计算运行每个构建版本的二进制文件的数量 ， 我们可以写成 ： < / p >
< pre > count _values ( "version" , build _version ) < / pre >
< p > 要在所有实例中获取最大的5个 HTTP 请求计数 ， 我们可以写成 ： < / p >
< pre > topk ( 5 , http _requests _total ) < / pre >
< / div >
< / div >
<!-- Binary operator precedence -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "binary-operator-precedence" > 二进制运算符优先级 < / h1 >
< div class = "introduce-view__content-label binary-operator-precedence" >
< p > 以下列表从高到低显示了 Prometheus 中二进制运算符的优先级 ： < / p >
< ul >
< li > < code > ^ < / code > < / li >
< li > < code > * < / code > , < code > / < / code > , < code > % < / code > , < code > atan2 < / code > < / li >
< li > < code > + < / code > , < code > - < / code > < / li >
< li > < code > == < / code > , < code > != < / code > , < code > & lt ; = < / code > , < code > & lt ; < / code > , < code > & gt ; = < / code > , < code > & gt ; < / code > < / li >
< li > < code > and < / code > , < code > unless < / code > < / li >
< li > < code > or < / code > < / li >
< / ul >
< p > 具有相同优先级的运算符为从左到右运算的 。 例如 ， < code > 2 * 3 % 2 < / code > 相当于 < code > ( 2 * 3 ) % 2 < / code > 。 但 < code > ^ < / code > 是从右到左运算的 ， 所以 < code > 2 ^ 3 ^ 2 < / code > 相当于 < code > 2 ^ ( 3 ^ 2 ) < / code > 。 < / p >
< / div >
< / div >
<!-- FUNCTIONS -- >
< h1 class = "page-header-one" id = "functions" > 函数 < / h1 >
< div class = "introduce-view__content" >
< div class = "introduce-view__content-label" >
< p > 有些函数有默认参数 ， 例如 < code > year ( v = vector ( time ( ) ) instant - vector ) < / code > 。 这意味着有一个即时向量 ： 参数 v ， 如果不提供该参数 ， 将默认为 < code > vector ( time ( ) ) < / code > 表达式的值 。 < / p >
< / div >
< / div >
<!-- abs ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-abs" > abs ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > abs ( v instant - vector ) < / code > 返回输入向量的所有样本值都转换为了绝对值 。 < / p >
< / div >
< / div >
<!-- absent ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-absent" > absent ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > absent ( v instant - vector ) < / code > 如果传递给它的向量含有元素 ， 则返回一个空向量 ； 如果传递给它的向量没有元素 ， 则返回一个值为1的单元素向量 。 < / p >
< p > 这有助于在给定的度量名称和标签组合不存在时间序列时发出警报 。 < / p >
< pre > absent ( nonexistent { job = "myjob" } )
# => { job = "myjob" }
absent ( nonexistent { job = "myjob" , instance = ~ ".*" } )
# => { job = "myjob" }
absent ( sum ( nonexistent { job = "myjob" } ) )
# => { } < / pre >
< p > 在前两个例子中 ， < code > absent ( ) < / code > 试图从输入向量中导出单元素输出向量的标签 。 < / p >
< / div >
< / div >
<!-- absent _over _time ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-absent_over_time" > absent _over _time ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > absent _over _time ( v range - vector ) < / code > 如果传递给它的范围向量含有元素 ， 则返回一个空向量 ； 如果传递给它的范围向量没有元素 ， 则返回一个值为1的单元素向量 。 < / p >
< p > 这有助于在给定的度量名称和标签组合不存在时间序列一段时间后发出警报 。 < / p >
< pre > absent _over _time ( nonexistent { job = "myjob" } [ 1 h ] )
# => { job = "myjob" }
absent _over _time ( nonexistent { job = "myjob" , instance = ~ ".*" } [ 1 h ] )
# => { job = "myjob" }
absent _over _time ( sum ( nonexistent { job = "myjob" } ) [ 1 h : ] )
# => { } < / pre >
< p > 在前两个例子中 ， < code > absent _over _time ( ) < / code > 试图从输入向量中导出单元素输出向量的标签 。 < / p >
< / div >
< / div >
<!-- ceil ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-ceil" > ceil ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > ceil ( v instant - vector ) < / code > 将 < code > v < / code > 中所有元素的样本值向上舍入为最接近的整数 。 < / p >
< / div >
< / div >
<!-- changes ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-changes" > changes ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > 对于每个输入时间序列 ， < code > changes ( v range - vector ) < / code > 返回该值在提供的时间范围内作为即时向量改变的次数 。 < / p >
< / div >
< / div >
<!-- clamp ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-clamp" > clamp ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > clamp ( v instant - vector , min scalar , max scalar ) < / code > 将 < code > v < / code > 中所有元素的样本值钳制为下限 < code > min < / code > 和上限 < code > max < / code > 。 < / p >
< p > 特殊情况 ： 如果 < code > min > max < / code > ， 则返回一个空向量 ； 如果 < code > min < / code > 或 < code > max < / code > 是 < code > NaN < / code > ， 返回 < code > NaN < / code > 。 < / p >
< / div >
< / div >
<!-- clamp _max ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-clamp_max" > clamp _max ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > clamp _max ( v instant - vector , max scalar ) < / code > 将 < code > v < / code > 中所有元素的样本值钳制为上限 < code > max < / code > 。 < / p >
< / div >
< / div >
<!-- clamp _min ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-clamp_min" > clamp _min ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > clamp _min ( v instant - vector , min scalar ) < / code > 将 < code > v < / code > 中所有元素的样本值钳制为下限 < code > min < / code > 。 < / p >
< / div >
< / div >
<!-- day _of _month ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-day_of_month" > day _of _month ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > day _of _month ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的月份中的某天 。 返回值的范围为1到31 。 < / p >
< / div >
< / div >
<!-- day _of _week ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-day_of_week" > day _of _week ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > day _of _week ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的星期中的某天 。 返回值的范围为 0 到 6 ， 其中 0 表示星期日 。 < / p >
< / div >
< / div >
<!-- day _of _year ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-day_of_year" > day _of _year ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > day _of _year ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的年中的某天 。 对于平年 ， 返回值的范围为1到365 ， 对于闰年 ， 返回值的范围为1到366 。 < / p >
< / div >
< / div >
<!-- days _in _month ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-days_in_month" > days _in _month ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > days _in _month ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的一个月中的天数 。 返回值的范围为28到31 。 < / p >
< / div >
< / div >
<!-- delta ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-delta" > delta ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > delta ( v range - vector ) < / code > 计算范围向量 < code > v < / code > 中每个时间序列元素的第一个值和最后一个值之间的差 ， 返回具有给定 delta 和等效标签的即时向量 。 Delta 被外推以覆盖范围向量选择器中指定的完整时间范围 ， 因此即使样本值都是整数 ， 也有可能得到非整数结果 。 < / p >
< p > 下面的表达式返回现在和2小时前的 CPU 温度差 ： < / p >
< pre > delta ( cpu _temp _celsius { host = "zeus" } [ 2 h ] ) < / pre >
< p > < code > delta < / code > 应仅用于 gauge 。 < / p >
< / div >
< / div >
<!-- deriv ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-deriv" > deriv ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > deriv ( v range - vector ) < / code > 使用简单线性回归计算范围向量 < code > v < / code > 中时间序列的每秒导数 。 范围向量必须至少有两个样本才能执行计算 。 当在范围向量中找到 < code > + Inf < / code > 或 < code > - Inf < / code > 时 ， 所计算的斜率和偏移值将为 < code > NaN < / code > 。 < / p >
< p > < code > deriv < / code > 应仅用于 gauge 。 < / p >
< / div >
< / div >
<!-- exp ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-exp" > exp ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > exp ( v instant - vector ) < / code > 计算 < code > v < / code > 中所有元素的指数函数 。 特殊情况有 ： < / p >
< ul >
< li > < code > Exp ( + Inf ) = + Inf < / code > < / li >
< li > < code > Exp ( NaN ) = NaN < / code > < / li >
< / ul >
< / div >
< / div >
<!-- floor ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-floor" > floor ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > floor ( v instant - vector ) < / code > 将 < code > v < / code > 中所有元素的样本值向下舍入到最接近的整数 。 < / p >
< / div >
< / div >
<!-- histogram _quantile ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-histogram_quantile" > histogram _quantile ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > histogram _quantile ( φ scalar , b instant - vector ) < / code > 从直方图的 < code > b < / code > 桶计算 φ 分位数 （ 0 ≤ φ ≤ 1 ） 。 （ 有关 φ - 分位数的详细解释和直方图度量类型的一般用法 ， 请参见 直方图和总结 。 ） b 中的样本是每个桶中的观察计数 。 每个样本必须具有标签 < code > le < / code > ， 该标签值表示桶的包含上限 。 （ 没有该标签的样本会被悄然忽略 。 ） 直方图度量类型自动为时间序列提供 < code > _bucket < / code > 后缀和适当的标签 。 < / p >
< p > 使用 < code > rate ( ) < / code > 函数指定分位数计算的时间窗口 。 < / p >
< p > 示例 ： 一个直方图度量的名称为 < code > http _request _duration _seconds < / code > 。 要计算过去10分钟内请求持续时间的第90个百分位数 ， 请使用以下表达式 ： < / p >
< pre > histogram _quantile ( 0.9 , rate ( http _request _duration _seconds _bucket [ 10 m ] ) ) < / pre >
< p > 计算 < code > http _request _duration _seconds < / code > 中每个标签组合的分位数 。 若要聚合 ， 请在 < code > rate ( ) < / code > 函数周围使用 < code > sum ( ) < / code > 聚合器 。 因为 < code > histogram _quantile ( ) < / code > 需要 < code > le < / code > 标签 ， 所以 < code > by < / code > 子句必须包含该标签 。 以下表达式按 < code > job < / code > 聚合第90个百分位数 ： < / p >
< pre > histogram _quantile ( 0.9 , sum by ( job , le ) ( rate ( http _request _duration _seconds _bucket [ 10 m ] ) ) ) < / pre >
< p > 要聚合所有内容 ， 仅指定 < code > le < / code > 标签 ： < / p >
< pre > histogram _quantile ( 0.9 , sum by ( le ) ( rate ( http _request _duration _seconds _bucket [ 10 m ] ) ) ) < / pre >
< p > < code > histogram _quantile ( ) < / code > 函数通过假设桶内的线性分布来内插分位数值 。 最高的存储桶必须有 < code > + Inf < / code > 的上限 （ 没有则返回 < code > NaN < / code > ） 。 如果分位数位于最高的桶中 ， 则返回第二高桶的上限 。 如果最低桶的上限大于0 ， 则该桶的下限被假定为0 。 在这种情况下 ， 通常的线性插值会被应用于该桶 。 否则 ， 为位于最低桶中的分位数返回最低桶的上限 。 < / p >
< p > 如果 < code > b < / code > 有0个观察值 ， 则返回 < code > NaN < / code > 。 如果 < code > b < / code > 包含的桶少于两个 ， 则返回 < code > NaN < / code > 。 如果 φ & lt ; 0 ， 返回 < code > - Inf < / code > 。 如果 φ > 1 ， 返回 < code > + Inf < / code > 如果 φ = < code > NaN < / code > , 返回 < code > NaN < / code > 。 < / p >
< / div >
< / div >
<!-- holt _winters ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-holt_winters" > holt _winters ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > holt _winters ( v range - vector , sf scalar , tf scalar ) < / code > 基于 < code > v < / code > 中的范围为时间序列生成平滑值 。 平滑因子 < code > sf < / code > 越低 ， 旧数据越重要 。 趋势因子 < code > tf < / code > 越高 ， 考虑的数据趋势越多 。 < code > sf < / code > 和 tf 都必须介于0和1之间 。 < / p >
< p > < code > holt _winters < / code > 应仅用于gauge 。 < / p >
< / div >
< / div >
<!-- hour ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-hour" > hour ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > hour ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的一天中的时刻 。 返回值的范围为0到23 。 < / p >
< / div >
< / div >
<!-- idelta ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-idelta" > idelta ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > idelta ( v range - vector ) < / code > 计算范围向量 < code > v < / code > 中最后两个样本之间的差 ， 返回具有给定 delta 和等效标签的即时向量 。 < / p >
< p > < code > idelta < / code > 应仅用于gauge 。 < / p >
< / div >
< / div >
<!-- increase ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-increase" > increase ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > increase ( v range - vector ) < / code > 计算范围向量中时间序列的 increase 。 会对单调性的中断 （ 如由于目标重启导致的计数器重置 ） 自动进行调整 。 Increase 被外推以覆盖范围向量选择器中指定的整个时间范围 ， 因此即使计数器仅增加整数 ， 也有可能得到非整数结果 。 < / p >
< p > 以下表达式返回范围向量中每个时间序列在过去5分钟内的 HTTP 请求数 ： < / p >
< pre > increase ( http _requests _total { job = "api-server" } [ 5 m ] ) < / pre >
< p > < code > increase < / code > 仅用于计数器 。 它是 < code > rate ( v ) < / code > 乘以指定时间范围窗口下的秒数的语法糖 ， 主要目的是提高可读性 。 在记录规则中使用 < code > rate < / code > ， 以持续跟踪每秒的 increase 。 < / p >
< / div >
< / div >
<!-- irate ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-irate" > irate ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > irate ( v range - vector ) < / code > 计算范围向量中时间序列的每秒瞬时增长率 。 计算基于最后两个数据点 。 会对单调性的中断 （ 如由于目标重启导致的计数器重置 ） 自动进行调整 。 < / p >
< p > 下面的表达式返回范围向量中每个时间序列里最近的两个数据点的每秒 HTTP 请求速率 ， 最多可追溯5分钟 ： < / p >
< pre > irate ( http _requests _total { job = "api-server" } [ 5 m ] ) < / pre >
< p > 只有在绘制易变的 、 快速移动的计数器时 ， 才应使用 < code > irate < / code > 。 警报和慢速计数器应使用 < code > rate < / code > ， 因为 rate 的短暂变化会重置 < code > FOR < / code > 子句 ， 完全由罕见峰值构成的图读起来很难 。 < / p >
< p > 请注意 ， 当将 < code > irate ( ) < / code > 与聚合运算符 （ 如 < code > sum ( ) < / code > ） 或随时间聚合的函数 （ 任何以 < code > _over _time < / code > 结尾的函数 ） 结合使用时 ， 始终先取 < code > irate ( ) < / code > ， 然后再聚合 。 否则 ， 当目标重启时 ， < code > irate ( ) < / code > 无法检测计数器重置 。 < / p >
< / div >
< / div >
<!-- label _join ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-label_join" > label _join ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > 对于 < code > v < / code > 中的每个时间序列 ， < code > label _join ( v instant - vector , dst _label string , separator string , src _label _1 string , src _label _2 string , ... ) < / code > 用 < code > separator < / code > 连接所有 < code > src _labels < / code > 的所有值 ， 并返回带有包含连接值的 < code > dst _label < / code > 标签的时间序列 。 此函数中可以有任意数量的 < code > src _labels < / code > 。 < / p >
< p > 下面的表达式返回一个向量 ， 该向量中的每个时间序列都有一个添加了值 < code > a , b , c < / code > 的 < code > foo < / code > 标签 ： < / p >
< pre > label _join ( up { job = "api-server" , src1 = "a" , src2 = "b" , src3 = "c" } , "foo" , "," , "src1" , "src2" , "src3" ) < / pre >
< / div >
< / div >
<!-- label _replace ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-label_replace" > label _replace ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > 对于 < code > v < / code > 中的每个时间序列 ， < code > label _replace ( v instant - vector , dst _label string , replacement string , src _label string , regex string ) < / code > 将正则表达式 < code > regex < / code > 与标签 < code > src _label < / code > 的值进行匹配 。 如果匹配成功 ， 返回的时间序列中的标签 < code > dst _label < / code > 的值将是 < code > replacement < / code > 的扩展 ， 以及输入中的原始标签 。 正则表达式中的捕获组可以用 < code > $1 < / code > , < code > $2 < / code > 等引用 。 如果正则表达式不匹配 ， 则返回的时间序列不发生改变 。 < / p >
< p > 此表达式将返回带有值为 < code > a : c < / code > 的 < code > service < / code > 标签和值为 < code > a < / code > 的 < code > foo < / code > 标签的时间序列 ： < / p >
< pre > label _replace ( up { job = "api-server" , service = "a:c" } , "foo" , "$1" , "service" , "(.*):.*" ) < / pre >
< / div >
< / div >
<!-- ln ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-ln" > ln ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > ln ( v instant - vector ) < / code > 计算 < code > v < / code > 中所有元素的自然对数 。 特殊情况有 ： < / p >
< ul >
< li > < code > ln ( + Inf ) = + Inf < / code > < / li >
< li > < code > ln ( 0 ) = - Inf < / code > < / li >
< li > < code > ln ( x & lt ; 0 ) = NaN < / code > < / li >
< li > < code > ln ( NaN ) = NaN < / code > < / li >
< / ul >
< / div >
< / div >
<!-- log2 ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-log2" > log2 ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > log2 ( v instant - vector ) < / code > 计算 < code > v < / code > 中所有元素的二进制对数 。 特殊情况与 < code > ln < / code > 中的特殊情况相同 。 < / p >
< / div >
< / div >
<!-- log10 ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-log10" > log10 ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > log10 ( v instant - vector ) < / code > 计算 < code > v < / code > 中所有元素的十进制对数 。 特殊情况与 < code > ln < / code > 中的特殊情况相同 。 < / p >
< / div >
< / div >
<!-- minute ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-minute" > minute ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > minute ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的一小时内的分钟数 。 返回值的范围为0到59 。 < / p >
< / div >
< / div >
<!-- month ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-month" > month ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > month ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的一年中的月份数 。 返回值的范围为1到12 ， 其中1表示一月 。 < / p >
< / div >
< / div >
<!-- predict _linear ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-predict_linear" > predict _linear ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > predict _linear ( v range - vector , t scalar ) < / code > 使用简单线性回归 ， 基于范围向量 < code > v < / code > 预测从现在起 < code > t < / code > 秒后时间序列的值 。 范围向量必须有至少两个样本才能执行计算 。 当在范围向量中发现 < code > + Inf < / code > 或 < code > - Inf < / code > 时 ， 计算的斜率和偏移值将为 < code > NaN < / code > 。 < / p >
< p > < code > predict _linear < / code > 应仅用于 gauge 。 < / p >
< / div >
< / div >
<!-- rate ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-rate" > rate ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > rate ( v range - vector ) < / code > 计算范围向量中时间序列的每秒平均增长率 。 会对单调性的中断 （ 如由于目标重启导致的计数器重置 ） 自动进行调整 。 此外 ， 考虑到遗漏的抓取 ， 或抓取周期与该范围时间段的不完全一致 ， 计算会外推至时间范围的端点 。 < / p >
< p > 下面的表达式返回范围向量中的每个时间序列在过去5分钟内的每秒 HTTP 请求速率 ： < / p >
< pre > rate ( http _requests _total { job = "api-server" } [ 5 m ] ) < / pre >
< p > < code > rate < / code > 仅用于计数器 。 最适合于报警和绘制移动缓慢的计数器 。 < / p >
< p > 请注意 ， 当将 < code > rate ( ) < / code > 与聚合运算符 （ 如 < code > sum ( ) < / code > ） 或随时间聚合的函数 （ 任何以 < code > _over _time < / code > 结尾的函数 ） 结合使用时 ， 始终先取 < code > rate ( ) < / code > ， 然后再聚合 。 否则 ， 当目标重启时 ， < code > rate ( ) < / code > 无法检测计数器重置 。 < / p >
< / div >
< / div >
<!-- resets ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-resets" > resets ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > 对于每个输入时间序列 ， < code > resets ( v range - vector ) < / code > 将在给定时间范围内计数器重置的次数返回为一个即时向量 。 两个连续样本之间值的任何减少都会被看作计数器重置 。 < / p >
< p > < code > resets < / code > 仅用于计数器 。 < / p >
< / div >
< / div >
<!-- round ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-round" > round ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > round ( v instant - vector , to _nearest = 1 scalar ) < / code > 将 < code > v < / code > 中所有元素的样本值舍入到最接近的整数 。 通过四舍五入来解决平局 。 可选的 < code > to _nearest < / code > 参数允许指定样本值应舍入到的最接近倍数 。 这个倍数也可能是一个分数 。 < / p >
< / div >
< / div >
<!-- scalar ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-scalar" > scalar ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > 输入一个单元素向量 ， < code > scalar ( v instant - vector ) < / code > 将该单元素的样本值作为标量返回 。 如果输入的向量不是只有一个元素 ， 则 < code > scalar < / code > 返回 < code > NaN < / code > 。 < / p >
< / div >
< / div >
<!-- sgn ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sgn" > sgn ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > sgn ( v instant - vector ) < / code > 返回一个所有样本值都转换为其符号的向量 ， 定义为 ： 如果 v 为正 ， 则为1 ； 如果 v 为负 ， 则为 - 1 ； 如果 v 等于0 ， 则为0 。 < / p >
< / div >
< / div >
<!-- sort ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sort" > sort ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > sort ( v instant - vector ) < / code > 返回按样本值升序排序的向量元素 。 < / p >
< / div >
< / div >
<!-- sort _desc ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sort_desc" > sort _desc ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > 与 < code > sort < / code > 相同 ， 但按降序排序 。 < / p >
< / div >
< / div >
<!-- sqrt ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-sqrt" > sqrt ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > sqrt ( v instant - vector ) < / code > 计算 < code > v < / code > 中所有元素的平方根 。 < / p >
< / div >
< / div >
<!-- time ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-time" > time ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > time ( ) < / code > 返回自1970年1月1日 （ UTC ） 以来的秒数 。 请注意 ， 该算法并不返回当前时间 ， 而是返回表达式评估的时间 。 < / p >
< / div >
< / div >
<!-- timestamp ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-timestamp" > timestamp ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > timestamp ( v instant - vector ) < / code > 将给定向量的每个样本的时间戳作为自1970年1月1日 （ UTC ） 以来的秒数返回 。 < / p >
< / div >
< / div >
<!-- vector ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-vector" > vector ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > vector ( s scalar ) < / code > 将标量 < code > s < / code > 作为不带标签的向量返回 。 < / p >
< / div >
< / div >
<!-- year ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-year" > year ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > < code > year ( v = vector ( time ( ) ) instant - vector ) < / code > 返回 UTC 中每个给定时间的年份 。 < / p >
< / div >
< / div >
<!-- < aggregation > _over _time ( ) -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-aggregation" > & lt ; aggregation & gt ; _over _time ( ) < / h1 >
< div class = "introduce-view__content-label" >
< p > 以下函数允许聚合一段时间内给定范围向量的每个序列 ， 并返回包含每个序列聚合结果的即时向量 ： < / p >
< ul >
< li > < code > avg _over _time ( range - vector ) : < / code > 指定间隔内所有点的平均值 。 < / li >
< li > < code > min _over _time ( range - vector ) : < / code > 指定间隔内所有点的最小值 。 < / li >
< li > < code > max _over _time ( range - vector ) : < / code > 指定间隔内所有点的最大值 。 < / li >
< li > < code > sum _over _time ( range - vector ) : < / code > 指定间隔内所有值的总和 。 < / li >
< li > < code > count _over _time ( range - vector ) : < / code > 指定间隔内所有值的计数 。 < / li >
< li > < code > quantile _over _time ( scalar , range - vector ) : < / code > 指定间隔内值的 φ 分位数 （ 0 ≤ φ ≤ 1 ） 。 < / li >
< li > < code > stddev _over _time ( range - vector ) : < / code > 指定间隔内值的总体标准偏差 。 < / li >
< li > < code > stdvar _over _time ( range - vector ) : < / code > 指定间隔内值的总体标准方差 。 < / li >
< li > < code > last _over _time ( range - vector ) : < / code > 指定间隔内最近的点值 。 < / li >
< li > < code > present _over _time ( range - vector ) : < / code > 指定间隔内任何序列的值1 。 < / li >
< / ul >
< p > 注意 ： 指定间隔中的所有值在聚合中都具有相同的权重 ， 即使这些值在整个间隔中的间距并不相同 。 < / p >
< / div >
< / div >
<!-- Trigonometric Functions -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "functions-trigonometric" > 三角函数 < / h1 >
< div class = "introduce-view__content-label" >
< p > The trigonometric functions work in radians : < / p >
< ul >
< li > < code > acos ( v instant - vector ) : < / code > 计算 v 中所有元素的反余弦值 （ 特殊情况 ） 。 < / li >
< li > < code > acosh ( v instant - vector ) : < / code > 计算 v 中所有元素的反双曲余弦值 （ 特殊情况 ） 。 < / li >
< li > < code > asin ( v instant - vector ) : < / code > 计算 v 中所有元素的反正弦值 （ 特殊情况 ） 。 < / li >
< li > < code > asinh ( v instant - vector ) : < / code > 计算 v 中所有元素的反双曲正弦值 （ 特殊情况 ） 。 < / li >
< li > < code > atan ( v instant - vector ) : < / code > 计算 v 中所有元素的反正切值 （ 特殊情况 ） 。 < / li >
< li > < code > atanh ( v instant - vector ) : < / code > 计算 v 中所有元素的反双曲正切值 （ 特殊情况 ） 。 < / li >
< li > < code > cos ( v instant - vector ) : < / code > 计算 v 中所有元素的余弦值 （ 特殊情况 ） 。 < / li >
< li > < code > cosh ( v instant - vector ) : < / code > 计算 v 中所有元素的双曲余弦值 （ 特殊情况 ） 。 < / li >
< li > < code > sin ( v instant - vector ) : < / code > 计算 v 中所有元素的正弦值 （ 特殊情况 ） 。 < / li >
< li > < code > sinh ( v instant - vector ) : < / code > 计算 v 中所有元素的双曲正弦值 （ 特殊情况 ） 。 < / li >
< li > < code > tan ( v instant - vector ) : < / code > 计算 v 中所有元素的正切值 （ 特殊情况 ） 。 < / li >
< li > < code > tanh ( v instant - vector ) : < / code > 计算 v 中所有元素的双曲正切值 （ 特殊情况 ） 。 < / li >
< / ul >
< p > 以下函数可以对角度和弧度进行转换 ： < / p >
< ul >
< li > < code > deg ( v instant - vector ) < / code > : 将 < code > v < / code > 中所有元素的弧度转换为角度 。 < / li >
< li > < code > pi ( ) < / code > : 返回pi 。 < / li >
< li > < code > rad ( v instant - vector ) < / code > : 将 < code > v < / code > 中所有元素的角度转换为弧度 。 < / li >
< / ul >
< / div >
< / div >
<!-- QUERY EXAMPLES -- >
< h1 class = "page-header-one" id = "query-examples" > 查询示例 < / h1 >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "simple-time-series-selection" > 简单的时间序列选择 < / h1 >
< div class = "introduce-view__content-label" >
< p > 返回度量为 < code > http _requests _total < / code > 的所有时间序列 ： < / p >
< pre > http _requests _total < / pre >
< p > 返回带有度量 < code > http _requests _total < / code > 和给定 < code > job < / code > 和 < code > handler < / code > 标签的时间序列 ： < / p >
< pre > http _requests _total { job = "apiserver" , handler = "/api/comments" } < / pre >
2022-10-25 14:47:47 +08:00
< p > 返回同一个向量的整个时间范围 （ 该示例中为查询时间之前的5分钟 ） ， 使其成为 < b style = "color: #3C92F1" @click ="jumpClick('#range-vector-selectors')" class = "log-link" > 范围向量 < / b > ： < / p >
2022-10-24 16:11:36 +08:00
< pre > http _requests _total { job = "apiserver" , handler = "/api/comments" } [ 5 m ] < / pre >
< p > 注意 ， 产生范围向量的表达式不能被直接绘制成图形 ， 而是要在表达式浏览器的表格 （ “ 控制台 “ ） 视图中查看 < / p >
< p > 使用正则表达式 ， 您可以只为名称符合特定模式的任务选择时间序列 ， 本示例中要求作业以 < code > server < / code > 结尾 : < / p >
< pre > http _requests _total { job = ~ ".*server" } < / pre >
< p > Prometheus 中的所有正则表达式都使用 RE2 语法 。 < / p >
< p > 要选择除 4 xx 之外的所有 HTTP 状态代码 ， 您可以运行 ： < / p >
< pre > http _requests _total { status ! ~ "4.." } < / pre >
< / div >
< / div >
<!-- Subquery -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "query-examples-subquery" > Subquery子查询 < / h1 >
< div class = "introduce-view__content-label" >
< p > 返回过去30分钟内 < code > http _requests _total < / code > 度量的5分钟速率 ， 分辨率为1分钟 。 < / p >
< pre > rate ( http _requests _total [ 5 m ] ) [ 30 m : 1 m ] < / pre >
< p > 这是嵌套子查询的一个示例 。 < code > deriv < / code > 函数的子查询使用默认分辨率 。 注意应该在必要的时候才使用子查询 。 < / p >
< pre > max _over _time ( deriv ( rate ( distance _covered _total [ 5 s ] ) [ 30 s : 5 s ] ) [ 10 m : ] ) < / pre >
< / div >
< / div >
<!-- Using functions , operators , etc . -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "using-functions" > 使用函数 、 运算符等 < / h1 >
< div class = "introduce-view__content-label" >
< p > 返回度量名称为 < code > http _requests _total < / code > 的所有时间序列在过去5分钟内的每秒速率 ： < / p >
< pre > rate ( http _requests _total [ 5 m ] ) < / pre >
< p > 假设 < code > http _requests _total < / code > 时间序列都有标签 < code > job < / code > （ 按任务名扇出 ） 和 < code > instance < / code > （ 按任务实例扇出 ） ， 我们可能会对所有实例的速率求和 ， 这样我们得到较少的输出时间序列 ， 但仍然保留 < code > job < / code > 这一维度 ： < / p >
< pre > sum by ( job ) (
rate ( http _requests _total [ 5 m ] )
) < / pre >
< p > 如果我们有两个具有相同维度标签的不同度量 ， 我们可以对其应用二进制运算符 ， 则两侧具有相同标签集的元素将匹配并传播到输出 。 例如 ， 该表达式返回每个实例在 MiB 中未使用的内存 （ 在一个虚构的集群调度程序上公开有关其所运行实例的度量 ) ： < / p >
< pre > ( instance _memory _limit _bytes - instance _memory _usage _bytes ) / 1024 / 1024 < / pre >
< p > 同样的表达式由应用程序求和 ， 则可以写为 ： < / p >
< pre > sum by ( app , proc ) (
instance _memory _limit _bytes - instance _memory _usage _bytes
) / 1024 / 1024 < / pre >
< p > 如果相同的虚拟群集调度程序针对每个实例公开了如下 CPU 使用度量 ： < / p >
< pre > instance _cpu _time _ns { app = "lion" , proc = "web" , rev = "34d0f99" , env = "prod" , job = "cluster-manager" }
instance _cpu _time _ns { app = "elephant" , proc = "worker" , rev = "34d0f99" , env = "prod" , job = "cluster-manager" }
instance _cpu _time _ns { app = "turtle" , proc = "api" , rev = "4d3a513" , env = "prod" , job = "cluster-manager" }
instance _cpu _time _ns { app = "fox" , proc = "widget" , rev = "4d3a513" , env = "prod" , job = "cluster-manager" }
... < / pre >
< p > 我们得到可以按应用程序 （ < code > app < / code > ） 和进程类型 （ < code > proc < / code > ） 分组的前3名 CPU 用户 ， 如下所示 ： < / p >
< pre > topk ( 3 , sum by ( app , proc ) ( rate ( instance _cpu _time _ns [ 5 m ] ) ) ) < / pre >
< p > 假设此度量包含每个正在运行实例的一个时间序列 ， 您可以按如下方式计算每个应用程序的运行实例数 ： < / p >
< pre > count by ( app ) ( instance _cpu _time _ns ) < / pre >
< / div >
< / div >
< / div >
< / div >
< / div >
< div v-else v-show = "showIntroduce" class="introduce-view" >
<!-- 英文 -- >
< div class = "info-room title-heard" v-if = "language == 'en'" >
< div class = "col-md-9 logs-content" >
<!-- LogQL : Log query language -- >
< h1 class = "page-header" style = "margin-Top:0px" id = "log-query-language" > LogQL : Log Query Language < a class = "header-anchor" href = "https://grafana.com/docs/loki/latest/logql/" rel = "noopener noreferrer" target = "_blank" > < i class = "nz-icon nz-icon-link1" style = "font-size: 16px;" :title = "$t('overall.link')" > < / i > < / a > < / h1 >
< div class = "title-heard__divider" > < / div >
<!-- catalog 目录 -- >
< div class = "catalog" >
< ul class = "catalog-square" >
< li >
< div @click ="jumpClick('#log-queries')" > < span > Log queries < / span > < / div >
< ul class = "catalog-disc" >
< li @click ="jumpClick('#log-stream-selector')" > < span > Log stream selector < / span > < / li >
< li >
< div @click ="jumpClick('#log-pipeline')" > < span > Log pipeline < / span > < / div >
< ul >
< li @click ="jumpClick('#line-filter-expressions')" > < span > Line filter expression < / span > < / li >
< li @click ="jumpClick('#label-filter-expressions')" > < span > Label filter expression < / span > < / li >
< li @click ="jumpClick('#parsing-expressions')" > < span > Parser expression < / span > < / li >
< li @click ="jumpClick('#JSON')" > < span > JSON < / span > < / li >
< li @click ="jumpClick('#logfmt')" > < span > logfmt < / span > < / li >
< li @click ="jumpClick('#pattern')" > < span > Pattern < / span > < / li >
< li @click ="jumpClick('#regexp')" > < span > Regular expression < / span > < / li >
< li @click ="jumpClick('#unpack')" > < span > unpack < / span > < / li >
< li @click ="jumpClick('#line-format-expressions')" > < span > Line format expression < / span > < / li >
< li @click ="jumpClick('#label-format-expressions')" > < span > Labels format expression < / span > < / li >
< / ul >
< / li >
< li >
< div @click ="jumpClick('#log-queries-examples')" > < span > Log queries examples < / span > < / div >
< ul >
< li @click ="jumpClick('#multiple-filtering')" > < span > Multiple filtering < / span > < / li >
< li @click ="jumpClick('#multiple-parsers')" > < span > Multiple parsers < / span > < / li >
< li @click ="jumpClick('#formatting')" > < span > Formatting < / span > < / li >
< / ul >
< / li >
< / ul >
< / li >
< li >
< div @click ="jumpClick('#metric-queries')" > < span > Metric queries < / span > < / div >
< ul >
< li style = "list-style:disc;" >
< div @click ="jumpClick('#range-vector-aggregation')" > < span > Range Vector aggregation < / span > < / div >
< ul >
< li @click ="jumpClick('#log-range-aggregations')" > < span > Log range aggregations < / span > < / li >
< li @click ="jumpClick('#unwrapped-range-aggregations')" > < span > Unwrapped range aggregations < / span > < / li >
< li @click ="jumpClick('#unwrapped-examples')" > < span > Unwrapped examples < / span > < / li >
< / ul >
< / li >
< li style = "list-style:disc;" >
< div @click ="jumpClick('#built-in-aggregation-operators')" > < span > Built - in aggregation operators < / span > < / div >
< ul > < li @click ="jumpClick('#vector-aggregation-examples')" > < span > Vector aggregation examples < / span > < / li > < / ul >
< / li >
< / ul >
< / li >
< / ul >
< / div >
< div class = "page-header-label" >
< p > LogQL is Grafana Loki ’ s PromQL - inspired query language . Queries act as if they are a distributed grep to aggregate log sources . LogQL uses labels and operators for filtering . < / p >
< p > There are two types of LogQL queries : < / p >
< ul >
< li > < b style = "color: #3C92F1" @click ="jumpClick('#log-queries')" class = "log-link" > Log queries < / b > return the contents of log lines . < / li >
< li > < b style = "color: #3C92F1" @click ="jumpClick('#metric-queries')" class = "log-link" > Metric queries < / b > extend log queries to calculate values based on query results . < / li >
< / ul >
< / div >
<!-- Log queries -- >
<!-- start -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-one" id = "log-queries" > Log queries < / h1 >
< p > All LogQL queries contain a < b > log stream selector . < / b > < / p >
< div class = "img-hidden" > < img src = " data : image / png ; base64 , iVBORw0KGgoAAAANSUhEUgAAAkYAAAIPCAYAAACWihHIAABZK0lEQVR4XuzdC7ylU / 3H8Z9b5JJE7pdBSDepSAmDoitdpFBModCFVFL / MhJKiopIxSil + 82llDLjTq6JEJlBuadE7tX / 953fWmevvc6zz + wzc2Zm77M / 79fr9zJ7Pes8 + 9n7nP / / + bbWep7HDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHNiHa9V60aMudW81q4b55GVvNarGwEAQDudMB / zus9rwWrb / HSJ17F1Y + UlXtO9Xl1v6EGLeP3D61Gv5attY0371 / fynqLtb15PeE0o2gAAGGjXeh1RtS3m9Suvk6v2 + U0n8h / UjZVXeP3P6831hh71Ha8zvJ5SbxhjK1t8Lx8p2r7mdbbXkkUbAAAD7V9e36wbe9R4DEbzSlMwAgCgby3ktZ3Xoam2T221g7wmei1qMW3yea8DvNYs + sgWXpMtpnGuSP / evdj + Aa + ditfZM7z2thhl + rjXBu2bZ3q2xf5W8HqWRT8dxySL42qiKbAPeR3l9VFrXvsyp8FoQ69PWBz7Xl5Pb9 / cZiOvT1kc9w6pbRevPYd6NNPoiz77i72e5vV + i33sbzFFWdvV4vvMyu9uDa + PWfz8Hl6LF / 1q23od5nWk1zstRv1KTcFoR6 / 9itf6G9F7r27x3gfarN97GYvv8ksW3 + 0m7ZsBABh7OqEqvOjEpnCg0r + vtDjhlf7j9VmvCy1Gg6Z7PWyxlqQ8qX8wbVP / 3O + nxfabvE4vXotOvg9Y7Ev9tT5Gx3GMta9FemNq13vovWd43ZvaLrX2cKRwd1Ladr / XVRb7fdJrt6KfzG4w0rEdn9q1bx27PsM / vV5Z9JMFrNVX29VX6610jJpevKzVtdGKFj + rMPona73f4xbfhb6b0m + 9rile5 + / uHRbvf5fXrantdq / ntLrOpMDyC4vt6jsj / fsvFqE0awpGP7Hon21l0UchTn8Tt3ndndr + aMOn3F5qsT3 / PWhNmvpqBFLfIwAAY04nmN95Pei1TdGuE7pCyrmpT6ag84jF2pV8IlvO4qSuE5hGTUqdptLqYLSGRd / fW1xJJVo8 / BmLk2E58pBP7jqR5 / dTONFIl9rLERKNmKhNIw45MD3V63yLz6d / Z7MbjHSiV9shFscsGhVRyNF75M8jCo / qq5GrfDy6Ok99NbrWbTDS76D8TNqHQuFDFt9l1ikYqd + 7inaNYCn4XGetzyBajK730mhWpu9c35WCc / 7bGE0wUth5edGuUSu1awQp00jRnRaBfa3UtrBFH / XdJ7UBADCm9L / KdaLRyb2m6S5t27RoUzC6x4ZPfSgc / dtrStXebTDSlIqCVdOl5VMtTsR51Cif3Pcd6hF04tQoyKlV + wts + NVvkyz28cKibXaCkUakdAI / Z6hHi0ZUNDKlEbZMozwatapHPNb3 + q91H4xusOGfaR2L34 + mvLJOwejbRVumUSRte0N6vazFSNSnh3q07GzRNwec0QQjTSGW9F3ou9ci8ezD1vmKNv09aFE / AABjTus2dLJapd5gsQ5F27SuKNOJtw4e2Vlet1Rt3Qajyy0ul2 + iESAdx3PT63xy14m2dr3F6FUTjUK8zGLtyy8t9rFZsX12gtHz0 + v3DvVopxEwlShoqO / k1uY2CjvdBqMv1BsShaALitedglFe11RayuL3m / f9Jou + r7MIKGXpe9Q2hWcZTTDSfmv63Wt6NtPvR8c9oaG + bBEiy9E + AADGhE4y + l / mnWga5avFa504NQ3U5ESLKZpSt8FI02KdQolOzDqhbp1e55P75kM9WjQio4CWaVpIwW66xc + oNLKlADUWwehV6fVrhnq0 + 5HFGh7Rwmf17RSipln3wagMICWFwj8XrzsFI32OJlqzlEeTciAdqXJoHk0wen3Rll3sdVHxWtN09XvV1bTYHACAOZLX5SxRb7BYv6L / Zf65ok3B6BvF65JCwB1VW7fBSIGm00iPrl7TMWodjIwmGH3Rou / JFlNEWvsjeTRkToNRnop821CPdr + 21rSP1hqpr0bpmmgBcrfBqGl6SzTqotG3rFMwagpymhbU1JnWFck7Lfpua8NHbXI93cJYB6NzLcLRhBGq6apJAADmyFstTlYalalpMba2aT1JpmCkBbo1re9RsPhN1a5gpJGkWh2Mvm9x1VjT9MgJFguTdXm6jCYYafREJ9mabjUwFsFIwUDHdvxQjxZ9lnLN0wIWwVEhoDbB4rvtNhidXW + wmArTlWknF22dgpEWtdfyZ9Pl8aL1V3o9KXcYwVgHI41S6m + nvi0AAABzlUaKdDWSFgSXo0ZaXK2TtK4g0gk308lbJ7fdijbJVwtplKGkfddhSepglENYOTolugIqXwWXjSYYafREIzbl6II + j8LCWAQjUfBRICkXcssRFn3LS / a1qFhtWpCtETnR + i6N9ChgdRuMNJJXXkUomhbVtjzlKJ2CkS59n1C061jOs7g6cfmiXaM2Wjem9y0dbBF61k2vxzoYbWzxt6bPVNLvTsH8u1U7AABj5tUW4WO6xcLbIy3uU6O2eiRJJ6vTLE6smjqbbDEFphOerirSqEhJ02japlEbXc6e1cFIjrHoO81iqkg / q / VAN1r7yXo0wWhPi7468epYFVZuTa / VPhbBSKFBn0fHqmPW59TnVb + ji36iK8lOStu0Hkvfub7Tr1kEk26D0Q8tRlS + ZfFd6WfVXk9bdgpGp1jc + + krFmFUa64UtnSzxZKu6FM / lUZxyt / 3j232LtfvJhiJ3kv9L7WY8tWViwppmu7TtCgAAHONRjv0v8J1gr / ZYhSkHgERncS / ZHHn5XMsTuwabdKIkRY61zQVomkbnfB1Ms80AnR48TrbxeJybO33DxYn7byOJVM4UR + dtGsnW5xAS5Msrgy7zSIk6EoqhSrt4 / mtbjNP9DoZj0T99XN1KHuGxftq / zp2fTdvb + vRTuul9J3p / XJQGE0wOsAiaGikSe + nz6d7 + 9TBVGusyqnMHIy2sAiNWtekn9fUXNO6I1nDYl3ZDRZ9FWLeZ + 2jcLriTt9LudZKAVFTpNmLLProiraaQlde21TSWjAdm95Xpf3ltWYAAMx3ORhh9jWtoxKN2jSthyqVwWh2lMEIAADMIYLRnHmvxQ0hNXpS2tUisBxWtdcIRgAA9BCC0ZxZ3 + KeTbp31PkWdwq / 2iKsaI1NudC9CcEIAIAecpDFYm3MPt12QGt0tI5Li6N1OwLdq6mb + / IsabEuadN6Q5d0k0n9 / Br1BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB9aUGvG70WqDcAAAAMmqUtnmq / RL0BAABg0KzodYnFyBEAAAAAAAAAAACAIS / w2sbrd / UGAACAQbKY1 / 1eq6X / Lt + + GQAAYHDs4PXb9O + ve32y2AYAADBQLvB6S / r3 + l4 / L7YBAAAMjEW8DjMu0wcAAAAAAIAsWzcUVvD6jdfT6g0AAADjjRZcX + e1UL2hcIzXmRbTbQAAAOPS1l53e21Qb6gs7PUTi8XYIwUoAACAvrS6111em9YbOlA42rVuBAAAGC / 0wNjZpWAFAADQt / Soj13qxtmg6bQ / eP3Ma71qGwAAQM / Sgukdvc7zut7rde2bZ9tTvA6wmI47utoGAAAw3 + nmjBO8NvNaILUt4XWGxR2ttU5orOn5auXi7c29PmBxDBOMxdoAAAw50WLK5W9e / / N6YbHt6tSWS091z66ptj2v2HZtte05xTZddl5u02MtMo2WlNvKKaAbq23rFNtuqratXWy7udq2VrHtlmrbhGLbjGpbuV7ntmrbqsW226ttqxTb9B0 / 4TXd63yvZYpt85IC0bEWjxfRsXyk2PY5az / + jxbbjqi2lT93ZLVt / 2LbF6tt + xXbNJJVbvtgse1L1TaFuewr1
< p > Optionally , the log stream selector can be followed by < b > a log pipeline < / b > . A log pipeline is a set of stage expressions that are chained together and applied to the selected log streams . Each expression can filter out , parse , or mutate log lines and their respective labels . < / p >
< p > The following example shows a full log query in action : < / p >
< p > < code class = "fillbox" > { container = "query-frontend" , namespace = "loki-dev" } |= "metrics.go" | logfmt | duration > 10 s and throughput _mb < 500 < / code > < / p >
< p > The query is composed of : < / p >
< ul >
< li > a log stream selector < code > { container = "query-frontend" , namespace = "loki-dev" } < / code > which targets the < code > query - frontend < / code > container in the < code > loki - dev < / code > namespace . < / li >
< li > a log pipeline < code > |= "metrics.go" | logfmt | duration > 10 s and throughput _mb < 500 < / code > which will filter out log that contains the word < code > metrics . go < / code > , then parses each log line to extract more labels and filter with them . < / li >
< / ul >
< pre > To avoid escaping special characters you can use the < code > ` </code>(backtick) instead of<code> " </code>when quoting strings. For example <code> ` \ w + ` </code> is the same as <code>" \\ w+"</code>. This is specially useful when writing a regular expression which contains multiple <br/>backslashes that require escaping.</pre>
< / div >
<!-- Log stream selector -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "log-stream-selector" > Log stream selector < / h1 >
< div class = "introduce-view__content-label" >
< p > The stream selector determines which log streams to include in a query ’ s results . A log stream is a unique source of log content , such as a file . A more granular log stream selector then reduces the number of searched streams to a manageable volume . This means that the labels passed to the log stream selector will affect the relative performance of the query ’ s execution . < / p >
< p > The log stream selector is specified by one or more comma - separated key - value pairs . Each key is a log label and each value is that label ’ s value . Curly braces ( < code > { < / code > and < code > } < / code > ) delimit the stream selector . < / p >
< p > Consider this stream selector : < / p >
< p > < code class = "fillbox" > { app = "mysql" , name = "mysql-backup" } < / code > < / p >
< p > All log streams that have both a label of < code > app < / code > whose value is < code > mysql < / code > and a label of < code > name < / code > whose value is < code > mysql - backup < / code > will be included in the query results . A stream may contain other pairs of labels and values , but only the specified pairs within the stream selector are used to determine which streams will be included within the query results . < / p >
< p > The same rules that apply for Prometheus Label Selectors apply for Grafana Loki log stream selectors . < / p >
< p > The < code > = < / code > operator after the label name is a < b > label matching operator < / b > . The following label matching operators are supported : < / p >
< ul >
< li > < code > = < / code > : exactly equal < / li >
< li > < code > != < / code > : not equal < / li >
< li > < code > = ~ < / code > : regex matches < / li >
< li > < code > ! ~ < / code > : regex does not match < / li >
< / ul >
< p > Regex log stream examples : < / p >
< ul >
< li > < code > { name = ~ "mysql.+" } < / code > < / li >
< li > < code > { name ! ~ "mysql.+" } < / code > < / li >
< li > < code > { name ! ~ ` mysql- \ d+ ` } < / code > < / li >
< / ul >
< p > < b > Note : < / b > The < code > = ~ < / code > regex operator is fully anchored , meaning regex must match against the entire string , including newlines . The regex < code > . < / code > character does not match newlines by default . If you want the regex dot character to match newlines you can use the single - line flag , like so : < code > ( ? s ) search _term . + < / code > matches < code > search _term \ n . < / code > < / p >
< / div >
< / div >
<!-- Log pipeline -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "log-pipeline" > Log pipeline < / h1 >
< div class = "introduce-view__content-label" >
< p > A log pipeline can be appended to a log stream selector to further process and filter log streams . It is composed of a set of expressions . Each expression is executed in left to right sequence for each log line . If an expression filters out a log line , the pipeline will stop processing the current log line and start processing the next log line . < / p >
< p > Some expressions can mutate the log content and respective labels , which will be then be available for further filtering and processing in subsequent expressions . An example that mutates is the expression < / p >
< p > < code v-pre class = "fillbox" > | line _format "{{.status_code}}" < / code > < / p >
< p > Log pipeline expressions fall into one of three categories : < / p >
< ul >
< li > Filtering expressions : < b style = "color: #3C92F1" @click ="jumpClick('#line-filter-expressions')" class = "log-link" > line filter expressions < / b > and < b style = "color: #3C92F1" @click ="jumpClick('#label-filter-expressions')" class = "log-link" > label filter expressions < / b > < / li >
< li > < b style = "color: #3C92F1" @click ="jumpClick('#parsing-expressions')" class = "log-link" > Parsing expressions < / b > < / li >
< li > Formatting expressions : < b style = "color: #3C92F1" @click ="jumpClick('#line-format-expressions')" class = "log-link" > line format expressions < / b > and < b style = "color: #3C92F1" @click ="jumpClick('#label-format-expressions')" class = "log-link" > label format expressions < / b > < / li >
< / ul >
< / div >
< / div >
<!-- Line filter expression -- >
< div class = "introduce-view__content" >
< h2 id = "line-filter-expressions" > Line filter expression < / h2 >
< div class = "introduce-view__content-label" >
< p > The line filter expression does a distributed < code > grep < / code > over the aggregated logs from the matching log streams . It searches the contents of the log line , discarding those lines that do not match the case sensitive expression . < / p >
< p > Each line filter expression has a < b > filter operator < / b > followed by text or a regular expression . These filter operators are supported : < / p >
< ul >
< li > < code > |= < / code > : Log line contains string < / li >
< li > < code > != < / code > : Log line does not contain string < / li >
< li > < code > | ~ < / code > : Log line contains a match to the regular expression < / li >
< li > < code > ! ~ < / code > : Log line does not contain a match to the regular expression < / li >
< / ul >
< p > Line filter expression examples : < / p >
< ul >
< li >
< p > Keep log lines that have the substring “ error ” : < / p >
< p > < code class = "fillbox" > |= "error" < / code > < / p >
< p > A complete query using this example : < / p >
< p > < code class = "fillbox" > { job = "mysql" } |= "error" < / code > < / p >
< / li >
< li >
< p > Discard log lines that have the substring “ kafka . server : type = ReplicaManager ” : < / p >
< p > < code class = "fillbox" > != "kafka.server:type=ReplicaManager" < / code > < / p >
< p > A complete query using this example : < / p >
< p > < code class = "fillbox" > { instance = ~ "kafka-[23]" , name = "kafka" } != "kafka.server:type=ReplicaManager" < / code > < / p >
< / li >
< li >
< p > Keep log lines that contain a substring that starts with < code > tsdb - ops < / code > and ends with < code > io : 2003 < / code > . A complete query with a regular expression : < / p >
< p > < code class = "fillbox" > { name = "kafka" } | ~ "tsdb-ops.*io:2003" < / code > < / p >
< / li >
< li >
< p > Keep log lines that contain a substring that starts with < code > error = < / code > , and is followed by 1 or more word characters . A complete query with a regular expression : < / p >
< p > < code class = "fillbox" > { name = "cassandra" } | ~ ` error= \ w+ ` < / code > < / p >
< / li >
< / ul >
< p > Filter operators can be chained . Filters are applied sequentially . Query results will have satisfied every filter . This complete query example will give results that include the string < code > error < / code > , and do not include the string < code > timeout < / code > . < / p >
< p > < code class = "fillbox" > { job = "mysql" } |= "error" != "timeout" < / code > < / p >
< p > When using < code > | ~ < / code > and < code > ! ~ < / code > , Go ( as in Golang ) RE2 syntax regex may be used . The matching is case - sensitive by default . Switch to case - insensitive matching by prefixing the regular expression with < code > ( ? i ) < / code > . < / p >
< p > While line filter expressions could be placed anywhere within a log pipeline , it is almost always better to have them at the beginning . Placing them at the beginning improves the performance of the query , as it only does further processing when a line matches . For example , while the results will be the same , the query specified with < / p >
< p > < code class = "fillbox" v-pre > { job = "mysql" } | = " error " | json | line_format " {{ .err }} " < / code > < / p >
< p > will always run faster than < / p >
< p > < code class = "fillbox" v-pre > { job = "mysql" } | json | line_format " {{ .message }} " | = " error " < / code > < / p >
< p > Line filter expressions are the fastest way to filter logs once the log stream selectors have been applied . < / p >
< p > Line filter expressions have support matching IP addresses . See Matching IP addresses for details . < / p >
< / div >
< / div >
<!-- Label filter expression -- >
< div class = "introduce-view__content" >
< h2 id = "label-filter-expressions" > Label filter expression < / h2 >
< div class = "introduce-view__content-label" >
< p > Label filter expression allows filtering log line using their original and extracted labels . It can contain multiple predicates . < / p >
< p > A predicate contains a < b > label identifier < / b > , an < b > operation < / b > and a < b > value < / b > to compare the label with . < / p >
< p > For example with < code > cluster = "namespace" < / code > the cluster is the label identifier , the operation is < code > = < / code > and the value is “ namespace ” . The label identifier is always on the right side of the operation . < / p >
< p > We support multiple < b > value < / b > types which are automatically inferred from the query input . < / p >
< ul >
< li > < b > String < / b > is double quoted or backticked such as < code > "200" < / code > or ` <code>us-central1</code> ` . < / li >
< li > Duration is a sequence of decimal numbers , each with optional fraction and a unit suffix , such as “ 300 ms ” , “ 1.5 h ” or “ 2 h45m ” . Valid time units are “ ns ” , “ us ” ( or “ µs ” ) , “ ms ” , “ s ” , “ m ” , “ h ” . < / li >
< li > < b > Number < / b > are floating - point number ( 64 bits ) , such as < code > 250 < / code > , < code > 89.923 < / code > . < / li >
< li > < b > Bytes < / b > is a sequence of decimal numbers , each with optional fraction and a unit suffix , such as “ 42 MB ” , “ 1.5 Kib ” or “ 20 b ” . Valid bytes units are “ b ” , “ kib ” , “ kb ” , “ mib ” , “ mb ” , “ gib ” , “ gb ” , “ tib ” , “ tb ” , “ pib ” , “ pb ” , “ eib ” , “ eb ” . < / li >
< / ul >
< p > String type work exactly like Prometheus label matchers use in < b style = "color: #3C92F1" @click ="jumpClick('#log-stream-selector')" class = "log-link" > log stream selector < / b > . This means you can use the same operations ( < code > = < / code > , < code > != < / code > , < code > = ~ < / code > , < code > ! ~ < / code > ) . < / p >
< pre > The string type is the only one that can filter out a log line with a label < code > _ _error _ _ < / code > . < / pre >
< p > Using Duration , Number and Bytes will convert the label value prior to comparision and support the following comparators : < / p >
< ul >
< li > < code > == < / code > or < code > = < / code > for equality . < / li >
< li > < code > != < / code > for inequality . < / li >
< li > < code > > < / code > and < code > >= < / code > for greater than and greater than or equal . < / li >
< li > < code > & lt ; < / code > and < code > & lt ; = < / code > for lesser than and lesser than or equal . < / li >
< / ul >
< p > For instance , < code > logfmt | duration > 1 m and bytes _consumed > 20 MB < / code > < / p >
< p > If the conversion of the label value fails , the log line is not filtered and an < code > _ _error _ _ < / code > label is added . To filters those errors see the pipeline errors section . < / p >
< p > You can chain multiple predicates using < code > and < / code > and < code > or < / code > which respectively express the < code > and < / code > and < code > or < / code > binary operations . < code > and < / code > can be equivalently expressed by a comma , a space or another pipe . Label filters can be place anywhere in a log pipeline . < / p >
< p > This means that all the following expressions are equivalent : < / p >
< p > < code class = "fillbox" >
| duration >= 20 ms or size == 20 kb and method ! ~ "2.." < br / >
| duration >= 20 ms or size == 20 kb | method ! ~ "2.." < br / >
| duration >= 20 ms or size == 20 kb , method ! ~ "2.." < br / >
| duration >= 20 ms or size == 20 kb method ! ~ "2.."
< / code > < / p >
< p > By default the precedence of multiple predicates is right to left . You can wrap predicates with parenthesis to force a different precedence left to right . < / p >
< p > For example the following are equivalent . < / p >
< p > < code class = "fillbox" >
| duration >= 20 ms or method = "GET" and size & lt ; = 20 KB < br / >
| ( ( duration >= 20 ms or method = "GET" ) and size & lt ; = 20 KB )
< / code > < / p >
< p > It will evaluate first < code > duration >= 20 ms or method = "GET" < / code > . To evaluate first < code > method = "GET" and size & lt ; = 20 KB < / code > , make sure to use proper parenthesis as shown below . < / p >
< p > < code class = "fillbox" > | duration >= 20 ms or ( method = "GET" and size & lt ; = 20 KB ) < / code > < / p >
< pre > Label filter expressions are the only expression allowed after the unwrap expression . This is mainly to allow filtering errors from the metric extraction . < / pre >
< p > Label filter expressions have support matching IP addresses . See Matching IP addresses for details . < / p >
< / div >
< / div >
<!-- Parser expression -- >
< div class = "introduce-view__content" >
< h2 id = "parsing-expressions" > Parser expression < / h2 >
< div class = "introduce-view__content-label" >
< p > Parser expression can parse and extract labels from the log content . Those extracted labels can then be used for filtering using < b style = "color: #3C92F1" @click ="jumpClick('#label-filter-expressions')" class = "log-link" > label filter expressions < / b > or for < b style = "color: #3C92F1" @click ="jumpClick('#metric-queries')" class = "log-link" > metric aggregations < / b > . < / p >
< p > Extracted label keys are automatically sanitized by all parsers , to follow Prometheus metric name convention . ( They can only contain ASCII letters and digits , as well as underscores and colons . They cannot start with a digit . ) < / p >
< p > For instance , the pipeline < code > | json < / code > will produce the following mapping : < / p >
< p > < code class = "fillbox" > { "a.b" : { c : "d" } , e : "f" } < / code > < / p >
< p > - > < / p >
< p > < code class = "fillbox" > { a _b _c = "d" , e = "f" } < / code > < / p >
< p > In case of errors , for instance if the line is not in the expected format , the log line won ’ t be filtered but instead will get a new < code > _ _error _ _ < / code > label added . < / p >
< p > If an extracted label key name already exists in the original log stream , the extracted label key will be suffixed with the < code > _extracted < / code > keyword to make the distinction between the two labels . You can forcefully override the original label using a < b style = "color: #3C92F1" @click ="jumpClick('#label-format-expressions')" class = "log-link" > label formatter expression < / b > . However if an extracted key appears twice , only the latest label value will be kept . < / p >
< p > Loki supports < b style = "color: #3C92F1" @click ="jumpClick('#JSON')" class = "log-link" > JSON < / b > , < b style = "color: #3C92F1" @click ="jumpClick('#logfmt')" class = "log-link" > logfmt < / b > , < b style = "color: #3C92F1" @click ="jumpClick('#pattern')" class = "log-link" > pattern < / b > , < b style = "color: #3C92F1" @click ="jumpClick('#regexp')" class = "log-link" > regexp < / b > and < b style = "color: #3C92F1" @click ="jumpClick('#unpack')" class = "log-link" > unpack < / b > parsers . < / p >
< p > It ’ s easier to use the predefined parsers < code > json < / code > and < code > logfmt < / code > when you can . If you can ’ t , the < code > pattern < / code > and < code > regexp < / code > parsers can be used for log lines with an unusual structure . The < code > pattern < / code > parser is easier and faster to write ; it also outperforms the < code > regexp < / code > parser . Multiple parsers can be used by a single log pipeline . This is useful for parsing complex logs . There are examples in < b style = "color: #3C92F1" @click ="jumpClick('#multiple-parsers')" class = "log-link" > Multiple parsers < / b > . < / p >
< / div >
< / div >
<!-- JSON -- >
< div class = "introduce-view__content" >
< h2 id = "JSON" > JSON < / h2 >
< div class = "introduce-view__content-label" >
< p > The < b > json < / b > parser operates in two modes : < / p >
< p > 1. < b > without < / b > parameters : < / p >
< div class = "logfmt-module" style = "padding-left: 20px;" >
< p > Adding < code > | json < / code > to your pipeline will extract all json properties as labels if the log line is a valid json document . Nested properties are flattened into label keys using the < code > _ < / code > separator . < / p >
< p > Note : < b > Arrays are skipped < / b > . < / p >
< p > For example the json parsers will extract from the following document : < / p >
< pre > {
"protocol" : "HTTP/2.0" ,
"servers" : [ "129.0.1.1" , "10.2.1.3" ] ,
"request" : {
"time" : "6.032" ,
"method" : "GET" ,
"host" : "foo.grafana.net" ,
"size" : "55" ,
"headers" : {
"Accept" : "*/*" ,
"User-Agent" : "curl/7.68.0"
}
} ,
"response" : {
"status" : 401 ,
"size" : "228" ,
"latency_seconds" : "6.031"
}
} < / pre >
< p > The following list of labels : < / p >
< pre > "protocol" => "HTTP/2.0"
"request_time" => "6.032"
"request_method" => "GET"
"request_host" => "foo.grafana.net"
"request_size" => "55"
"response_status" => "401"
"response_size" => "228"
"response_latency_seconds" => "6.031" < / pre >
< / div >
< p > 2. < b > with < / b > parameters : < / p >
< div class = "logfmt-module" style = "padding-left: 20px;" >
< p > Using < code > | json label = "expression" , another = "expression" < / code > in your pipeline will extract only the specified json fields to labels . You can specify one or more expressions in this way , the same as < code > label _format < / code > ; all expressions must be quoted . < / p >
< p > Currently , we only support field access ( < code > my . field < / code > , < code > my [ "field" ] < / code > ) and array access ( < code > list [ 0 ] < / code > ) , and any combination of these in any level of nesting ( < code > my . list [ 0 ] [ "field" ] < / code > ) . < / p >
< p > For example , < code > | json first _server = "servers[0]" , ua = "request.headers[\"User-Agent\" ] < / code > will extract from the following document : < / p >
< pre > {
"protocol" : "HTTP/2.0" ,
"servers" : [ "129.0.1.1" , "10.2.1.3" ] ,
"request" : {
"time" : "6.032" ,
"method" : "GET" ,
"host" : "foo.grafana.net" ,
"size" : "55" ,
"headers" : {
"Accept" : "*/*" ,
"User-Agent" : "curl/7.68.0"
}
} ,
"response" : {
"status" : 401 ,
"size" : "228" ,
"latency_seconds" : "6.031"
}
}
< / pre >
< p > The following list of labels : < / p >
< pre > "first_server" => "129.0.1.1"
"ua" => "curl/7.68.0" < / pre >
< p > If an array or an object returned by an expression , it will be assigned to the label in json format . < / p >
< p > For example , < code > | json server _list = "servers" , headers = "request.headers" < / code > will extract : < / p >
< pre > "server_list" => ` ["129.0.1.1","10.2.1.3"] `
"headers" => ` {"Accept": "*/*", "User-Agent": "curl/7.68.0"} ` < / pre >
< p > If the label to be extracted is same as the original JSON field , expression can be written as just < code > | json & lt ; label & gt ; < / code > < / p >
< p > For example , to extract < code > servers < / code > fields as label , expression can be written as following < / p >
< p > < code > | json servers < / code > will extract : < / p >
< pre > "servers" => ` ["129.0.1.1","10.2.1.3"] ` < / pre >
< p > Note that < code > | json servers < / code > is same as < code > | json servers = "servers" < / code > < / p >
< / div >
< / div >
< / div >
<!-- logfmt -- >
< div class = "introduce-view__content" >
< h2 id = "logfmt" > logfmt < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
< p > The < b > logfmt < / b > parser can be added using the < code > | logfmt < / code > and will extract all keys and values from the logfmt formatted log line . < / p >
< p > For example the following log line : < / p >
< pre > at = info method = GET path = / h o s t = g r a f a n a . n e t f w d = " 1 2 4 . 1 3 3 . 1 2 4 . 1 6 1 " s e r v i c e = 8 m s s t a t u s = 2 0 0 < / p r e >
< p > will get those labels extracted : < / p >
< pre > "at" => "info"
"method" => "GET"
"path" => "/"
"host" => "grafana.net"
"fwd" => "124.133.124.161"
"service" => "8ms"
"status" => "200" < / pre >
< / div >
< / div >
<!-- Pattern -- >
< div class = "introduce-view__content" >
< h2 id = "pattern" > Pattern < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
< p > The pattern parser allows the explicit extraction of fields from log lines by defining a pattern expression ( < code > | pattern "<pattern-expression>" < / code > ) . The expression matches the structure of a log line . < / p >
< p > Consider this NGINX log line . < / p >
< p > < code class = "fillbox" > 0.191 .12 .2 - - [ 10 / Jun / 2021 : 09 : 14 : 29 + 0000 ] "GET /api/plugins/versioncheck HTTP/1.1" 200 2 "-" "Go-http-client/2.0" "13.76.247.102, 34.120.177.193" "TLSv1.2" "US" ""
< / code > < / p >
< p > This log line can be parsed with the expression < / p >
< p > < code > & lt ; ip & gt ; - - & lt ; _ & gt ; "<method> <uri> <_>" & lt ; status & gt ; & lt ; size & gt ; & lt ; _ & gt ; "<agent>" & lt ; _ & gt ; < / code > < / p >
< p > to extract these fields : < / p >
< pre > "ip" => "0.191.12.2"
"method" => "GET"
"uri" => "/api/plugins/versioncheck"
"status" => "200"
"size" => "2"
"agent" => "Go-http-client/2.0" < / pre >
< p > A pattern expression is composed of captures and literals . < / p >
< p > A capture is a field name delimited by the < code > & lt ; < / code > and < code > & gt ; < / code > characters . < code > & lt ; example & gt ; < / code > defines the field name < code > example < / code > . An unnamed capture appears as < code > & lt ; _ & gt ; < / code > . < br / > The unnamed capture skips matched content . < / p >
< p > Captures are matched from the line beginning or the previous set of literals , to the line end or the next set of literals . If a capture is not matched , the pattern parser will stop . < / p >
< p > Literals can be any sequence of UTF - 8 characters , including whitespace characters . < / p >
< p > By default , a pattern expression is anchored at the start of the log line . If the expression starts with literals , then the log line must also start with the same set of literals . Use < code > & lt ; _ & gt ; < / code > at the beginning of the expression if you don ’ t want to anchor the expression at the start . < / p >
< p > Consider the log line < / p >
< pre > level = debug ts = 2021 - 06 - 10 T09 : 24 : 13.472094048 Z caller = logging . go : 66 traceID = 0568 b66ad2d9294c msg = "POST /loki/api/v1/push (204) 16.652862ms" < / pre >
< p > To match < code > msg = " < / code > , use the expression : < / p >
< pre > & lt ; _ & gt ; msg = "<method> <path> (<status>) <latency>" < / pre >
< p > A pattern expression is invalid if < / p >
< ul >
< li > It does not contain any named capture . < / li >
< li > It contains two consecutive captures not separated by whitespace characters . < / li >
< / ul >
< / div >
< / div >
<!-- Regular expression -- >
< div class = "introduce-view__content" >
< h2 id = "regexp" > Regular expression < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
< p > Unlike the logfmt and json , which extract implicitly all values and takes no parameters , the regexp parser takes a single parameter < code > | regexp "<re>" < / code > which is the regular expression using the Golang RE2 syntax . < / p >
< p > The regular expression must contain a least one named sub - match ( e . g < code > ( ? P & lt ; name & gt ; re ) < / code > ) , each sub - match will extract a different label . < / p >
< p > For example the parser | regexp "(?P<method>\\w+) (?P<path>[\\w|/]+) \\((?P<status>\\d+?)\\) (?P<duration>.*)" will extract from the following line : < / p >
< pre > POST / api / prom / api / v1 / query _range ( 200 ) 1.5 s < / pre >
< p > those labels : < / p >
< pre > "method" => "POST"
"path" => "/api/prom/api/v1/query_range"
"status" => "200"
"duration" => "1.5s" < / pre >
< / div >
< / div >
<!-- unpack -- >
< div class = "introduce-view__content" >
< h2 id = "unpack" > unpack < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
< p > The < code > unpack < / code > parser parses a JSON log line , unpacking all embedded labels from Promtail ’ s < code > pack < / code > stage . < b > A special property < code > _entry < / code > will also be used to replace the original log line < / b > . < / p >
< p > For example , using < code > | unpack < / code > with the log line : < / p >
< pre > {
"container" : "myapp" ,
"pod" : "pod-3223f" ,
"_entry" : "original log message"
} < / pre >
< p > extracts the < code > container < / code > and < code > pod < / code > labels ; it sets < code > original log message < / code > as the new log line . < / p >
< p > You can combine the < code > unpack < / code > and < code > json < / code > parsers ( or any other parsers ) if the original embedded log line is of a specific format . < / p >
< / div >
< / div >
<!-- Line format expression -- >
< div class = "introduce-view__content" >
< h2 id = "line-format-expressions" > Line format expression < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
< p v-pre > The line format expression can rewrite the log line content by using the text / template format. It takes a single string parameter < code > | line _format "{{.label_name}}" < / code > , which is the template format . All labels are injected variables into the template and are available to use with the < code > { { . label _name } } < / code > notation . < / p >
< p > For example the following expression : < / p >
< pre v-pre > { container = "frontend" } | logfmt | line_format " {{ .query }} {{ .duration }} " < / pre >
< p > Will extract and rewrite the log line to only contains the query and the duration of a request . < / p >
< p v-pre > You can use double quoted string for the template or backticks < code > ` {{.label_name}} ` < / code > to avoid the need to escape special characters . < / p >
< p > < code > line _format < / code > also supports < code > math < / code > functions . Example : < / p >
< p > If we have the following labels < code > ip = 1.1 .1 .1 < / code > , < code > status = 200 < / code > and < code > duration = 3000 ( ms ) < / code > , we can divide the duration by < code > 1000 < / code > to get the value in seconds . < / p >
< pre v-pre > { container = "frontend" } | logfmt | line_format " {{ .ip }} {{ .status }} {{ div .duration 1000 }} " < / pre >
< p > The above query will give us the < code > line < / code > as < code > 1.1 .1 .1 200 3 < / code > < / p >
< p > See template functions to learn about available functions in the template format . < / p >
< / div >
< / div >
<!-- Labels format expression -- >
< div class = "introduce-view__content" >
< h2 id = "label-format-expressions" > Labels format expression < / h2 >
< div class = "introduce-view__content-label" >
< p > The < code > | label _format < / code > expression can rename , modify or add labels . It takes as parameter a comma separated list of equality operations , enabling multiple operations at once . < / p >
< p > When both side are label identifiers , for example < code > dst = src < / code > , the operation will rename the < code > src < / code > label into < code > dst < / code > . < / p >
< p > The right side can alternatively be a template string ( double quoted or backtick ) , for example dst = "<code v-pre>{{.status}} {{.query}}</code>" , in which case the < code > dst < / code > label value is replaced by the result of the text / template evaluation . This is the same template engine as the < code > | line _format < / code > expression , which means labels are available as variables and you can use the same list of functions . < / p >
< p > In both cases , if the destination label doesn ’ t exist , then a new one is created . < / p >
< p > The renaming form < code > dst = src < / code > will drop the < code > src < / code > label after remapping it to the < code > dst < / code > label . However , the template form will preserve the referenced labels , such that < code v-pre > dst = "{{.src}}" < / code > results in both < code > dst < / code > and < code > src < / code > having the same value . < / p >
< pre > A single label name can only appear once per expression . This means < code > | label _format foo = bar , foo = "new" < / code > is not allowed but you can use two expressions for the desired effect : < code > | label _format foo = bar | label _format foo = "new" < / code > < / pre >
< / div >
< / div >
<!-- Log queries examples -- >
< h1 class = "page-header-two" id = "log-queries-examples" > Log queries examples < / h1 >
<!-- Multiple filtering -- >
< div class = "introduce-view__content" >
< h2 id = "multiple-filtering" > Multiple filtering < / h2 >
< div class = "introduce-view__content-label" >
< p > Filtering should be done first using label matchers , then line filters ( when possible ) and finally using label filters . The following query demonstrate this . < / p >
< p > < code v-pre class = "fillbox" > { cluster = "ops-tools1" , namespace = "loki-dev" , job = "loki-dev/query-frontend" } |= "metrics.go" != "out of order" | logfmt | duration > 30 s or status _code != "200" < / code > < / p >
< / div >
< / div >
<!-- Multiple parsers -- >
< div class = "introduce-view__content" >
< h2 id = "multiple-parsers" > Multiple parsers < / h2 >
< div class = "introduce-view__content-label" >
< p > To extract the method and the path of the following logfmt log line : < / p >
< p > < code v-pre class = "fillbox" > level = debug ts = 2020 - 10 - 02 T10 : 10 : 42.092268913 Z caller = logging . go : 66 traceID = a9d4d8a928d8db1 msg = "POST /api/prom/api/v1/query_range (200) 1.5s" < / code > < / p >
< p > You can use multiple parsers ( logfmt and regexp ) like this . < / p >
< p > < code v-pre class = "fillbox" > { job = "loki-ops/query-frontend" } | logfmt | line _format "{{.msg}}" | regexp "(?P<method>\\w+) (?P<path>[\\w|/]+) \\((?P<status>\\d+?)\\) (?P<duration>.*)" < / code > < / p >
< p > This is possible because the < code > | line _format < / code > reformats the log line to become < code > POST / api / prom / api / v1 / query _range ( 200 ) 1.5 s < / code > which can then be parsed with the < code > | regexp ... < / code > parser . < / p >
< / div >
< / div >
<!-- Formatting -- >
< div class = "introduce-view__content" >
< h2 id = "formatting" > Formatting < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
< p > The following query shows how you can reformat a log line to make it easier to read on screen . < / p >
< pre v-pre > { cluster = "ops-tools1" , name = "querier" , namespace = "loki-dev" }
|= "metrics.go" != "loki-canary"
| logfmt
| query != ""
| label _format query = "{{ Replace .query \" & # 92 ; & # 92 ; n & # 92 ; " \" & # 92 ; " -1 }}"
| line _format "{{ .ts}}\t{{.duration}}\ttraceID = {{.traceID}}\t{{ printf \" % - 100.100 s & # 92 ; " .query }} " < / pre >
< p > Label formatting is used to sanitize the query while the line format reduce the amount of information and creates a tabular output . < / p >
< p > For these given log lines : < / p >
< pre > level = info ts = 2020 - 10 - 23 T20 : 32 : 18.094668233 Z caller = metrics . go : 81 org _id = 29 traceID = 1980 d41501b57b68 latency = fast query = "{cluster=\"ops-tools1\", job=\"loki-ops/query-frontend\"} |= \"query_range\"" query _type = filter range _type = range length = 15 m0s step = 7 s duration = 650.22401 ms status = 200 throughput _mb = 1.529717 total _bytes _mb = 0.994659
level = info ts = 2020 - 10 - 23 T20 : 32 : 18.068866235 Z caller = metrics . go : 81 org _id = 29 traceID = 1980 d41501b57b68 latency = fast query = "{cluster=\"ops-tools1\", job=\"loki-ops/query-frontend\"} |= \"query_range\"" query _type = filter range _type = range length = 15 m0s step = 7 s duration = 624.008132 ms status = 200 throughput _mb = 0.693449 total _bytes _mb = 0.432718 < / pre >
< p > The result would be : < / p >
< pre > 2020 - 10 - 23 T20 : 32 : 18.094668233 Z 650.22401 ms traceID = 1980 d41501b57b68 { cluster = "ops-tools1" , job = "loki-ops/query-frontend" } |= "query_range"
2020 - 10 - 23 T20 : 32 : 18.068866235 Z 624.008132 ms traceID = 1980 d41501b57b68 { cluster = "ops-tools1" , job = "loki-ops/query-frontend" } |= "query_range" < / pre >
< / div >
< / div >
<!-- Metric queries -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-one" id = "metric-queries" > Metric queries < / h1 >
< div class = "introduce-view__content-label" >
< p > Metric queries extend log queries by applying a function to log query results . This powerful feature creates metrics from logs . < / p >
< p > Metric queries can be used to calculate the rate of error messages or the top N log sources with the greatest quantity of logs over the last 3 hours . < / p >
< p > Combined with parsers , metric queries can also be used to calculate metrics from a sample value within the log line , such as latency or request size . All labels , including extracted ones , will be available for aggregations and generation of new series . < / p >
< / div >
< / div >
<!-- Range Vector aggregation -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "range-vector-aggregation" > Range Vector aggregation < / h1 >
< div class = "introduce-view__content-label" >
< p > LogQL shares the range vector concept of Prometheus . In Grafana Loki , the selected range of samples is a range of selected log or label values . < / p >
< p > The aggregation is applied over a time duration . Loki defines Time Durations with the same syntax as Prometheus . < / p >
< p > Loki supports two types of range vector aggregations : log range aggregations and unwrapped range aggregations . < / p >
< / div >
< / div >
<!-- Log range aggregations -- >
< div class = "introduce-view__content" >
< h2 id = "log-range-aggregations" > Log range aggregations < / h2 >
< div class = "introduce-view__content-label" >
< p > A log range aggregation is a query followed by a duration . A function is applied to aggregate the query over the duration . The duration can be placed after the log stream selector or at end of the log pipeline . < / p >
< p > The functions : < / p >
< ul >
< li > < code > rate ( log - range ) < / code > : calculates the number of entries per second < / li >
< li > < code > count _over _time ( log - range ) < / code > : counts the entries for each log stream within the given range . < / li >
< li > < code > bytes _rate ( log - range ) < / code > : calculates the number of bytes per second for each stream . < / li >
< li > < code > bytes _over _time ( log - range ) < / code > : counts the amount of bytes used by each log stream for a given range . < / li >
< li > < code > absent _over _time ( log - range ) < / code > : returns an empty vector if the range vector passed to it has any elements and a 1 - element vector with the value 1 if the range vector passed to it has no elements . ( < code > absent _over _time < / code > is useful for alerting on when no time series and logs stream exist for label combination for a certain amount of time . ) < / li >
< / ul >
< p > Examples : < / p >
< ul >
< li >
< p > Count all the log lines within the last five minutes for the MySQL job . < / p >
< p > < code class = "fillbox" > count _over _time ( { job = "mysql" } [ 5 m ] ) < / code > < / p >
< / li >
< li >
< p > This aggregation includes filters and parsers . It returns the per - second rate of all non - timeout errors within the last minutes per host for the MySQL job and only includes errors whose duration is above ten seconds . < / p >
< p > < code class = "fillbox" > sum by ( host ) ( rate ( { job = "mysql" } |= "error" != "timeout" | json | duration > 10 s [ 1 m ] ) ) < / code > < / p >
< / li >
< / ul >
< / div >
< / div >
<!-- Unwrapped range aggregations -- >
< div class = "introduce-view__content" >
< h2 id = "unwrapped-range-aggregations" > Unwrapped range aggregations < / h2 >
< div class = "introduce-view__content-label" >
< p > Unwrapped ranges uses extracted labels as sample values instead of log lines . However to select which label will be used within the aggregation , the log query must end with an unwrap expression and optionally a label filter expression to discard errors . < / p >
< p > The unwrap expression is noted < code > | unwrap label _identifier < / code > where the label identifier is the label name to use for extracting sample values . < / p >
< p > Since label values are string , by default a conversion into a float ( 64 bits ) will be attempted , in case of failure the < code > _ _error _ _ < / code > label is added to the sample . Optionally the label identifier can be wrapped by a conversion function < code > | unwrap & lt ; function & gt ; ( label _identifier ) < / code > , which will attempt to convert the label value from a specific format . < / p >
< p > We currently support the functions : < / p >
< ul >
< li > < code > duration _seconds ( label _identifier ) < / code > ( or its short equivalent < code > duration < / code > ) which will convert the label value in seconds from the go duration format ( e . g < code > 5 m < / code > , < code > 24 s30ms < / code > ) . < / li >
< li > < code > bytes ( label _identifier ) < / code > which will convert the label value to raw bytes applying the bytes unit ( e . g . < code > 5 MiB < / code > , < code > 3 k < / code > , < code > 1 G < / code > ) . < / li >
< / ul >
< p > Supported function for operating over unwrapped ranges are : < / p >
< ul >
< li > < code > rate ( unwrapped - range ) < / code > : calculates per second rate of the sum of all values in the specified interval . < / li >
< li > < code > rate _counter ( unwrapped - range ) < / code > : calculates per second rate of the values in the specified interval and treating them as “ counter metric ” < / li >
< li > < code > sum _over _time ( unwrapped - range ) < / code > : the sum of all values in the specified interval . < / li >
< li > < code > avg _over _time ( unwrapped - range ) < / code > : the average value of all points in the specified interval . < / li >
< li > < code > max _over _time ( unwrapped - range ) < / code > : the maximum value of all points in the specified interval . < / li >
< li > < code > min _over _time ( unwrapped - range ) < / code > : the minimum value of all points in the specified interval < / li >
< li > < code > first _over _time ( unwrapped - range ) < / code > : the first value of all points in the specified interval < / li >
< li > < code > last _over _time ( unwrapped - range ) < / code > : the last value of all points in the specified interval < / li >
< li > < code > stdvar _over _time ( unwrapped - range ) < / code > : the population standard variance of the values in the specified interval . < / li >
< li > < code > stddev _over _time ( unwrapped - range ) < / code > : the population standard deviation of the values in the specified interval . < / li >
< li > < code > quantile _over _time ( scalar , unwrapped - range ) < / code > : the φ - quantile ( 0 ≤ φ ≤ 1 ) of the values in the specified interval . < / li >
< li > < code > absent _over _time ( unwrapped - range ) < / code > : returns an empty vector if the range vector passed to it has any elements and a 1 - element vector with the value 1 if the range vector passed to it has no elements . ( < code > absent _over _time < / code > is useful for alerting on when no time series and logs stream exist for label combination for a certain amount of time . ) < / li >
< / ul >
< p > Except for < code > sum _over _time < / code > , < code > absent _over _time < / code > and < code > rate < / code > , unwrapped range aggregations support grouping . < / p >
< p > < code class = "fillbox" > & lt ; aggr - op & gt ; ( [ parameter , ] & lt ; unwrapped - range & gt ; ) [ without | by ( & lt ; label list & gt ; ) ] < / code > < / p >
< p > Which can be used to aggregate over distinct labels dimensions by including a < code > without < / code > or < code > by < / code > clause . < / p >
< p > < code > without < / code > removes the listed labels from the result vector , while all other labels are preserved the output . < code > by < / code > does the opposite and drops labels that are not listed in the < code > by < / code > clause , even if their label values are identical between all elements of the vector . < / p >
< / div >
< / div >
<!-- Unwrapped examples -- >
< div class = "introduce-view__content" >
< h2 id = "unwrapped-examples" > Unwrapped examples < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
< pre > quantile _over _time ( 0.99 ,
{ cluster = "ops-tools1" , container = "ingress-nginx" }
| json
| _ _error _ _ = ""
| unwrap request _time [ 1 m ] ) by ( path ) < / pre >
< p > This example calculates the p99 of the nginx - ingress latency by path . < / p >
< pre > sum by ( org _id ) (
sum _over _time (
{ cluster = "ops-tools1" , container = "loki-dev" }
|= "metrics.go"
| logfmt
| unwrap bytes _processed [ 1 m ] )
) < / pre >
< p > This calculates the amount of bytes processed per organization ID . < / p >
< / div >
< / div >
<!-- Built - in aggregation operators -- >
< div class = "introduce-view__content" >
< h1 class = "page-header-two" id = "built-in-aggregation-operators" > Built - in aggregation operators < / h1 >
< div class = "introduce-view__content-label" >
< p > Like PromQL , LogQL supports a subset of built - in aggregation operators that can be used to aggregate the element of a single vector , resulting in a new vector of fewer elements but with aggregated values : < / p >
< ul >
< li > < code > sum < / code > : Calculate sum over labels < / li >
< li > < code > avg < / code > : Calculate the average over labels < / li >
< li > < code > min < / code > : Select minimum over labels < / li >
< li > < code > max < / code > : Select maximum over labels < / li >
< li > < code > stddev < / code > : Calculate the population standard deviation over labels < / li >
< li > < code > stdvar < / code > : Calculate the population standard variance over labels < / li >
< li > < code > count < / code > : Count number of elements in the vector < / li >
< li > < code > topk < / code > : Select largest k elements by sample value < / li >
< li > < code > bottomk < / code > : Select smallest k elements by sample value < / li >
< / ul >
< p > The aggregation operators can either be used to aggregate over all label values or a set of distinct label values by including a < code > without < / code > or a < code > by < / code > clause : < / p >
< p > < code class = "fillbox" > & lt ; aggr - op & gt ; ( [ parameter , ] & lt ; vector expression & gt ; ) [ without | by ( & lt ; label list & gt ; ) ] < / code > < / p >
< p > < code > parameter < / code > is required when using < code > topk < / code > and < code > bottomk < / code > . < code > topk < / code > and < code > bottomk < / code > are different from other aggregators in that a subset of the input samples , including the original labels , are returned in the result vector . < / p >
< p > < code > by < / code > and < code > without < / code > are only used to group the input vector . The < code > without < / code > clause removes the listed labels from the resulting vector , keeping all others . The < code > by < / code > clause does the opposite , dropping labels that are not listed in the clause , even if their label values are identical between all elements of the vector . < / p >
< / div >
< / div >
<!-- Vector aggregation examples -- >
< div class = "introduce-view__content" >
< h2 id = "vector-aggregation-examples" > Vector aggregation examples < / h2 >
< div class = "introduce-view__content-label" >
< p > Get the top 10 applications by the highest log throughput : < / p >
< p > < code class = "fillbox" > topk ( 10 , sum ( rate ( { region = "us-east1" } [ 5 m ] ) ) by ( name ) ) < / code > < / p >
< p > Get the count of log lines for the last five minutes for a specified job , grouping by level : < / p >
< p > < code class = "fillbox" > sum ( count _over _time ( { job = "mysql" } [ 5 m ] ) ) by ( level ) < / code > < / p >
< p > Get the rate of HTTP GET requests to the < code > / home < / code > endpoint for NGINX logs by region : < / p >
< p > < code class = "fillbox" > avg ( rate ( ( { job = "nginx" } |= "GET" | json | path = "/home" ) [ 10 s ] ) ) by ( region ) < / code > < / p >
< / div >
< / div >
< / div >
2022-09-27 14:49:45 +08:00
< / div >
2022-10-24 16:11:36 +08:00
<!-- 中文 -- >
< div class = "info-room title-heard" v-else >
2022-09-27 14:49:45 +08:00
< div class = "col-md-9 logs-content" >
<!-- LogQL : Log query language -- >
2022-10-24 16:11:36 +08:00
< h1 class = "page-header" style = "margin-Top:0px" id = "log-query-language" > LogQL ： 日志查询语言 < a class = "header-anchor" href = "https://grafana.com/docs/loki/latest/logql/" rel = "noopener noreferrer" target = "_blank" > < i class = "nz-icon nz-icon-link1" style = "font-size: 16px;" :title = "$t('overall.link')" > < / i > < / a > < / h1 >
2022-09-27 14:49:45 +08:00
< div class = "title-heard__divider" > < / div >
<!-- catalog 目录 -- >
< div class = "catalog" >
2022-09-27 11:18:55 +08:00
< ul class = "catalog-square" >
< li >
2022-10-25 14:47:47 +08:00
< div @click ="jumpClick('#log-queries')" > < span > 日志查询 < / span > < / div >
2022-09-27 11:18:55 +08:00
< ul class = "catalog-disc" >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#log-stream-selector')" > < span > 日志流选择器 < / span > < / li >
2022-09-27 11:18:55 +08:00
< li >
2022-10-25 14:47:47 +08:00
< div @click ="jumpClick('#log-pipeline')" > < span > 日志管道 < / span > < / div >
2022-09-27 11:18:55 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#line-filter-expressions')" > < span > 行过滤表达式 < / span > < / li >
< li @click ="jumpClick('#label-filter-expressions')" > < span > 标签过滤表达式 < / span > < / li >
< li @click ="jumpClick('#parsing-expressions')" > < span > 解析器表达式 < / span > < / li >
2022-09-27 14:49:45 +08:00
< li @click ="jumpClick('#JSON')" > < span > JSON < / span > < / li >
< li @click ="jumpClick('#logfmt')" > < span > logfmt < / span > < / li >
< li @click ="jumpClick('#pattern')" > < span > Pattern < / span > < / li >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#regexp')" > < span > 正则表达式 < / span > < / li >
2022-09-27 14:49:45 +08:00
< li @click ="jumpClick('#unpack')" > < span > unpack < / span > < / li >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#line-format-expressions')" > < span > 行格式化表达式 < / span > < / li >
< li @click ="jumpClick('#label-format-expressions')" > < span > 标签格式化表达式 < / span > < / li >
2022-09-27 14:49:45 +08:00
< / ul >
2022-09-27 11:18:55 +08:00
< / li >
2022-09-27 14:49:45 +08:00
< li >
2022-10-25 14:47:47 +08:00
< div @click ="jumpClick('#log-queries-examples')" > < span > 日志查询示例 < / span > < / div >
2022-09-27 11:18:55 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#multiple-filtering')" > < span > 多个过滤阶段 < / span > < / li >
< li @click ="jumpClick('#multiple-parsers')" > < span > 使用多个解析器 < / span > < / li >
< li @click ="jumpClick('#formatting')" > < span > 日志行格式化 < / span > < / li >
2022-09-27 11:18:55 +08:00
< / ul >
< / li >
< / ul >
< / li >
< li >
2022-10-25 14:47:47 +08:00
< div @click ="jumpClick('#metric-queries')" > < span > 度量查询 < / span > < / div >
2022-09-27 14:49:45 +08:00
< ul >
< li style = "list-style:disc;" >
2022-10-25 14:47:47 +08:00
< div @click ="jumpClick('#range-vector-aggregation')" > < span > 范围向量聚合 < / span > < / div >
2022-09-27 14:49:45 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li @click ="jumpClick('#log-range-aggregations')" > < span > 日志范围聚合 < / span > < / li >
< li @click ="jumpClick('#unwrapped-range-aggregations')" > < span > 展开范围聚合 < / span > < / li >
< li @click ="jumpClick('#unwrapped-examples')" > < span > 展开 < / span > < / li >
2022-09-27 11:18:55 +08:00
< / ul >
< / li >
2022-09-27 14:49:45 +08:00
< li style = "list-style:disc;" >
2022-10-25 14:47:47 +08:00
< div @click ="jumpClick('#built-in-aggregation-operators')" > < span > 内置聚合运算符 < / span > < / div >
< ul > < li @click ="jumpClick('#vector-aggregation-examples')" > < span > 向量聚合 < / span > < / li > < / ul >
2022-09-27 11:18:55 +08:00
< / li >
< / ul >
< / li >
< / ul >
2022-09-27 14:49:45 +08:00
< / div >
< div class = "page-header-label" >
2022-10-25 14:47:47 +08:00
< p > LogQL 是 Grafana Loki 的 、 受 PromQL 启发的查询语言 。 查询动作就像是通过分布式 grep 来聚合日志源 。 LogQL 使用标签和运算符进行过滤 。 < / p >
< p > LogQL 查询分为两类 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < b style = "color: #3C92F1" @click ="jumpClick('#log-queries')" class = "log-link" > 日志查询 < / b > 返回日志行的内容 < / li >
< li > < b style = "color: #3C92F1" @click ="jumpClick('#metric-queries')" class = "log-link" > 度量查询 < / b > 延展日志查询 ， 基于查询结果计算 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
< / div >
<!-- Log queries -- >
<!-- start -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header-one" id = "log-queries" > 日志查询 < / h1 >
< p > 所有LogQL查询都含有一个 < b > 日志流选择器 < / b > 。 < / p >
2022-09-01 11:06:16 +08:00
< div class = "img-hidden" > < img src = " data : image / png ; base64 , iVBORw0KGgoAAAANSUhEUgAAAkYAAAIPCAYAAACWihHIAABZK0lEQVR4XuzdC7ylU / 3H8Z9b5JJE7pdBSDepSAmDoitdpFBModCFVFL / MhJKiopIxSil + 82llDLjTq6JEJlBuadE7tX / 953fWmevvc6zz + wzc2Zm77M / 79fr9zJ7Pes8 + 9n7nP / / + bbWep7HDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHNiHa9V60aMudW81q4b55GVvNarGwEAQDudMB / zus9rwWrb / HSJ17F1Y + UlXtO9Xl1v6EGLeP3D61Gv5attY0371 / fynqLtb15PeE0o2gAAGGjXeh1RtS3m9Suvk6v2 + U0n8h / UjZVXeP3P6831hh71Ha8zvJ5SbxhjK1t8Lx8p2r7mdbbXkkUbAAAD7V9e36wbe9R4DEbzSlMwAgCgby3ktZ3Xoam2T221g7wmei1qMW3yea8DvNYs + sgWXpMtpnGuSP / evdj + Aa + ditfZM7z2thhl + rjXBu2bZ3q2xf5W8HqWRT8dxySL42qiKbAPeR3l9VFrXvsyp8FoQ69PWBz7Xl5Pb9 / cZiOvT1kc9w6pbRevPYd6NNPoiz77i72e5vV + i33sbzFFWdvV4vvMyu9uDa + PWfz8Hl6LF / 1q23od5nWk1zstRv1KTcFoR6 / 9itf6G9F7r27x3gfarN97GYvv8ksW3 + 0m7ZsBABh7OqEqvOjEpnCg0r + vtDjhlf7j9VmvCy1Gg6Z7PWyxlqQ8qX8wbVP / 3O + nxfabvE4vXotOvg9Y7Ev9tT5Gx3GMta9FemNq13vovWd43ZvaLrX2cKRwd1Ladr / XVRb7fdJrt6KfzG4w0rEdn9q1bx27PsM / vV5Z9JMFrNVX29VX6610jJpevKzVtdGKFj + rMPona73f4xbfhb6b0m + 9rile5 + / uHRbvf5fXrantdq / ntLrOpMDyC4vt6jsj / fsvFqE0awpGP7Hon21l0UchTn8Tt3ndndr + aMOn3F5qsT3 / PWhNmvpqBFLfIwAAY04nmN95Pei1TdGuE7pCyrmpT6ag84jF2pV8IlvO4qSuE5hGTUqdptLqYLSGRd / fW1xJJVo8 / BmLk2E58pBP7jqR5 / dTONFIl9rLERKNmKhNIw45MD3V63yLz6d / Z7MbjHSiV9shFscsGhVRyNF75M8jCo / qq5GrfDy6Ok99NbrWbTDS76D8TNqHQuFDFt9l1ikYqd + 7inaNYCn4XGetzyBajK730mhWpu9c35WCc / 7bGE0wUth5edGuUSu1awQp00jRnRaBfa3UtrBFH / XdJ7UBADCm9L / KdaLRyb2m6S5t27RoUzC6x4ZPfSgc / dtrStXebTDSlIqCVdOl5VMtTsR51Cif3Pcd6hF04tQoyKlV + wts + NVvkyz28cKibXaCkUakdAI / Z6hHi0ZUNDKlEbZMozwatapHPNb3 + q91H4xusOGfaR2L34 + mvLJOwejbRVumUSRte0N6vazFSNSnh3q07GzRNwec0QQjTSGW9F3ou9ci8ezD1vmKNv09aFE / AABjTus2dLJapd5gsQ5F27SuKNOJtw4e2Vlet1Rt3Qajyy0ul2 + iESAdx3PT63xy14m2dr3F6FUTjUK8zGLtyy8t9rFZsX12gtHz0 + v3DvVopxEwlShoqO / k1uY2CjvdBqMv1BsShaALitedglFe11RayuL3m / f9Jou + r7MIKGXpe9Q2hWcZTTDSfmv63Wt6NtPvR8c9oaG + bBEiy9E + AADGhE4y + l / mnWga5avFa504NQ3U5ESLKZpSt8FI02KdQolOzDqhbp1e55P75kM9WjQio4CWaVpIwW66xc + oNLKlADUWwehV6fVrhnq0 + 5HFGh7Rwmf17RSipln3wagMICWFwj8XrzsFI32OJlqzlEeTciAdqXJoHk0wen3Rll3sdVHxWtN09XvV1bTYHACAOZLX5SxRb7BYv6L / Zf65ok3B6BvF65JCwB1VW7fBSIGm00iPrl7TMWodjIwmGH3Rou / JFlNEWvsjeTRkToNRnop821CPdr + 21rSP1hqpr0bpmmgBcrfBqGl6SzTqotG3rFMwagpymhbU1JnWFck7Lfpua8NHbXI93cJYB6NzLcLRhBGq6apJAADmyFstTlYalalpMba2aT1JpmCkBbo1re9RsPhN1a5gpJGkWh2Mvm9x1VjT9MgJFguTdXm6jCYYafREJ9mabjUwFsFIwUDHdvxQjxZ9lnLN0wIWwVEhoDbB4rvtNhidXW + wmArTlWknF22dgpEWtdfyZ9Pl8aL1V3o9KXcYwVgHI41S6m + nvi0AAABzlUaKdDWSFgSXo0ZaXK2TtK4g0gk308lbJ7fdijbJVwtplKGkfddhSepglENYOTolugIqXwWXjSYYafREIzbl6II + j8LCWAQjUfBRICkXcssRFn3LS / a1qFhtWpCtETnR + i6N9ChgdRuMNJJXXkUomhbVtjzlKJ2CkS59n1C061jOs7g6cfmiXaM2Wjem9y0dbBF61k2vxzoYbWzxt6bPVNLvTsH8u1U7AABj5tUW4WO6xcLbIy3uU6O2eiRJJ6vTLE6smjqbbDEFphOerirSqEhJ02japlEbXc6e1cFIjrHoO81iqkg / q / VAN1r7yXo0wWhPi7468epYFVZuTa / VPhbBSKFBn0fHqmPW59TnVb + ji36iK8lOStu0Hkvfub7Tr1kEk26D0Q8tRlS + ZfFd6WfVXk9bdgpGp1jc + + krFmFUa64UtnSzxZKu6FM / lUZxyt / 3j232LtfvJhiJ3kv9L7WY8tWViwppmu7TtCgAAHONRjv0v8J1gr / ZYhSkHgERncS / ZHHn5XMsTuwabdKIkRY61zQVomkbnfB1Ms80AnR48TrbxeJybO33DxYn7byOJVM4UR + dtGsnW5xAS5Msrgy7zSIk6EoqhSrt4 / mtbjNP9DoZj0T99XN1KHuGxftq / zp2fTdvb + vRTuul9J3p / XJQGE0wOsAiaGikSe + nz6d7 + 9TBVGusyqnMHIy2sAiNWtekn9fUXNO6I1nDYl3ZDRZ9FWLeZ + 2jcLriTt9LudZKAVFTpNmLLProiraaQlde21TSWjAdm95Xpf3ltWYAAMx3ORhh9jWtoxKN2jSthyqVwWh2lMEIAADMIYLRnHmvxQ0hNXpS2tUisBxWtdcIRgAA9BCC0ZxZ3 + KeTbp31PkWdwq / 2iKsaI1NudC9CcEIAIAecpDFYm3MPt12QGt0tI5Li6N1OwLdq6mb + / IsabEuadN6Q5d0k0n9 / Br1BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB9aUGvG70WqDcAAAAMmqUtnmq / RL0BAABg0KzodYnFyBEAAAAAAAAAAACAIS / w2sbrd / UGAACAQbKY1 / 1eq6X / Lt + + GQAAYHDs4PXb9O + ve32y2AYAADBQLvB6S / r3 + l4 / L7YBAAAMjEW8DjMu0wcAAAAAAIAsWzcUVvD6jdfT6g0AAADjjRZcX + e1UL2hcIzXmRbTbQAAAOPS1l53e21Qb6gs7PUTi8XYIwUoAACAvrS6111em9YbOlA42rVuBAAAGC / 0wNjZpWAFAADQt / Soj13qxtmg6bQ / eP3Ma71qGwAAQM / Sgukdvc7zut7rde2bZ9tTvA6wmI47utoGAAAw3 + nmjBO8NvNaILUt4XWGxR2ttU5orOn5auXi7c29PmBxDBOMxdoAAAw50WLK5W9e / / N6YbHt6tSWS091z66ptj2v2HZtte05xTZddl5u02MtMo2WlNvKKaAbq23rFNtuqratXWy7udq2VrHtlmrbhGLbjGpbuV7ntmrbqsW226ttqxTb9B0 / 4TXd63yvZYpt85IC0bEWjxfRsXyk2PY5az / + jxbbjqi2lT93ZLVt / 2LbF6tt + xXbNJJVbvtgse1L1TaFuewr1
2022-10-25 14:47:47 +08:00
< p > 日志流选择器后的 < b > 日志管道 < / b > 是可选的 。 日志管道由一组阶段表达式连接而成 ， 应用于所选的日志流 。 每个表达式都可以过滤 、 解析和改变日志行内容以及各自的标签 。 < / p >
< p > 以下示例展示了一个完整的日志查询操作 ： < / p >
< p > < code class = "fillbox" > { container = "query-frontend" , namespace = "loki-dev" } |= "metrics.go" | logfmt | duration > 10 s and throughput _mb & lt ; 500 < / code > < / p >
< p > 该查询的组成部分为 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > 一个日志流选择器 < code > { container = "query-frontend" , namespace = "loki-dev" } < / code > ， 用于过滤 < code > loki - dev < / code > 命名空间里的 < code > query - frontend < / code > 容器的日志 。 < / li >
< li > 一个日志管道 < code > |= "metrics.go" | logfmt | duration > 10 s and throughput _mb < 500 < / code > ， 会过滤出含有词 < code > metrics . go < / code > 的日志 ， 解析每个日志行 ， 以提取更多标签用于过滤 。 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< pre > 为了避免转义特殊字符 ， 在引用字符串时可以使用 < code > ` </code>（反引号），而非 <code> " </code>（双引号）。例如：<code> ` \ w + ` </code> 与 <code>" \\ w+"</code>相同。在写含有多个需要转义的反斜杠的正则表达式时，这一方法尤其有用。</pre>
2022-08-26 13:50:04 +08:00
< / div >
<!-- Log stream selector -- >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header-two" id = "log-stream-selector" > 日志流选择器 < / h1 >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 日志流选择器决定了查询结果包含哪些日志流 。 一条日志流是一个日志内容独特的源 ， 例如一个文件 。 一个更细粒度的日志流选择器能够减少搜索到的流数量 ， 便于管理 。 这意味着传递给日志流选择器的标签将影响查询执行的相关表现 。 < / p >
< p > 日志流选择器由一个或多个逗号分隔的键值对组成 。 键为一个日志标签 ， 值为该标签的值 。 大括号 ( < code > { < / code > 和 < code > } < / code > ) 划定了流选择器的边界 。 < / p >
< p > 以该流选择器为例 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > { app = "mysql" , name = "mysql-backup" } < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 所有既包含值为 < code > mysql < / code > 的 < code > app < / code > 标签 、 又包含值为 < code > mysql - backup < / code > 的 < code > name < / code > 标签的日志流 ， 都会被包含在查询结果之中 。 一条流可能包含其他标签和值对 ， 但只有流选择器指定的对才会用于决定查询结果包含哪些日志流 。 < / p >
< p > 适用于 Prometheus 标签选择器 的规则同样适用于 Grafana Loki 日志流选择器 。 < / p >
< p > 位于标签名后的 < code > = < / code > 运算符为 < b > 标签匹配运算符 < / b > 。 支持以下标签匹配运算符 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < code > = < / code > : 完全匹配 < / li >
< li > < code > != < / code > : 不相等 < / li >
< li > < code > = ~ < / code > : 正则表达式匹配 < / li >
< li > < code > ! ~ < / code > : 正则表达式不匹配 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 正则表达式日志流示例 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
< li > < code > { name = ~ "mysql.+" } < / code > < / li >
< li > < code > { name ! ~ "mysql.+" } < / code > < / li >
< li > < code > { name ! ~ ` mysql- \ d+ ` } < / code > < / li >
< / ul >
2022-10-25 14:47:47 +08:00
< p > < b > 注意 : < / b > 正则表达式运算符 < code > = ~ < / code > 是完全锚定的 ， 意味着正则表达式必须与整个字符串进行匹配 ， 包括新行 < code > 。 < / code > 正则表达式 。 字符默认不匹配新行 ， 如果您想让其匹配新行 ， 您可以使用单行标志 ， 例如 ： < code > ( ? s ) search _term . + < / code > matches < code > search _term \ n < / code > 。 < / p >
2021-08-02 19:51:53 +08:00
< / div >
< / div >
2022-08-26 13:50:04 +08:00
<!-- Log pipeline -- >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header-two" id = "log-pipeline" > 日志管道 < / h1 >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 日志管道可以附加到日志流选择器上 ， 以进一步处理和过滤日志流 。 日志管道由一组表达式组成 。 每个表达式针对每个日志行按从左到右的顺序执行 。 如果表达式过滤处理一个日志行 ， 管道将停止处理当前日志行 ， 并开始处理下一日志行 。 < / p >
< p > 一些表达式可以改变日志内容及关联标签 ， 用于后续表达式的进一步过滤和分析 。 以下示例表达式可以改变 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code v-pre class = "fillbox" > | line _format "{{.status_code}}" < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 日志表达式分为三类 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > 过滤表达式 : < b style = "color: #3C92F1" @click ="jumpClick('#line-filter-expressions')" class = "log-link" > 行过滤表达式 < / b > 和 < b style = "color: #3C92F1" @click ="jumpClick('#label-filter-expressions')" class = "log-link" > 标签过滤表达式 < / b > < / li >
< li > < b style = "color: #3C92F1" @click ="jumpClick('#parsing-expressions')" class = "log-link" > 解析表达式 < / b > < / li >
< li > 格式化表达式 : < b style = "color: #3C92F1" @click ="jumpClick('#line-format-expressions')" class = "log-link" > 行格式化表达式 < / b > 和 < b style = "color: #3C92F1" @click ="jumpClick('#label-format-expressions')" class = "log-link" > 标签格式化表达式 < / b > < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2021-08-02 19:51:53 +08:00
< / div >
< / div >
2022-08-26 13:50:04 +08:00
<!-- Line filter expression -- >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "line-filter-expressions" > 行过滤表达式 < / h2 >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 行过滤表达式对从匹配日志流聚合而来的日志进行分布式 < code > grep < / code > ， 搜索日志行内容 ， 丢弃不匹配区分大小写的表达式的日志行 。 < / p >
< p > 每个行过滤表达式都有 < b > 过滤运算符 < / b > ， 其后为文本或正则表达式 。 支持以下过滤运算符 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < code > |= < / code > : 包含字符串的日志行 < / li >
< li > < code > != < / code > : 不含字符串的日志行 < / li >
< li > < code > | ~ < / code > : 匹配正则表达式的日志行 < / li >
< li > < code > ! ~ < / code > : 不匹配正则表达式的日志行 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 行过滤表达式示例 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
< li >
2022-10-25 14:47:47 +08:00
< p > 保留含有子字符串 “ error ” 的日志行 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > |= "error" < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 使用该示例的完整查询为 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > { job = "mysql" } |= "error" < / code > < / p >
< / li >
< li >
2022-10-25 14:47:47 +08:00
< p > 丢弃含有子字符串 “ kafka . server : type = ReplicaManager ” 的日志行 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > != "kafka.server:type=ReplicaManager" < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 使用该示例的完整查询为 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > { instance = ~ "kafka-[23]" , name = "kafka" } != "kafka.server:type=ReplicaManager" < / code > < / p >
< / li >
< li >
2022-10-25 14:47:47 +08:00
< p > 保留含有以 < code > tsdb - ops < / code > 开头 、 < code > io : 2003 < / code > 结尾的子字符串的日志行 。 带有正则表达式的完整查询为 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > { name = "kafka" } | ~ "tsdb-ops.*io:2003" < / code > < / p >
< / li >
< li >
2022-10-25 14:47:47 +08:00
< p > 保留含有以 < code > error = < / code > 开头 、 且其后有至少一个字符的子字符串的日志行 。 带有正则表达式的完整查询为 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > { name = "cassandra" } | ~ ` error= \ w+ ` < / code > < / p >
< / li >
< / ul >
2022-10-25 14:47:47 +08:00
< p > 过滤运算符可以连接起来使用 。 过滤器按顺序应用 。 查询结果将满足每个过滤器 。 该完整查询示例给出的结果包含字符串 < code > error < / code > ， 且不包含字符串 < code > timeout < / code > 。 < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > { job = "mysql" } |= "error" != "timeout" < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 当使用 < code > | ~ < / code > 和 < code > ! ~ < / code > 时 ， 可能使用 Go （ 即 Golang ） RE2 语法 正则表达式 。 默认情况下 ， 匹配区分大小写 。 将 < code > ( ? i ) < / code > 作为正则表达式前缀 ， 切换匹配为不区分大小写 。 < / p >
< p > 虽然行过滤表达式可以放置在日志管道中任意位置 ， 但最好还是置于开头 。 当某一行匹配时才能做后续处理 ， 从而提升了查询性能 。 例如 ， 虽然结果相同 ， 但下面的查询 < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" v-pre > { job = "mysql" } | = " error " | json | line_format " {{ .err }} " < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 总是比以下查询更快 < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" v-pre > { job = "mysql" } | json | line_format " {{ .message }} " | = " error " < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 一旦应用了日志流选择器 ， 行过滤表达式是过滤日志的最快方法 。 < / p >
< p > 行过滤表达式支持匹配 IP 地址 。 详情参见匹配 IP 地址 。 < / p >
2021-08-02 19:51:53 +08:00
< / div >
< / div >
2022-08-26 13:50:04 +08:00
<!-- Label filter expression -- >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "label-filter-expressions" > 标签过滤表达式 < / h2 >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 标签过滤表达式可以使用原始和提取的标签来过滤日志行 ， 可包含多个谓词 。 < / p >
< p > 谓词包含用于比较标签的 < b > 标签标识符 < / b > 、 < b > 运算符 < / b > 和 < b > 值 < / b > 。 < / p >
< p > 例如 ， 在 < code > cluster = "namespace" < / code > 中 ， cluster 为标签标识符 ， 运算符为 < code > = < / code > ， 值为 “ namespace ” 。 标签标识符总是在运算符的左侧 。 < / p >
< p > LogQL 支持多种 < b > 值 < / b > 类型 ， 这些值类型会从查询输入中自动推断出来 。 < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < b > 字符串 < / b > 使用双引号或反引号 ， 如 < code > "200" < / code > 或 ` <code>us-central1</code> ` 。 < / li >
< li > 持续时间 是一串带后缀单位的十进制数字 ， 数字可为小数 ， 如 “ 300 ms ” 、 “ 1.5 h ” 或 “ 2 h45m ” 。 有效的时间单位为 “ ns ” 、 “ us ” ( 或 “ µs ” ) 、 “ ms ” 、 “ s ” 、 “ m ” 、 “ h ” 。 < / li >
< li > < b > 数字 < / b > 为浮点数 （ 64 位 ） ， 如 < code > 250 < / code > 、 < code > 89.923 < / code > 。 < / li >
< li > < b > 字节 < / b > 是一串带后缀单位的十进制数字 ， 数字可为小数 ， 如 “ 42 MB ” 、 “ 1.5 Kib ” 或 “ 20 b ” 。 有效的字节单位为 “ b ” 、 “ kib ” 、 “ kb ” 、 “ mib ” 、 “ mb ” 、 “ gib ” 、 “ gb ” 、 “ tib ” 、 “ tb ” 、 “ pib ” 、 “ pb ” 、 “ eib ” 、 “ eb ” 。 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 字符串类型使用方法和 < b style = "color: #3C92F1" @click ="jumpClick('#log-stream-selector')" class = "log-link" > 日志流选择器 < / b > 里的 Prometheus 标签匹配器使用方法完全一样 ， 意味着您也使用这些运算符 ( < code > = < / code > 、 < code > != < / code > 、 < code > = ~ < / code > 、 < code > ! ~ < / code > ) 。 < / p >
< pre > 字符串类型是唯一能够过滤出含有标签 < code > _ _error _ _ < / code > 日志行的方式 。 < / pre >
< p > 使用持续时间 、 数字 、 字节可以在比较前转换标签值 ， 支持以下比较符 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < code > == < / code > 或 < code > = < / code > 表示相等 。 < / li >
< li > < code > != < / code > 表示不相等 。 < / li >
< li > < code > > < / code > 和 < code > >= < / code > 分别表示大于和大于等于 。 < / li >
< li > < code > & lt ; < / code > 和 < code > & lt ; = < / code > 分别表示小于和小于等于 。 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 例如 ： < code > logfmt | duration > 1 m and bytes _consumed > 20 MB < / code > < / p >
< p > 如果标签值未能成功转换 ， 则无法过滤日志行 ， 同时还添加 < code > _ _error _ _ < / code > 标签 。 要过滤这些错误 ， 详情参见管道错误一节 。 < / p >
< p > 您可以使用 < code > and < / code > 和 < code > or < / code > 来连接多个谓词 ， < code > and < / code > 表示 and 的二进制运算 ， < code > or < / code > 表示 or 的二进制运算 。 < code > and < / code > 也可以用逗号 、 空格 、 另一管道来表示 。 标签过滤器可放置在日志管道的任意位置 。 < / p >
< p > 这意味着以下所有表达式都是等价的 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" >
| duration >= 20 ms or size == 20 kb and method ! ~ "2.." < br / >
| duration >= 20 ms or size == 20 kb | method ! ~ "2.." < br / >
| duration >= 20 ms or size == 20 kb , method ! ~ "2.." < br / >
| duration >= 20 ms or size == 20 kb method ! ~ "2.."
< / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 评估多个谓词时 ， 优先级为从左到右 。 您可以用圆括号括住谓词 ， 改变其优先级 。 < / p >
< p > 以下示例为等价的 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" >
| duration >= 20 ms or method = "GET" and size & lt ; = 20 KB < br / >
| ( ( duration >= 20 ms or method = "GET" ) and size & lt ; = 20 KB )
< / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 若要先评估逻辑 and ， 使用圆括号 ， 如 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > | duration >= 20 ms or ( method = "GET" and size & lt ; = 20 KB ) < / code > < / p >
2022-10-25 14:47:47 +08:00
< pre > 在展开表达式后仅允许标签过滤表达式 ， 主要是为了从度量提取中过滤出错误 。 < / pre >
< p > 标签过滤表达式支持匹配 IP 地址 ， 详情参见匹配 IP 地址 。 < / p >
2021-08-02 19:51:53 +08:00
< / div >
< / div >
2022-08-26 13:50:04 +08:00
<!-- Parser expression -- >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "parsing-expressions" > 解析器表达式 < / h2 >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 解析器表达式可以从日志内容中解析 、 提取标签 。 提取的标签可以用 < b style = "color: #3C92F1" @click ="jumpClick('#label-filter-expressions')" class = "log-link" > 标签过滤表达式 < / b > 来过滤 ， 或用于 < b style = "color: #3C92F1" @click ="jumpClick('#metric-queries')" class = "log-link" > 度量聚合 < / b > 。 < / p >
< p > 提取的标签键由所有解析器自动净化 ， 以满足 Prometheus 度量名称的规则 。 （ 只能包含ASCII字母和数字 、 下划线和冒号 ， 不能以数字开头 。 ） < / p >
< p > 例如 ， < code > | json < / code > 管道会生成以下映射 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > { "a.b" : { c : "d" } , e : "f" } < / code > < / p >
< p > - > < / p >
< p > < code class = "fillbox" > { a _b _c = "d" , e = "f" } < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 在出错的情况下 ， 例如 ， 如果该行格式不符合要求 ， 则该日志行不会被过滤 ， 同时会添加一个新标签 < code > _ _error _ _ < / code > 。 < / p >
< p > 如果在原始日志流中已经存在了提取的标签键名称 ， 该提取的标签键会添加关键词 < code > _extracted < / code > 作为后缀 ， 从而区分这两个标签 。 您可以使用 < b style = "color: #3C92F1" @click ="jumpClick('#label-format-expressions')" class = "log-link" > 标签格式化表达式 < / b > 来强制覆盖原始标签 。 但是如果一个提取的键出现了两次 ， 那么只会保留最新的标签值 。 < / p >
< p > Loki 支持 < b style = "color: #3C92F1" @click ="jumpClick('#JSON')" class = "log-link" > JSON < / b > 、 < b style = "color: #3C92F1" @click ="jumpClick('#logfmt')" class = "log-link" > logfmt < / b > 、 < b style = "color: #3C92F1" @click ="jumpClick('#pattern')" class = "log-link" > pattern < / b > 、 < b style = "color: #3C92F1" @click ="jumpClick('#regexp')" class = "log-link" > regexp < / b > 和 < b style = "color: #3C92F1" @click ="jumpClick('#unpack')" class = "log-link" > unpack < / b > 解析器 。 < / p >
< p > 应尽量用 < code > json < / code > 和 < code > logfmt < / code > 等预定义解析器 ， 使用起来更便捷 。 如果无法使用的话 ， 可以用 < code > pattern < / code > 和 < code > regexp < / code > 解析器来处理带有异常结构的日志行 < code > pattern < / code > 解析器写起来更容易 ， 速度更快 ， 性能也比 < code > regexp < / code > 解析器更高 。 可以在一条日志管道中使用多个解析器 ， 在解析复杂日志时尤其有用 。 示例参见 < b style = "color: #3C92F1" @click ="jumpClick('#multiple-parsers')" class = "log-link" > 多个解析器 < / b > 。 < / p >
2021-08-02 19:51:53 +08:00
< / div >
< / div >
2022-08-26 13:50:04 +08:00
<!-- JSON -- >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content" >
2022-08-26 13:50:04 +08:00
< h2 id = "JSON" > JSON < / h2 >
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > < b > json < / b > 解析器有两种运行模式 ： < / p >
< p > 1. < b > 没有 < / b > 参数 ： < / p >
2022-09-27 14:49:45 +08:00
< div class = "logfmt-module" style = "padding-left: 20px;" >
2022-10-25 14:47:47 +08:00
< p > 如果日志行为有效的json文档 ， 在管道中添加 < code > | json < / code > 会将所有 json 属性提取为标签 。 嵌套属性使用 < code > _ < / code > 分隔符平铺到标签键中 。 < / p >
< p > 注意 ： < b > 数组会被跳过 < / b > 。 < / p >
< p > 例如 ， json 解析器从以下文档中提取 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > {
"protocol" : "HTTP/2.0" ,
"servers" : [ "129.0.1.1" , "10.2.1.3" ] ,
"request" : {
"time" : "6.032" ,
"method" : "GET" ,
"host" : "foo.grafana.net" ,
"size" : "55" ,
"headers" : {
"Accept" : "*/*" ,
"User-Agent" : "curl/7.68.0"
}
} ,
"response" : {
"status" : 401 ,
"size" : "228" ,
"latency_seconds" : "6.031"
}
} < / pre >
2022-10-25 14:47:47 +08:00
< p > 以下为标签列表 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > "protocol" => "HTTP/2.0"
"request_time" => "6.032"
"request_method" => "GET"
"request_host" => "foo.grafana.net"
"request_size" => "55"
"response_status" => "401"
"response_size" => "228"
"response_latency_seconds" => "6.031" < / pre >
< / div >
2022-10-25 14:47:47 +08:00
< p > 2. < b > 有 < / b > 参数 ： < / p >
2022-09-27 14:49:45 +08:00
< div class = "logfmt-module" style = "padding-left: 20px;" >
2022-10-25 14:47:47 +08:00
< p > 在管道中使用 < code > | json label = "expression" , another = "expression" < / code > 只会提取指定的 json 字段为标签 。 您可以以同样的方式指定一个或多个表达式 ， 如同 < code > label _format < / code > ; 所有表达式必须加引号 。 < / p >
< p > 目前 ， 我们只支持字段访问 ( < code > my . field < / code > , < code > my [ "field" ] < / code > ) 和数组访问 ( < code > list [ 0 ] < / code > ) , 以及它们在嵌套 ( < code > my . list [ 0 ] [ "field" ] < / code > ) 中处于任意级别的任意组合 。 < / p >
< p > 例如 ， < code > | json first _server = "servers[0]" , ua = "request.headers[\"User-Agent\" ] < / code > 从以下文档中提取 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > {
"protocol" : "HTTP/2.0" ,
"servers" : [ "129.0.1.1" , "10.2.1.3" ] ,
"request" : {
"time" : "6.032" ,
"method" : "GET" ,
"host" : "foo.grafana.net" ,
"size" : "55" ,
"headers" : {
"Accept" : "*/*" ,
"User-Agent" : "curl/7.68.0"
}
} ,
"response" : {
"status" : 401 ,
"size" : "228" ,
"latency_seconds" : "6.031"
}
}
< / pre >
2022-10-25 14:47:47 +08:00
< p > 以下为标签列表 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > "first_server" => "129.0.1.1"
"ua" => "curl/7.68.0" < / pre >
2022-10-25 14:47:47 +08:00
< p > 表达式返回的数组或对象会以 json 格式分配给标签 。 < / p >
< p > 例如 ， < code > | json server _list = "servers" , headers = "request.headers" < / code > 会提取 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > "server_list" => ` ["129.0.1.1","10.2.1.3"] `
"headers" => ` {"Accept": "*/*", "User-Agent": "curl/7.68.0"} ` < / pre >
2022-10-25 14:47:47 +08:00
< p > 如果待提取的标签与原始 JSON 字段相同 ， 表达式可以写为 < code > | json & lt ; label & gt ; < / code > 。 < / p >
< p > 例如 ， 将 < code > servers < / code > 字段提取为标签 ， 表达式写法如下 ： < / p >
< p > < code > | json servers < / code > 会提取 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > "servers" => ` ["129.0.1.1","10.2.1.3"] ` < / pre >
2022-10-25 14:47:47 +08:00
< p > 注意 ： < code > | json servers < / code > 与 < code > | json servers = "servers" < / code > 相同 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
< / div >
<!-- logfmt -- >
< div class = "introduce-view__content" >
< h2 id = "logfmt" > logfmt < / h2 >
< div class = "introduce-view__content-label logfmt-module" >
2022-10-25 14:47:47 +08:00
< p > < b > logfmt < / b > 解析器可以通过 < code > | logfmt < / code > 来添加 ， 会从 logfmt 格式化的日志行中提取所有的键和值 。 < / p >
< p > 例如 ， 日志行 ： < / p >
2022-09-27 14:49:45 +08:00
< pre > at = info method = GET path = / h o s t = g r a f a n a . n e t f w d = " 1 2 4 . 1 3 3 . 1 2 4 . 1 6 1 " s e r v i c e = 8 m s s t a t u s = 2 0 0 < / p r e >
2022-10-25 14:47:47 +08:00
< p > 可以将这些标签提取出来 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > "at" => "info"
"method" => "GET"
"path" => "/"
"host" => "grafana.net"
"fwd" => "124.133.124.161"
"service" => "8ms"
"status" => "200" < / pre >
< / div >
< / div >
<!-- Pattern -- >
< div class = "introduce-view__content" >
< h2 id = "pattern" > Pattern < / h2 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label logfmt-module" >
2022-10-25 14:47:47 +08:00
< p > 模式 （ Pattern ） 解析器可以通过定义模式表达式 ( < code > | pattern "<pattern-expression>" < / code > ) ， 从日志行中显式提取字段 。 该表达式匹配日志行的结构 。 < / p >
< p > 以 NGINX 日志行为例 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > 0.191 .12 .2 - - [ 10 / Jun / 2021 : 09 : 14 : 29 + 0000 ] "GET /api/plugins/versioncheck HTTP/1.1" 200 2 "-" "Go-http-client/2.0" "13.76.247.102, 34.120.177.193" "TLSv1.2" "US" ""
< / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 该日志行可以用以下表达式解析 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code > & lt ; ip & gt ; - - & lt ; _ & gt ; "<method> <uri> <_>" & lt ; status & gt ; & lt ; size & gt ; & lt ; _ & gt ; "<agent>" & lt ; _ & gt ; < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 提取出以下字段 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > "ip" => "0.191.12.2"
"method" => "GET"
"uri" => "/api/plugins/versioncheck"
"status" => "200"
"size" => "2"
"agent" => "Go-http-client/2.0" < / pre >
2022-10-25 14:47:47 +08:00
< p > 模式表达式由捕获和字面量组成 。 < / p >
< p > 捕获为由 < code > & lt ; < / code > 和 < code > & gt ; < / code > 字符分隔的字段名称 。 < code > & lt ; example & gt ; < / code > 定义了字段名称 < code > example < / code > 。 未命名的捕获会显示为 < code > & lt ; _ & gt ; < / code > 。 < br / > 且会跳过匹配的内容 。 < / p >
< p > 捕获会从行开头匹配到行结尾 ， 或从上一组字面量匹配到下一组字面量 。 如果捕获没有匹配 ， 模式解析器则会停止 。 < / p >
< p > 字面量可以是任意一串 UTF - 8 字符 ， 包括空白字符 。 < / p >
< p > 默认情况下 ， 模式表达式锚定在日志行开头 。 如果表达式以字面量开头 ， 日志行也需以同一组字面量开头 。 如果不想再日志行开头锚定表达式 ， 可在表达式开头使用 < code > & lt ; _ & gt ; < / code > 。 < / p >
< p > 以该日志行为例 < / p >
2022-09-27 14:49:45 +08:00
< pre > level = debug ts = 2021 - 06 - 10 T09 : 24 : 13.472094048 Z caller = logging . go : 66 traceID = 0568 b66ad2d9294c msg = "POST /loki/api/v1/push (204) 16.652862ms" < / pre >
2022-10-25 14:47:47 +08:00
< p > 要匹配 < code > msg = " < / code > ， 使用表达式 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > & lt ; _ & gt ; msg = "<method> <path> (<status>) <latency>" < / pre >
2022-10-25 14:47:47 +08:00
< p > 在以下情况中 ， 模式表达式是无效的 < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > 不含任何已命名的捕获 。 < / li >
< li > 含有两个未经空白字符分隔的连续捕获 。 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
< / div >
< / div >
<!-- Regular expression -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "regexp" > 正则表达式 < / h2 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label logfmt-module" >
2022-10-25 14:47:47 +08:00
< p > 不同于隐式提取所有值且不用参数的 logfmt 和 json ， 正则表达式的解析器需要一个参数 < code > | regexp "<re>" < / code > ， 为 Golang RE2 语法的正则表达式 。 < / p >
< p > 正则表达式必须含有至少一个已命名的子匹配 （ 如 < code > ( ? P & lt ; name & gt ; re ) < / code > ） ， 每个子匹配都会提取一个不同的标签 。 < / p >
< p > 例如 ， 解析器 | regexp "(?P<method>\\w+) (?P<path>[\\w|/]+) \\((?P<status>\\d+?)\\) (?P<duration>.*)" 会从以下行中提取 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > POST / api / prom / api / v1 / query _range ( 200 ) 1.5 s < / pre >
2022-10-25 14:47:47 +08:00
< p > 这些标签 ： < / p >
2022-08-26 13:50:04 +08:00
< pre > "method" => "POST"
"path" => "/api/prom/api/v1/query_range"
"status" => "200"
"duration" => "1.5s" < / pre >
< / div >
< / div >
<!-- unpack -- >
< div class = "introduce-view__content" >
< h2 id = "unpack" > unpack < / h2 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label logfmt-module" >
2022-10-25 14:47:47 +08:00
< p > < code > unpack < / code > 解析器解析 JSON 日志行 ， 解包所有 Promtail < code > pack < / code > 阶段的嵌入标签 。 < b > 特殊属性 < code > _entry < / code > 会用来代替原始日志行 < / b > 。 < / p >
< p > 例如 ， 对日志行使用 < code > | unpack < / code > : < / p >
2022-08-26 13:50:04 +08:00
< pre > {
"container" : "myapp" ,
"pod" : "pod-3223f" ,
"_entry" : "original log message"
} < / pre >
2022-10-25 14:47:47 +08:00
< p > 提取 < code > container < / code > 标签和 < code > pod < / code > 标签 ； 将 < code > original log message < / code > 设为新日志行 。 < / p >
< p > 如果原始嵌入日志行属于某种格式 ， 您可以结合使用 < code > unpack < / code > 解析器和 < code > json < / code > 解析器 （ 或其他解析器 ） 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Line format expression -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "line-format-expressions" > 行格式化表达式 < / h2 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label logfmt-module" >
2022-10-25 14:47:47 +08:00
< p v-pre > 行格式化表达式可以用 文本 / 模板 格式来重写日志行内容 。 需要一个字符串参数 < code > | line _format "{{.label_name}}" < / code > 作为模板格式 。 所有标签都是注入模板的变量 ， 可以用 < code > { { . label _name } } < / code > 符号来使用 。 < / p >
< p > 例如 ， 以下表达式 ： < / p >
2022-08-26 13:50:04 +08:00
< pre v-pre > { container = "frontend" } | logfmt | line_format " {{ .query }} {{ .duration }} " < / pre >
2022-10-25 14:47:47 +08:00
< p > 会提取并重写日志行 ， 使其只包含查询和请求持续时间 。 < / p >
< p v-pre > 您可在模板中使用带双引号的字符串 ， 或带反引号的 < code > ` {{.label_name}} ` < / code > 来避免转义特殊字符 。 < / p >
< p > < code > line _format < / code > 同样支持 < code > math < / code > 函数 。 例如 ： < / p >
< p > 如果有 < code > ip = 1.1 .1 .1 < / code > 、 < code > status = 200 < / code > 和 < code > duration = 3000 ( ms ) < / code > 这三个标签 ， 我们可以将持续时间除以 < code > 1000 < / code > 来获取以秒为单位的值 。 < / p >
2022-09-27 14:49:45 +08:00
< pre v-pre > { container = "frontend" } | logfmt | line_format " {{ .ip }} {{ .status }} {{ div .duration 1000 }} " < / pre >
2022-10-25 14:47:47 +08:00
< p > 以上查询得到的 < code > line < / code > 为 < code > 1.1 .1 .1 200 3 < / code > 。 < / p >
< p > 了解模板格式的可用函数 ， 详情参见模板函数 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Labels format expression -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "label-format-expressions" > 标签格式化表达式 < / h2 >
2021-08-02 19:51:53 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > < code > | label _format < / code > 表达式可以重命名 、 修改或增加标签 ， 以逗号分隔的相等运算列表作为参数 ， 可以同时进行多个运算 。 < / p >
< p > 当两侧都为标签标识符时 ， 如 < code > dst = src < / code > ， 该运算会将 < code > src < / code > 标签重命名为 < code > dst < / code > 。 < / p >
< p > 另外 ， 右侧还可以是模板字符串 （ 双引号或反引号 ） ， 如 dst = "<code v-pre>{{.status}} {{.query}}</code>" ， 其中 < code > dst < / code > 标签值替换为文本 / 模板的评估结果 。 此处的模板引擎与 < code > | line _format < / code > 表达式的相同 ， 意味着标签可当作变量来使用 ， 您也可以用同样的函数列表 。 < / p >
< p > 在以上两种情况中 ， 如果目的标签不存在 ， 则会创建一个新标签 。 < / p >
< p > < code > dst = src < / code > 重命名形式会在将 < code > src < / code > 标签重映射到 < code > dst < / code > 标签后丢弃 src 标签 。 但是 ， 模板形式将保留引用的标签 ， 这样一来 < code v-pre > dst = "{{.src}}" < / code > 导致 < code > dst < / code > 和 < code > src < / code > 的值相同 。 < / p >
< pre > 一个标签名称在每个表达式中只能出现一次 ， 这意味着 < code > | label _format foo = bar , foo = "new" < / code > 是不允许的 ； 想要达到预期效果 ， 您可以使用两个表达式 ： < code > | label _format foo = bar | label _format foo = "new" < / code > 。 < / pre >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Log queries examples -- >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header-two" id = "log-queries-examples" > 日志查询示例 < / h1 >
2022-08-26 13:50:04 +08:00
<!-- Multiple filtering -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "multiple-filtering" > 多个过滤阶段 < / h2 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 查询结果按从左到右连续评估的方式收集 。 为了提高查询效率 ， 从左到右排序过滤阶段 ： 流选择器 、 行过滤器 、 标签过滤器 。 以该查询为例 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code v-pre class = "fillbox" > { cluster = "ops-tools1" , namespace = "loki-dev" , job = "loki-dev/query-frontend" } |= "metrics.go" != "out of order" | logfmt | duration > 30 s or status _code != "200" < / code > < / p >
< / div >
< / div >
<!-- Multiple parsers -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "multiple-parsers" > 使用多个解析器 < / h2 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 以 logfmt 日志行为例 。 提取该 logfmt 日志行的方法和路径 : < / p >
2022-08-26 13:50:04 +08:00
< p > < code v-pre class = "fillbox" > level = debug ts = 2020 - 10 - 02 T10 : 10 : 42.092268913 Z caller = logging . go : 66 traceID = a9d4d8a928d8db1 msg = "POST /api/prom/api/v1/query_range (200) 1.5s" < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 要提取方法和路径 ， 需使用多个解析器 ( logfmt 和 regexp ) ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code v-pre class = "fillbox" > { job = "loki-ops/query-frontend" } | logfmt | line _format "{{.msg}}" | regexp "(?P<method>\\w+) (?P<path>[\\w|/]+) \\((?P<status>\\d+?)\\) (?P<duration>.*)" < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 这么做是可行的 ， 因为 < code > | line _format < / code > 将日志行重新格式化为 < code > POST / api / prom / api / v1 / query _range ( 200 ) 1.5 s < / code > ， 随即可用 < code > | regexp ... < / code > 解析器来解析 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Formatting -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "formatting" > 日志行格式化 < / h2 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label logfmt-module" >
2022-10-25 14:47:47 +08:00
< p > 以下查询展示了如何通过重新格式化日志行增加可读性 。 < / p >
2022-09-27 14:49:45 +08:00
< pre v-pre > { cluster = "ops-tools1" , name = "querier" , namespace = "loki-dev" }
2022-08-26 13:50:04 +08:00
|= "metrics.go" != "loki-canary"
| logfmt
| query != ""
2022-08-31 16:16:21 +08:00
| label _format query = "{{ Replace .query \" & # 92 ; & # 92 ; n & # 92 ; " \" & # 92 ; " -1 }}"
| line _format "{{ .ts}}\t{{.duration}}\ttraceID = {{.traceID}}\t{{ printf \" % - 100.100 s & # 92 ; " .query }} " < / pre >
2022-10-25 14:47:47 +08:00
< p > 标签格式化用于净化查询 ， 而行格式化则减少信息量 ， 创建表格输出 。 < / p >
< p > 对于给出的日志行 ： < / p >
2022-09-27 14:49:45 +08:00
< pre > level = info ts = 2020 - 10 - 23 T20 : 32 : 18.094668233 Z caller = metrics . go : 81 org _id = 29 traceID = 1980 d41501b57b68 latency = fast query = "{cluster=\"ops-tools1\", job=\"loki-ops/query-frontend\"} |= \"query_range\"" query _type = filter range _type = range length = 15 m0s step = 7 s duration = 650.22401 ms status = 200 throughput _mb = 1.529717 total _bytes _mb = 0.994659
2022-08-26 13:50:04 +08:00
level = info ts = 2020 - 10 - 23 T20 : 32 : 18.068866235 Z caller = metrics . go : 81 org _id = 29 traceID = 1980 d41501b57b68 latency = fast query = "{cluster=\"ops-tools1\", job=\"loki-ops/query-frontend\"} |= \"query_range\"" query _type = filter range _type = range length = 15 m0s step = 7 s duration = 624.008132 ms status = 200 throughput _mb = 0.693449 total _bytes _mb = 0.432718 < / pre >
2022-10-25 14:47:47 +08:00
< p > 结果是 ： < / p >
2022-09-27 14:49:45 +08:00
< pre > 2020 - 10 - 23 T20 : 32 : 18.094668233 Z 650.22401 ms traceID = 1980 d41501b57b68 { cluster = "ops-tools1" , job = "loki-ops/query-frontend" } |= "query_range"
2022-08-26 13:50:04 +08:00
2020 - 10 - 23 T20 : 32 : 18.068866235 Z 624.008132 ms traceID = 1980 d41501b57b68 { cluster = "ops-tools1" , job = "loki-ops/query-frontend" } |= "query_range" < / pre >
< / div >
< / div >
<!-- Metric queries -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header-one" id = "metric-queries" > 度量查询 < / h1 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 度量查询通过将函数应用于日志查询结果来扩展日志查询 。 这一强大功能从日志中创建度量 。 < / p >
< p > 度量查询可用来计算错误信息速率 ， 或在过去3小时内拥有最多日志数量的前 N 大日志源 。 < / p >
< p > 度量查询结合解析器 ， 可用来计算来自日志行里样本值的度量 ， 如延时或请求大小 。 包括提取标签在内的所有标签 ， 均可用于聚合以及生成新系列 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Range Vector aggregation -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header-two" id = "range-vector-aggregation" > 范围向量聚合 < / h1 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > LogQL 范围向量的概念与 Prometheu 的相同 。 在 Grafana Loki 中 ， 选中的样本范围为某一范围内选中的日志或标签值 。 < / p >
< p > 聚合应用于一段时间长度 。 Loki 定义时间长度的语法与 Prometheus 的相同 。 < / p >
< p > Loki 支持两种范围向量聚合 ： 日志范围聚合和展开范围聚合 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Log range aggregations -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "log-range-aggregations" > 日志范围聚合 < / h2 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 日志范围聚合的查询后带有持续时间 。 在一段持续时间内应用函数来聚合查询 。 持续时间可放置于日志流选择器之后 ， 或日志管道末端 。 < / p >
< p > 函数 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < code > rate ( log - range ) < / code > : 计算每秒条目数 。 < / li >
< li > < code > count _over _time ( log - range ) < / code > : 计算给定时间内每个日志流的条目数 。 < / li >
< li > < code > bytes _rate ( log - range ) < / code > : 计算每个流每秒的字节数 。 < / li >
< li > < code > bytes _over _time ( log - range ) < / code > : 计算给定时间内每个日志流使用的字节数 。 < / li >
< li > < code > absent _over _time ( log - range ) < / code > : 如果传递给它的范围向量含有元素 ， 则返回空向量 ； 如果传递给它的范围向量不含有元素 ， 则返回值为1的单元素向量 。 （ 在某一段时间内 ， 如果没有用于标签组合的时间序列或日志流存在 ， < code > absent _over _time < / code > 可以起较好的告警作用 。 ） < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 示例 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
< li >
2022-10-25 14:47:47 +08:00
< p > 计算 MySQL 作业在过去五分钟内的所有日志行数 。 < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > count _over _time ( { job = "mysql" } [ 5 m ] ) < / code > < / p >
< / li >
< li >
2022-10-25 14:47:47 +08:00
< p > 该聚合包括了过滤器和解析器 。 返回 MySQL 作业每台主机过去几分钟内所有非超时错误的每秒比率 ， 并且只包括持续时间超过10秒的错误 。 < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > sum by ( host ) ( rate ( { job = "mysql" } |= "error" != "timeout" | json | duration > 10 s [ 1 m ] ) ) < / code > < / p >
< / li >
< / ul >
< / div >
< / div >
<!-- Unwrapped range aggregations -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "unwrapped-range-aggregations" > 展开范围聚合 < / h2 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 展开范围没有使用日志行而是使用了提取的标签作为样本值 。 但要选择在聚合里用什么标签 ， 日志查询必须以一个展开表达式为结尾 ， 同时可以选择使用标签过滤表达式来丢弃错误 。 < / p >
< p > 展开表达式标示为 < code > | unwrap label _identifier < / code > ， 其中 ， 标签标识符是用于提取样本值的标签名称 。 < / p >
< p > 因为标签值为字符串 ， 默认情况下会尝试将其转换为浮点数 （ 64 位 ） ， 避免因错误使样本添加 < code > _ _error _ _ < / code > 标签 。 可以选择将标签标识符用转换函数 < code > | unwrap & lt ; function & gt ; ( label _identifier ) < / code > 打包 ， 该过程会尝试转换特定格式的标签值 。 < / p >
< p > LogQL当前支持如下函数 : < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < code > duration _seconds ( label _identifier ) < / code > ( 简写为 < code > duration < / code > ) ， 可将go 持续时间格式 ( 如 ： < code > 5 m < / code > 、 < code > 24 s30ms < / code > ) 的标签值转换为以秒为单位 。 < / li >
< li > < code > bytes ( label _identifier ) < / code > ， 可将标签值转换为原始字节并应用字节单位 ( 如 ： < code > 5 MiB < / code > 、 < code > 3 k < / code > 、 < code > 1 G < / code > ) 。 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 支持展开范围运算的函数如下 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < code > rate ( unwrapped - range ) < / code > : 计算指定时间间隔内所有值总和的每秒速率 。 < / li >
< li > < code > rate _counter ( unwrapped - range ) < / code > : 计算指定时间间隔内值的每秒速率 ， 并将它们视为 “ counter metric ” （ “ 计数器度量 ” ） 。 < / li >
< li > < code > sum _over _time ( unwrapped - range ) < / code > : 指定时间间隔内所有值的总和 。 < / li >
< li > < code > avg _over _time ( unwrapped - range ) < / code > : 指定间隔内所有点的平均值 。 < / li >
< li > < code > max _over _time ( unwrapped - range ) < / code > : 指定间隔内所有点的最大值 。 < / li >
< li > < code > min _over _time ( unwrapped - range ) < / code > : 指定间隔内所有点的最小值 。 < / li >
< li > < code > first _over _time ( unwrapped - range ) < / code > : 指定时间间隔内所有点的第一个值 。 < / li >
< li > < code > last _over _time ( unwrapped - range ) < / code > : 指定时间间隔内所有点的最后一个值 。 < / li >
< li > < code > stdvar _over _time ( unwrapped - range ) < / code > : 指定时间间隔内值的总体标准方差 。 < / li >
< li > < code > stddev _over _time ( unwrapped - range ) < / code > : 指定时间间隔内值的总体标准偏差 。 < / li >
< li > < code > quantile _over _time ( scalar , unwrapped - range ) < / code > : 指定间隔内值的 φ 分位数 （ 0 ≤ φ ≤ 1 ） 。 < / li >
< li > < code > absent _over _time ( unwrapped - range ) < / code > : 如果传递给它的范围向量含有元素 ， 则返回空向量 ； 如果传递给它的范围向量不含有元素 ， 则返回值为1的单元素向量 。 （ 在某一段时间内 ， 如果没有用于标签组合的时间序列或日志流存在 ， < code > absent _over _time < / code > 可以起较好的告警作用 。 ） < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 除 < code > sum _over _time < / code > 、 < code > absent _over _time < / code > 和 < code > rate < / code > 以外 ， 展开范围聚合支持分组 。 < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > & lt ; aggr - op & gt ; ( [ parameter , ] & lt ; unwrapped - range & gt ; ) [ without | by ( & lt ; label list & gt ; ) ] < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 可以通过包含 < code > without < / code > 或 < code > by < / code > 子句 ， 来聚合不同的标签维度 。 < / p >
< p > < code > without < / code > 将列出的标签从结果向量中删除 ， 保留所有其他标签为输出 。 < code > by < / code > 作用相反 ， 丢弃没有列在 < code > by < / code > 子句里的标签 ， 尽管它们的标签值在向量的所有元素中是相同的 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Unwrapped examples -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "unwrapped-examples" > 展开 < / h2 >
2022-09-27 14:49:45 +08:00
< div class = "introduce-view__content-label logfmt-module" >
2022-08-26 13:50:04 +08:00
< pre > quantile _over _time ( 0.99 ,
{ cluster = "ops-tools1" , container = "ingress-nginx" }
| json
| _ _error _ _ = ""
| unwrap request _time [ 1 m ] ) by ( path ) < / pre >
2022-10-25 14:47:47 +08:00
< p > 按路径计算 nginx - ingress 延时的 p99 。 < / p >
2022-08-26 13:50:04 +08:00
< pre > sum by ( org _id ) (
sum _over _time (
{ cluster = "ops-tools1" , container = "loki-dev" }
|= "metrics.go"
| logfmt
| unwrap bytes _processed [ 1 m ] )
) < / pre >
2022-10-25 14:47:47 +08:00
< p > 计算每个组织 ID 处理的字节数量 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Built - in aggregation operators -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h1 class = "page-header-two" id = "built-in-aggregation-operators" > 内置聚合运算符 < / h1 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > LogQL 类似 PromQL ， 支持内置聚合运算符的子集 ， 可用来聚合单个向量的元素 ， 生成的新向量元素更少 ， 但含有聚合值 ： < / p >
2022-08-26 13:50:04 +08:00
< ul >
2022-10-25 14:47:47 +08:00
< li > < code > sum < / code > : 计算标签的总和 < / li >
< li > < code > avg < / code > : 计算标签的平均值 < / li >
< li > < code > min < / code > : 选择标签的最小值 < / li >
< li > < code > max < / code > : 选择标签的最大值 < / li >
< li > < code > stddev < / code > : 计算标签的总体标准偏差 < / li >
< li > < code > stdvar < / code > : 计算标签的总体标准方差 < / li >
< li > < code > count < / code > : 计算向量的元素数 < / li >
< li > < code > topk < / code > : 按样本值选择最大的 k 个元素 < / li >
< li > < code > bottomk < / code > : 按样本值选择最小的 k 个元素 < / li >
2022-08-26 13:50:04 +08:00
< / ul >
2022-10-25 14:47:47 +08:00
< p > 可以通过包含 < code > without < / code > 或 < code > by < / code > 子句 ， 使用聚合运算符来聚合所有标签值 ， 或一组不同的标签值 ： < / p >
2022-08-26 15:05:51 +08:00
< p > < code class = "fillbox" > & lt ; aggr - op & gt ; ( [ parameter , ] & lt ; vector expression & gt ; ) [ without | by ( & lt ; label list & gt ; ) ] < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 在使用 < code > topk < / code > 和 < code > bottomk < / code > 时 ， < code > parameter < / code > 为必须项 。 < code > topk < / code > 与 < code > bottomk < / code > 不同于其他聚合器 ， 其包含原始标签的输入样本子集会返回到结果向量之中 。 < / p >
< p > < code > by < / code > 和 < code > without < / code > 只用来对输入向量进行分组 。 < code > without < / code > 子句将列出的标签从结果向量中删除 ， 保留所有其他标签 。 < code > by < / code > 子句作用相反 ， 丢弃没有列在子句里的标签 ， 尽管它们的标签值在向量的所有元素中是相同的 。 < / p >
2022-08-26 13:50:04 +08:00
< / div >
< / div >
<!-- Vector aggregation examples -- >
< div class = "introduce-view__content" >
2022-10-25 14:47:47 +08:00
< h2 id = "vector-aggregation-examples" > 向量聚合 < / h2 >
2022-08-26 13:50:04 +08:00
< div class = "introduce-view__content-label" >
2022-10-25 14:47:47 +08:00
< p > 获取具有最高日志吞吐量的前10个应用程序 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > topk ( 10 , sum ( rate ( { region = "us-east1" } [ 5 m ] ) ) by ( name ) ) < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 获取过去五分钟内某一作业的日志行数 ， 按级别分组 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > sum ( count _over _time ( { job = "mysql" } [ 5 m ] ) ) by ( level ) < / code > < / p >
2022-10-25 14:47:47 +08:00
< p > 获取发往 < code > / home < / code > 端点的 、 NGINX 日志的 HTTP GET 请求速率 ， 按区域划分 ： < / p >
2022-08-26 13:50:04 +08:00
< p > < code class = "fillbox" > avg ( rate ( ( { job = "nginx" } |= "GET" | json | path = "/home" ) [ 10 s ] ) ) by ( region ) < / code > < / p >
2021-08-02 19:51:53 +08:00
< / div >
< / div >
< / div >
< / div >
< / div >
< / div >
< / div >
< / div >
2023-04-26 09:46:09 +08:00
< button : class = "{'to-top-is-hover': tableHover}" @click ="toTop(scrollbarWrap)" class = "to-top" style = "position:absolute;bottom: -20px;" v-show = "showTopBtn" :title="$t('overall.backToTop')"><i class="nz-icon nz-icon-top" > < / i > < / button >
2021-08-02 19:51:53 +08:00
< transition name = "right-box" >
2022-03-08 11:35:22 +08:00
< chartRightBox v-if = "rightBox.show" ref="addChartModal" :chart="chartData" :from="$CONSTANTS.fromRoute.explore" :panel-data="panelData" :show-panel="{id: -1, name: '', type: 'explore'}" @close="handleBox(false)" @on-create-success="createSuccess" > < / chartRightBox >
2021-08-02 19:51:53 +08:00
< / transition >
< / div >
< / template >
< script >
import bus from '../../../../libs/bus'
import promqlInput from './promqlInput'
import chart from '../overview/chart'
import axios from 'axios'
import { getUUID } from '../../../common/js/common'
2022-04-12 10:30:33 +08:00
import chartDataFormat from '../../../chart/chartDataFormat'
2021-08-02 19:51:53 +08:00
import logTab from './logTab'
2021-09-28 16:54:07 +08:00
import promqlInputMixin from '@/components/common/mixin/promqlInput'
2021-12-03 16:58:25 +08:00
import chartRightBox from '@/components/common/rightBox/chart/chartRightBox'
2022-10-20 16:25:03 +08:00
import { Loading } from 'element-ui'
2021-08-02 19:51:53 +08:00
export default {
name : 'exploreItem' ,
components : {
'promql-input' : promqlInput ,
2021-12-03 16:58:25 +08:00
chartRightBox ,
2021-08-02 19:51:53 +08:00
chart ,
logTab
} ,
props : {
tabIndex : Number ,
closable : Boolean
} ,
2021-09-28 16:54:07 +08:00
mixins : [ promqlInputMixin ] ,
2021-08-02 19:51:53 +08:00
data ( ) {
return {
2021-09-09 16:00:37 +08:00
chartLoading : false ,
2021-10-28 09:53:24 +08:00
logTabNoData : false ,
2021-08-02 19:51:53 +08:00
rightBox : { // 面板弹出框相关
show : false
} ,
value : true ,
tabPosition : 'none' ,
2021-12-27 15:37:14 +08:00
tableId : 'explore' ,
2021-08-02 19:51:53 +08:00
searchMetrics : [
{
value : 'Metrics' ,
2022-06-21 18:14:21 +08:00
label : this . $t ( 'overall.metric' ) ,
2021-08-25 10:39:26 +08:00
icon : 'nz-icon nz-icon-Metrics'
2021-08-02 19:51:53 +08:00
} ,
{
value : 'Logs' ,
2023-03-17 12:46:56 +08:00
label : this . $t ( 'dashboard.dashboard.chartForm.typeVal.log.label' ) ,
2021-08-25 10:39:26 +08:00
icon : 'nz-icon nz-icon-logs'
2021-08-02 19:51:53 +08:00
}
] ,
2022-06-21 18:14:21 +08:00
selectValue : this . $t ( 'overall.metric' ) ,
2021-08-25 13:57:04 +08:00
selectIcon : 'nz-icon nz-icon-Metrics' ,
2022-10-24 16:11:36 +08:00
// language: localStorage.getItem('nz-language') || 'en',
2021-08-02 19:51:53 +08:00
showMetrics : true ,
2023-05-19 17:55:25 +08:00
promqlCount : 0 ,
2021-08-02 19:51:53 +08:00
promqlKeys : [ ] ,
2023-05-19 17:55:25 +08:00
expressions : [ ] ,
2021-08-02 19:51:53 +08:00
filterTime : [
2021-12-31 17:14:26 +08:00
bus . timeFormate ( bus . getOffsetTimezoneData ( - 1 ) ) ,
bus . timeFormate ( bus . getOffsetTimezoneData ( ) )
2021-08-02 19:51:53 +08:00
] ,
/* 工具参数 */
tools : {
loading : false , // 是否显示table加载动画
showCustomTableTitle : false , // 自定义列弹框是否显示
customTableTitle : [ ] // 自定义列工具的数据
} ,
tableTitle : [ ] ,
showIntroduce : true ,
defaultChartVisible : true ,
defaultTableVisible : true ,
chartVisible : true ,
tableVisible : true ,
pageObj : {
pageNo : 1 ,
pageSize : this . $CONSTANTS . defaultPageSize ,
total : 0
} ,
tableData : [ ] ,
saveDisabled : true ,
panelData : [ ] ,
2023-05-19 17:55:25 +08:00
chartUnit : 2 ,
2021-08-02 19:51:53 +08:00
historyParam : { useHistory : true , key : 'expore-history' } ,
2022-03-08 11:35:22 +08:00
chartData : { } ,
2021-08-02 19:51:53 +08:00
collapseValue : [ '1' , '2' ] ,
2021-08-04 17:10:35 +08:00
showTab : [ '1' , '2' ] ,
2022-08-05 10:26:43 +08:00
logData : [ ] ,
letter : [
'A' , 'B' , 'C' , 'D' , 'E' , 'F' , 'G' ,
'H' , 'I' , 'J' , 'K' , 'L' , 'M' , 'N' ,
'O' , 'P' , 'Q' , 'R' , 'S' , 'T' ,
'U' , 'V' , 'W' , 'X' , 'Y' , 'Z'
2023-04-26 09:46:09 +08:00
] ,
tableHover : false ,
showTopBtn : false , // top按钮
scrollbarWrap : null
2021-08-02 19:51:53 +08:00
}
} ,
created ( ) {
this . getPanelData ( )
2023-05-19 17:55:25 +08:00
this . resetExpression ( )
2021-08-02 19:51:53 +08:00
} ,
2023-04-26 09:46:09 +08:00
mounted ( ) {
this . scrollbarWrap = this . $refs . exploreScrollbar
this . scrollbarWrap . addEventListener ( 'scroll' , this . onScroll )
2023-05-19 17:55:25 +08:00
this . initQueryFromPath ( )
2023-04-26 09:46:09 +08:00
} ,
beforeDestroy ( ) {
this . scrollbarWrap . removeEventListener ( 'scroll' , this . onScroll )
} ,
2021-08-02 19:51:53 +08:00
methods : {
2023-04-26 09:46:09 +08:00
onScroll : bus . debounce ( function ( ) {
this . showTopBtn = this . scrollbarWrap . scrollTop > 50
} , 300 ) ,
toTop ( wrap ) {
let currentTop = wrap . scrollTop
const interval = currentTop / 10
const intervalFunc = setInterval ( function ( ) { // 花200ms分10次回到顶部，
if ( currentTop === 0 ) {
clearInterval ( intervalFunc )
} else {
currentTop = ( currentTop - interval ) < interval * 0.5 ? 0 : currentTop - interval
wrap . scrollTop = currentTop
}
} , 20 )
} ,
2022-08-26 13:50:04 +08:00
jumpClick ( id ) {
2023-03-14 13:50:58 +08:00
const dom = document . getElementsByClassName ( 'nz-explore-' + this . tabIndex ) [ 0 ]
dom . querySelector ( id ) . scrollIntoView ( true )
2022-08-26 13:50:04 +08:00
} ,
2021-08-25 13:57:04 +08:00
selectMetricsLogs ( val , icon , label ) {
if ( val ) {
2021-08-25 10:39:26 +08:00
this . selectIcon = icon
this . selectValue = val
} else {
2021-08-25 13:57:04 +08:00
label = 'Metrics'
2021-08-25 10:39:26 +08:00
}
2021-08-25 13:57:04 +08:00
this . changeType ( label )
2021-08-25 10:39:26 +08:00
} ,
2021-08-02 19:51:53 +08:00
changeType ( value ) {
this . showMetrics = value === 'Metrics'
this . showIntroduce = true
this . resetExpression ( )
} ,
split ( ) {
this . $emit ( 'split' , this . tabIndex )
} ,
pageNo ( val ) {
this . pageObj . pageNo = val
this . tableData = this . filterShowData ( this . storedTableData , this . pageObj )
} ,
pageSize ( val ) {
this . pageObj . pageSize = val
this . tableData = this . filterShowData ( this . storedTableData , this . pageObj )
} ,
filterShowData ( source , pageObj ) {
2022-03-24 09:46:14 +08:00
if ( source ) return source . slice ( ( pageObj . pageNo - 1 ) * pageObj . pageSize , pageObj . pageNo * pageObj . pageSize )
2021-08-02 19:51:53 +08:00
} ,
chartUnitChange ( unit ) {
this . chartUnit = unit
this . $nextTick ( ( ) => {
this . expressionChange ( )
} )
} ,
exportLog ( { limit , descending } ) {
const params = {
2021-08-05 12:42:18 +08:00
logql : this . expressions ,
2021-12-31 17:14:26 +08:00
start : this . $stringTimeParseToUnix ( bus . formateTimeToTime ( this . filterTime [ 0 ] ) ) ,
end : this . $stringTimeParseToUnix ( bus . formateTimeToTime ( this . filterTime [ 1 ] ) ) ,
2021-08-02 19:51:53 +08:00
direction : descending ? 'backward' : 'forward' ,
limit
}
axios . get ( '/logs/loki/export' , { responseType : 'blob' , params : params } ) . then ( res => {
if ( window . navigator . msSaveOrOpenBlob ) {
// 兼容ie11
const blobObject = new Blob ( [ res . data ] )
window . navigator . msSaveOrOpenBlob ( blobObject , 'log' )
} else {
const url = URL . createObjectURL ( new Blob ( [ res . data ] ) )
const a = document . createElement ( 'a' )
document . body . appendChild ( a ) // 此处增加了将创建的添加到body当中
a . href = url
a . download = 'log'
a . target = '_blank'
a . click ( )
a . remove ( ) // 将a标签移除
}
} , error => {
const $self = this
const reader = new FileReader ( )
reader . onload = function ( event ) {
const responseText = reader . result
const exception = JSON . parse ( responseText )
if ( exception . message ) {
$self . $message . error ( exception . message )
} else {
console . error ( error )
}
}
reader . readAsText ( error . response . data )
} )
} ,
2021-08-04 19:22:32 +08:00
queryLogData ( limit ) { // log的chart和table是一个请求
2021-09-09 16:00:37 +08:00
this . chartLoading = true
2021-08-04 19:22:32 +08:00
if ( ! limit ) {
2021-09-23 10:51:53 +08:00
limit = this . $refs . logDetail ? this . $refs . logDetail . getLimit ( ) : 100
2021-08-04 19:22:32 +08:00
}
2021-11-27 19:28:01 +08:00
this . $refs . logDetail && this . $refs . logDetail . resetOperation ( )
2021-08-02 19:51:53 +08:00
if ( this . expressions . length > 0 ) {
const requestArr = [ ]
2022-07-01 17:34:28 +08:00
// 过滤掉state为0的元素
2021-08-02 19:51:53 +08:00
this . expressions . forEach ( ( item , index ) => {
2022-07-01 17:34:28 +08:00
if ( item != '' && this . promqlKeys [ index ] . state ) {
2021-12-31 17:14:26 +08:00
requestArr . push ( this . $get ( '/logs/loki/api/v1/query_range?format=1&query=' + encodeURIComponent ( item ) + '&start=' + this . $stringTimeParseToUnix ( bus . formateTimeToTime ( this . filterTime [ 0 ] ) ) + '&end=' + this . $stringTimeParseToUnix ( bus . formateTimeToTime ( this . filterTime [ 1 ] ) ) + '&limit=' + limit ) )
2021-08-02 19:51:53 +08:00
}
} )
if ( requestArr . length > 0 ) {
this . showIntroduce = false
this . saveDisabled = false
}
axios . all ( requestArr ) . then ( res => {
2021-09-09 16:00:37 +08:00
this . chartLoading = false
2021-08-21 17:34:01 +08:00
const errorRowIndex = [ ]
res . forEach ( ( r , i ) => {
if ( typeof r === 'string' ) {
errorRowIndex . push ( i )
2021-08-04 17:10:35 +08:00
}
2021-08-21 17:34:01 +08:00
} )
if ( errorRowIndex . length > 0 ) {
this . $message . error ( this . $t ( 'tip.errorInRow' ) + ': ' + errorRowIndex . map ( e => e + 1 ) . join ( ' ,' ) )
res = res . filter ( ( r , i ) => errorRowIndex . indexOf ( i ) === - 1 )
2021-08-04 17:10:35 +08:00
}
2021-08-21 17:34:01 +08:00
if ( res . length > 0 ) {
2021-08-24 18:33:32 +08:00
const logData = res . map ( r => r . data )
2021-10-28 09:53:24 +08:00
if ( logData [ 0 ] . result . length > 0 ) {
this . logTabNoData = false
} else {
this . logTabNoData = true
}
2021-08-24 18:33:32 +08:00
const hasGraph = logData . some ( d => d . resultType === 'matrix' )
const hasLog = logData . some ( d => d . resultType === 'streamsFormat' )
2021-08-21 17:34:01 +08:00
const graphTabIndex = this . showTab . indexOf ( '1' )
if ( hasGraph ) {
if ( graphTabIndex === - 1 ) {
this . showTab . push ( '1' )
}
} else {
if ( graphTabIndex > - 1 ) {
this . showTab . splice ( graphTabIndex , 1 )
}
2021-08-04 17:10:35 +08:00
}
2021-08-21 17:34:01 +08:00
const logTabIndex = this . showTab . indexOf ( '2' )
if ( hasLog ) {
if ( logTabIndex === - 1 ) {
2021-08-24 18:33:32 +08:00
this . showTab . push ( '2' )
2021-08-21 17:34:01 +08:00
}
} else {
if ( logTabIndex > - 1 ) {
this . showTab . splice ( logTabIndex , 1 )
}
2021-08-04 17:10:35 +08:00
}
2021-08-21 17:34:01 +08:00
this . $nextTick ( ( ) => {
2021-08-24 18:33:32 +08:00
this . logData = logData
2021-09-02 17:31:03 +08:00
hasGraph && this . loadLogGraph ( )
2021-08-21 17:34:01 +08:00
} )
2021-08-04 17:10:35 +08:00
}
2021-08-21 17:34:01 +08:00
} ) . catch ( e => {
2021-09-09 16:00:37 +08:00
this . chartLoading = false
2022-10-19 16:37:21 +08:00
this . $message . error ( this . $t ( 'config.terminallog.statusItem.unknownError' ) )
2021-08-02 19:51:53 +08:00
} )
}
} ,
loadLogGraph ( ) {
const graphData = this . logData . filter ( l => l . resultType === 'matrix' )
if ( graphData && graphData . length > 0 ) {
this . $refs . logChart . startLoading ( )
const promqlInputIndexs = [ ]
const queryExpression = [ ]
2021-09-03 16:30:55 +08:00
let series = [ ]
2021-08-02 19:51:53 +08:00
const legend = [ ]
this . expressions . forEach ( ( item , index ) => {
if ( item !== '' ) {
promqlInputIndexs . push ( index )
queryExpression . push ( item )
}
2021-09-02 17:31:03 +08:00
} )
this . logData . forEach ( ( response , index ) => {
if ( response . resultType === 'matrix' ) {
const promqlIndex = promqlInputIndexs [ index ]
const data = response . result
if ( ! data || data . length < 1 ) {
return
}
data . forEach ( ( result , i ) => {
const seriesItem = {
name : '' ,
symbol : 'emptyCircle' , // 去掉点
symbolSize : [ 2 , 2 ] ,
showSymbol : false ,
smooth : 0.2 , // 曲线变平滑
data : [ ] ,
lineStyle : {
width : 1 ,
opacity : 0.9
} ,
type : 'line'
2021-08-02 19:51:53 +08:00
}
2021-09-02 17:31:03 +08:00
let legendName = ''
seriesItem . data = result . values . map ( ( item ) => {
return [ item [ 0 ] * 1000 , item [ 1 ] ]
2021-08-02 19:51:53 +08:00
} )
2021-09-02 17:31:03 +08:00
if ( result . metric && Object . keys ( result . metric ) . length > 0 ) {
const metric = Object . assign ( { } , result . metric )
seriesItem . name += metric . _ _name _ _ ? metric . _ _name _ _ : ''
seriesItem . name += '{'
delete metric . _ _name _ _
for ( const key in metric ) {
seriesItem . name += key + '=' + '"' + metric [ key ] + '",'
}
legendName = seriesItem . name . substr ( 0 , seriesItem . name . length - 1 )
legendName += '}'
} else {
legendName = queryExpression [ index ]
}
seriesItem . name = legendName + '-' + index
series . push ( seriesItem )
legend . push ( { name : seriesItem . name , alias : legendName , isGray : false } )
} )
2021-08-02 19:51:53 +08:00
2021-09-02 17:31:03 +08:00
this . $refs [ 'promql-' + promqlIndex ] [ 0 ] . setError ( '' )
}
2021-08-02 19:51:53 +08:00
} )
this . defaultChartVisible = true
this . $nextTick ( ( ) => {
2021-09-02 17:31:03 +08:00
this . $refs . logChart . setLegend ( legend )
this . $refs . logChart . setRandomColors ( series . length )
2021-09-03 16:30:55 +08:00
if ( ! series . length ) {
series = ''
}
2021-09-02 17:31:03 +08:00
this . $refs . logChart . setSeries ( series )
2021-08-02 19:51:53 +08:00
this . $refs . logChart . endLoading ( )
} )
}
} ,
queryChartData ( ) {
this . $refs . exploreChart . startLoading ( )
2022-07-01 15:42:08 +08:00
if ( this . expressions . length > 0 ) {
const requestArr = [ ]
const promqlInputIndexs = [ ]
const queryExpression = [ ]
2022-07-01 17:34:28 +08:00
// 过滤掉state为0的元素
2022-07-01 15:42:08 +08:00
this . expressions . forEach ( ( item , index ) => {
2022-07-01 17:34:28 +08:00
if ( item != '' && this . promqlKeys [ index ] . state ) {
2022-07-01 15:42:08 +08:00
const step = bus . getStep ( bus . formateTimeToTime ( this . filterTime [ 0 ] ) , bus . formateTimeToTime ( this . filterTime [ 1 ] ) )
promqlInputIndexs . push ( index )
queryExpression . push ( item )
requestArr . push ( this . $get ( '/prom/api/v1/query_range?query=' + encodeURIComponent ( item ) + '&start=' + this . $stringTimeParseToUnix ( bus . formateTimeToTime ( this . filterTime [ 0 ] ) ) + '&end=' + this . $stringTimeParseToUnix ( bus . formateTimeToTime ( this . filterTime [ 1 ] ) ) + '&step=' + step + '&nullType=null' ) )
2021-08-02 19:51:53 +08:00
}
2022-07-01 15:42:08 +08:00
} )
if ( requestArr . length > 0 ) {
this . showIntroduce = false
this . saveDisabled = false
}
axios . all ( requestArr ) . then ( res => {
let series = [ ]
const legend = [ ]
if ( res . length > 0 ) {
res . forEach ( ( response , index ) => {
const promqlIndex = promqlInputIndexs [ index ]
if ( response . data && response . status == 'success' ) {
const data = response . data . result
if ( ( ! data || data . length < 1 ) && response . message ) {
this . $refs [ 'promql-' + promqlIndex ] [ 0 ] . setError ( response . message )
return
}
data . forEach ( ( result , i ) => {
const seriesItem = {
name : '' ,
symbol : 'emptyCircle' , // 去掉点
symbolSize : [ 2 , 2 ] ,
showSymbol : false ,
smooth : 0.2 , // 曲线变平滑
data : [ ] ,
lineStyle : {
width : 1 ,
opacity : 0.9
} ,
type : 'line'
2021-08-02 19:51:53 +08:00
}
2022-07-01 15:42:08 +08:00
let legendName = ''
seriesItem . data = result . values . map ( ( item ) => {
return [ item [ 0 ] * 1000 , item [ 1 ] ]
2021-08-02 19:51:53 +08:00
} )
2022-07-01 15:42:08 +08:00
if ( result . metric && Object . keys ( result . metric ) . length > 0 ) {
const metric = Object . assign ( { } , result . metric )
seriesItem . name += metric . _ _name _ _ ? metric . _ _name _ _ : ''
seriesItem . name += '{'
delete metric . _ _name _ _
for ( const key in metric ) {
seriesItem . name += key + '=' + '"' + metric [ key ] + '",'
}
legendName = seriesItem . name . substr ( 0 , seriesItem . name . length - 1 )
legendName += '}'
2021-11-22 15:39:30 +08:00
} else {
2022-07-01 15:42:08 +08:00
legendName = queryExpression [ index ]
2021-11-22 15:39:30 +08:00
}
2022-07-01 15:42:08 +08:00
seriesItem . name = legendName + '-' + index
series . push ( seriesItem )
legend . push ( { name : seriesItem . name , alias : legendName , isGray : false } )
} )
2021-08-02 19:51:53 +08:00
2022-07-01 15:42:08 +08:00
this . $refs [ 'promql-' + promqlIndex ] [ 0 ] . setError ( '' )
} else {
if ( response . error ) {
this . $refs [ 'promql-' + promqlIndex ] [ 0 ] . setError ( response . error )
} else {
this . $refs [ 'promql-' + promqlIndex ] [ 0 ] . setError ( response )
}
2021-09-03 16:30:55 +08:00
}
2022-07-01 15:42:08 +08:00
} )
this . $refs . exploreChart . setLegend ( legend )
this . $refs . exploreChart . setRandomColors ( series . length )
if ( ! series . length ) {
series = ''
2021-08-02 19:51:53 +08:00
}
2022-07-01 15:42:08 +08:00
this . $refs . exploreChart . setSeries ( series )
this . defaultChartVisible = true
}
this . $refs . exploreChart . endLoading ( )
} )
}
2021-08-02 19:51:53 +08:00
} ,
queryTableData ( ) {
this . tools . loading = true
2022-07-01 15:42:08 +08:00
if ( this . expressions . length > 0 ) {
const requestArr = [ ]
this . expressions . forEach ( ( item , index ) => {
2022-07-01 17:34:28 +08:00
// 过滤掉state为0的元素
if ( item !== '' && this . promqlKeys [ index ] . state ) {
2022-07-01 15:42:08 +08:00
requestArr . push ( this . $get ( '/prom/api/v1/query?query=' + encodeURIComponent ( item ) ) )
2021-08-02 19:51:53 +08:00
}
2022-07-01 15:42:08 +08:00
} )
if ( requestArr . length > 0 ) {
this . showIntroduce = false
}
axios . all ( requestArr ) . then ( res => {
const tData = [ ]
let tLabels = [ ]
if ( res . length > 0 ) {
this . tableData = [ ]
this . tableTitle = [ ]
res . forEach ( ( response , index ) => {
if ( response . data && response . status === 'success' ) {
const data = response . data . result
if ( data ) {
data . forEach ( ( result , i ) => {
const metrics = Object . assign ( { } , result . metric )
if ( ! Array . isArray ( result . value ) ) {
const val = result
result = {
value : [ '' , val ]
2021-08-02 19:51:53 +08:00
}
2022-07-01 15:42:08 +08:00
}
this . $set ( metrics , 'value#' + index , chartDataFormat . getUnit ( this . chartUnit || 2 ) . compute ( result . value [ 1 ] , null , 2 ) )
2021-12-27 17:59:57 +08:00
2022-07-01 15:42:08 +08:00
this . $set ( metrics , 'time' , bus . timeFormate ( bus . computeTimezone ( result . value [ 0 ] * 1000 ) ) )
for ( const key in metrics ) {
const label = {
label : key ,
prop : key ,
show : true
2021-08-02 19:51:53 +08:00
}
2022-07-01 15:42:08 +08:00
const temp = tLabels . find ( ( item , index ) => {
return item . prop == label . prop
} )
if ( ! temp ) {
tLabels . push ( label )
}
}
tData . push ( metrics )
} )
2021-08-02 19:51:53 +08:00
}
}
2022-07-01 15:42:08 +08:00
tLabels . sort ( ( a , b ) => {
return a . prop . charCodeAt ( 0 ) - b . prop . charCodeAt ( 0 )
} )
tLabels = tLabels . filter ( label => label . prop !== 'time' )
tLabels . unshift ( {
label : this . $t ( 'overall.time' ) ,
prop : 'time' ,
show : true
} )
const filterArr = [ 'alertname' , 'severity_id' , 'severity' , 'rule_type' , 'asset_id' , 'endpoint_id' , 'project_id' , 'datacenter_id' , 'module_id' , 'nz_agent_id' , 'parent_asset_id' ]
tLabels . forEach ( tLabel => {
if ( filterArr . indexOf ( tLabel . prop ) !== - 1 ) {
tLabel . show = false
}
} )
} )
if ( tData . length > 0 ) {
this . storedTableData = Object . assign ( [ ] , tData )
this . pageObj . total = this . storedTableData . length
this . tableData = this . filterShowData ( this . storedTableData , this . pageObj )
this . tableTitle = Object . assign ( [ ] , tLabels )
this . tools . customTableTitle = Object . assign ( [ ] , tLabels )
this . defaultTableVisible = true
} else {
// this.defaultTableVisible = false;
this . pageObj . total = 0
this . pageObj . pageNo = 1
2021-08-02 19:51:53 +08:00
}
2022-07-01 15:42:08 +08:00
}
this . tools . loading = false
} )
}
2021-08-02 19:51:53 +08:00
} ,
expressionChange ( ) {
const nowTimeType = this . $refs . pickTime . $refs . timePicker . nowTimeType
2021-11-22 14:42:17 +08:00
this . pageObj . pageNo = 1
2021-08-02 19:51:53 +08:00
this . setSearchTime ( nowTimeType . type , nowTimeType . value )
2023-05-19 17:55:25 +08:00
if ( this . expressions && this . expressions . length >= 1 ) {
if ( this . showMetrics ) {
2021-08-02 19:51:53 +08:00
this . queryTableData ( )
this . queryChartData ( )
this . storeHistory ( )
2023-05-19 17:55:25 +08:00
} else {
2021-08-02 19:51:53 +08:00
this . queryLogData ( )
}
}
2023-05-19 17:55:25 +08:00
this . updatePath ( )
} ,
initQueryFromPath ( ) {
const param = this . $route . query [ this . position ]
if ( param ) {
const data = JSON . parse ( param )
// 根据地址栏参数设置时间
const nowTimeType = data . nowTimeType
this . filterTime = data . searchTime
if ( nowTimeType && nowTimeType . type ) {
this . setSearchTime ( nowTimeType . type , nowTimeType . value , nowTimeType )
}
if ( nowTimeType ) {
nowTimeType . start _time = this . filterTime [ 0 ]
nowTimeType . end _time = this . filterTime [ 1 ]
this . $refs . pickTime . $refs . timePicker . setCustomTime ( nowTimeType )
}
// 设置单位
this . chartUnit = data . unit || 2
this . $refs . pickTime . unit = this . chartUnit
this . $refs . pickTime . $refs . chartUnit . unit = this . chartUnit
// 设置selectValue
const find = this . searchMetrics . find ( item => item . value == data . type )
this . selectMetricsLogs ( find . label , find . icon , find . value )
// 设置表达式
this . promqlCount = data . queries . length
data . queries . forEach ( ( item , index ) => {
this . $set ( this . expressions , index , item . expr )
if ( this . promqlKeys [ index ] ) {
this . promqlKeys [ index ] . state = item . state
} else {
this . promqlKeys [ index ] = {
id : getUUID ( ) ,
state : item . state
}
}
} )
setTimeout ( ( ) => {
this . expressionChange ( )
} , 200 )
}
} ,
updatePath ( ) {
const nowTimeType = this . $refs . pickTime . $refs . timePicker . nowTimeType
const queries = this . expressions . map ( ( item , index ) => {
return {
expr : item ,
state : this . promqlKeys [ index ] . state
}
} )
const q = {
type : this . showMetrics ? 'Metrics' : 'Logs' ,
unit : this . chartUnit ,
queries : queries ,
nowTimeType : nowTimeType ,
searchTime : this . filterTime
}
const exploreItems = this . $parent . exploreItems
let param = JSON . parse ( JSON . stringify ( this . $route . query ) )
delete param . t
if ( exploreItems . length === 1 ) { // 一列
param = {
left : JSON . stringify ( q )
}
} else { // 两列
param [ this . position ] = JSON . stringify ( q )
}
this . $router . replace ( { query : param } )
2021-08-02 19:51:53 +08:00
} ,
setSearchTime ( type , val ) { // 设置searchTime
if ( type === 'minute' ) {
2021-12-31 17:14:26 +08:00
const startTime = bus . timeFormate ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) . setMinutes ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) . getMinutes ( ) - val ) )
const endTime = bus . timeFormate ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) )
2021-08-02 19:51:53 +08:00
this . $set ( this . filterTime , 0 , startTime )
this . $set ( this . filterTime , 1 , endTime )
this . $set ( this . filterTime , 2 , val + 'm' )
} else if ( type === 'hour' ) {
2021-12-31 17:14:26 +08:00
const startTime = bus . timeFormate ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) . setHours ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) . getHours ( ) - val ) )
const endTime = bus . timeFormate ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) )
2021-08-02 19:51:53 +08:00
this . $set ( this . filterTime , 0 , startTime )
this . $set ( this . filterTime , 1 , endTime )
this . $set ( this . filterTime , 2 , val + 'h' )
} else if ( type === 'date' ) {
2021-12-31 17:14:26 +08:00
const startTime = bus . timeFormate ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) . setDate ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) . getDate ( ) - val ) )
const endTime = bus . timeFormate ( new Date ( bus . computeTimezone ( new Date ( ) . getTime ( ) ) ) )
2021-08-02 19:51:53 +08:00
this . $set ( this . filterTime , 0 , startTime )
this . $set ( this . filterTime , 1 , endTime )
this . $set ( this . filterTime , 2 , val + 'd' )
}
this . $refs . pickTime . $refs . timePicker . searchTime = this . filterTime
} ,
storeHistory ( ) {
const expire = 24
const historyJson = localStorage . getItem ( this . historyParam . key )
2022-07-01 17:34:28 +08:00
// 过滤掉state为0的元素
2022-07-01 15:42:08 +08:00
const expressions = this . expressions . filter ( ( item , index ) => {
2022-07-01 17:34:28 +08:00
return item && item != '' && this . promqlKeys [ index ] . state
2021-08-02 19:51:53 +08:00
} )
2021-11-26 18:47:00 +08:00
const username = localStorage . getItem ( 'nz-username' )
2021-08-02 19:51:53 +08:00
if ( historyJson && historyJson != 'undefined' && historyJson != '' ) {
const historyObj = JSON . parse ( historyJson )
let history = historyObj [ username ]
if ( history ) {
// 过滤过期表达式
history = history . filter ( item => {
return item . time + item . expire >= new Date ( ) . getTime ( )
} )
let repeat = history . filter ( item => {
return expressions . includes ( item . insertText )
} )
const old = history . filter ( item => {
return ! expressions . includes ( item . insertText )
} )
const freshExpression = expressions . filter ( item => {
const find = history . find ( t => { return t . insertText == item } )
return ! find
} )
repeat = repeat . map ( item => {
item . time = new Date ( ) . getTime ( )
item . num += 1
item . documentation = this . $t ( 'dashboard.metricPreview.historyTip' , { time : item . num , hour : 24 } )
return item
} )
const fresh = freshExpression . map ( item => {
return {
label : item ,
insertText : item ,
documentation : this . $t ( 'dashboard.metricPreview.historyTip' , { time : 1 , hour : 24 } ) ,
num : 1 ,
time : new Date ( ) . getTime ( ) ,
expire : expire * 60 * 60 * 1000
}
} )
historyObj [ username ] = fresh . concat ( repeat ) . concat ( old )
} else {
const history = expressions . map ( item => {
return {
label : item ,
insertText : item ,
documentation : this . $t ( 'dashboard.metricPreview.historyTip' , { time : 1 , hour : 24 } ) ,
num : 1 ,
time : new Date ( ) . getTime ( ) ,
expire : expire * 60 * 60 * 1000
}
} )
historyObj [ username ] = history
}
localStorage . setItem ( this . historyParam . key , JSON . stringify ( historyObj ) )
} else {
const history = expressions . map ( item => {
return {
label : item ,
insertText : item ,
documentation : this . $t ( 'dashboard.metricPreview.historyTip' , { time : 1 , hour : 24 } ) ,
num : 1 ,
time : new Date ( ) . getTime ( ) ,
expire : expire * 60 * 60 * 1000
}
} )
if ( history && history . length > 0 ) {
const stored = { }
stored [ username ] = history
localStorage . setItem ( this . historyParam . key , JSON . stringify ( stored ) )
}
}
} ,
2022-07-01 15:42:08 +08:00
// 禁用启用表达式
enableExpression ( index ) {
2022-07-01 17:34:28 +08:00
this . promqlKeys [ index ] . state = this . promqlKeys [ index ] . state ? 0 : 1
2022-07-01 15:42:08 +08:00
const temp = this . expressions . some ( ( item , index ) => {
2022-07-01 17:34:28 +08:00
return item != '' && this . promqlKeys [ index ] . state
2022-07-01 15:42:08 +08:00
} )
if ( ! temp ) {
this . showIntroduce = true
}
2023-05-19 17:55:25 +08:00
this . updatePath ( )
2022-07-01 15:42:08 +08:00
} ,
2021-08-02 19:51:53 +08:00
addExpression ( index ) {
this . expressions . splice ( index + 1 , 0 , '' )
2022-07-01 15:42:08 +08:00
this . promqlKeys . splice ( index + 1 , 0 , {
id : getUUID ( ) ,
2022-07-01 17:34:28 +08:00
state : 1
2022-07-01 15:42:08 +08:00
} )
2021-08-02 19:51:53 +08:00
this . promqlCount ++
} ,
copyExpression ( index ) {
this . expressions . push ( this . expressions [ index ] )
2022-07-01 15:42:08 +08:00
this . promqlKeys . push ( {
id : getUUID ( ) ,
2022-07-01 17:34:28 +08:00
state : 1
2022-07-01 15:42:08 +08:00
} )
2021-08-02 19:51:53 +08:00
this . promqlCount ++
} ,
removeExpression ( index ) {
if ( this . promqlCount > 1 ) {
this . expressions . splice ( index , 1 )
this . promqlKeys . splice ( index , 1 )
this . promqlCount --
}
} ,
resetExpression ( ) {
this . expressions = [ '' ]
2022-07-01 15:42:08 +08:00
this . promqlKeys = [ {
id : getUUID ( ) ,
2022-07-01 17:34:28 +08:00
state : 1
2022-07-01 15:42:08 +08:00
} ]
2021-08-02 19:51:53 +08:00
this . promqlCount = 1
} ,
changeChartVisible ( ) {
this . chartVisible = ! this . chartVisible
} ,
changeTableVisible ( ) {
this . tableVisible = ! this . tableVisible
} ,
handleBox ( show ) {
this . rightBox . show = show
} ,
saveChart ( ) {
const chart = {
2021-12-03 16:58:25 +08:00
id : '' ,
2021-08-02 19:51:53 +08:00
name : '' ,
2021-12-03 16:58:25 +08:00
panelName : '' ,
2021-08-02 19:51:53 +08:00
type : 'line' ,
2021-12-03 16:58:25 +08:00
span : 4 ,
2022-03-08 11:35:22 +08:00
datasource : 'metrics' ,
2021-12-03 16:58:25 +08:00
height : 4 ,
unit : 2 ,
2021-08-02 19:51:53 +08:00
param : {
2021-12-03 16:58:25 +08:00
stack : 0 ,
nullType : 'null' ,
legend : { placement : 'bottom' , values : [ ] , show : true } ,
thresholdShow : true ,
thresholds : [ { value : undefined , color : '#eeeeeeff' } ]
2021-08-02 19:51:53 +08:00
} ,
elements : [ ] ,
panel : '' ,
sync : 0 ,
2021-12-03 16:58:25 +08:00
remark : '' ,
groupId : - 1
2021-08-02 19:51:53 +08:00
}
2021-12-03 16:58:25 +08:00
this . expressions . forEach ( ( exp , index ) => {
2022-08-05 10:26:43 +08:00
chart . elements . push ( { state : this . promqlKeys [ index ] . state , expression : exp , legend : '' , type : 'expert' , id : '' , name : this . transformNumToLetter ( index ) } )
2021-08-02 19:51:53 +08:00
} )
2022-03-08 11:35:22 +08:00
this . chartData = chart
2021-08-02 19:51:53 +08:00
this . rightBox . show = true
} ,
2022-05-19 15:42:06 +08:00
saveChartLogs ( ) {
const chart = {
id : '' ,
name : '' ,
panelName : '' ,
span : 4 ,
height : 4 ,
unit : 2 ,
groupId : - 1 ,
updateBy : 1 ,
updateAt : '2022-05-18 07:51:45' ,
type : 'log' ,
weight : 6 ,
param : { limit : 100 } ,
pid : null ,
buildIn : 0 ,
seq : null ,
x : 0 ,
y : 1.93 ,
elements : [ ] ,
children : null ,
chartNums : null ,
asset : null ,
varType : null ,
varId : null ,
varName : null ,
datasource : 'logs' ,
enable : { thresholds : false , legend : true , valueMapping : false } ,
sync : 0 ,
remark : ''
}
this . expressions . forEach ( ( exp , index ) => {
2022-08-05 10:26:43 +08:00
chart . elements . push ( { state : this . promqlKeys [ index ] . state , expression : exp , legend : '' , type : 'expert' , id : '' , name : this . transformNumToLetter ( index ) } )
2022-05-19 15:42:06 +08:00
} )
this . chartData = chart
this . rightBox . show = true
} ,
2022-03-18 09:39:04 +08:00
createSuccess ( panel ) { // 添加chart成功
2023-03-15 15:39:06 +08:00
this . $confirm ( this . $t ( 'dashboard.metric.goDashboardTip' ) , this . $t ( 'tip.saveSuccess' ) , {
2021-08-02 19:51:53 +08:00
confirmButtonText : this . $t ( 'tip.yes' ) ,
cancelButtonText : this . $t ( 'tip.no' ) ,
type : 'success'
} ) . then ( ( ) => {
bus . $emit ( 'menu-change' , 'panel' )
this . $store . commit ( 'panelShowPanelChange' , panel )
this . $router . push ( {
2023-03-15 15:39:06 +08:00
path : '/dashboard' ,
2021-08-02 19:51:53 +08:00
query : {
t : + new Date ( )
}
} )
} )
} ,
getPanelData ( ) { // 获取panel数据
2023-03-15 15:39:06 +08:00
this . $get ( 'visual/dashboard?pageNo=1&pageSize=-1' ) . then ( response => {
2021-08-02 19:51:53 +08:00
if ( response . code === 200 ) {
this . panelData = response . data . list
}
} )
} ,
jumpTo ( data , id ) {
bus . $emit ( 'menu-change' , data )
this . $router . push ( {
path : '/' + data ,
query : {
t : + new Date ( )
}
} )
} ,
2021-09-13 15:06:54 +08:00
logsCollapseChange ( activeNames , a , b ) {
this . $nextTick ( ( ) => {
if ( this . $refs . exploreChart ) {
this . $refs . exploreChart . resize ( )
}
if ( this . $refs . logChart ) {
this . $refs . logChart . resize ( )
}
if ( this . $refs . logDetail ) {
this . $refs . logDetail . myChart . resize ( )
}
} )
2021-12-27 15:37:14 +08:00
} ,
updateCustomTableTitle ( custom ) {
this . tools . customTableTitle = custom
this . $refs . exploreTable . doLayout ( )
2022-08-05 10:26:43 +08:00
} ,
transformNumToLetter ( num ) { // 相当于26进制 获取idaddExpression
const self = this
let letter = ''
const loopNum = parseInt ( num / 26 )
if ( loopNum > 0 ) {
letter += this . transformNumToLetter ( loopNum - 1 )
}
letter += self . letter [ num % 26 ]
return letter
2022-09-14 11:14:45 +08:00
} ,
exportToHtml ( name ) {
2023-03-14 10:47:12 +08:00
if ( this . showIntroduce ) {
this . $message . error ( this . $t ( 'explore.queryExpression' ) )
return
}
2022-09-14 11:14:45 +08:00
const params = {
type : this . showMetrics ? 1 : 2 ,
start : this . momentStrToTimestamp ( this . filterTime [ 0 ] ) / 1000 ,
end : this . momentStrToTimestamp ( this . filterTime [ 1 ] ) / 1000 ,
unit : this . chartUnit ,
2022-09-14 14:02:08 +08:00
expressions : this . expressions . map ( item => encodeURIComponent ( item ) )
2022-09-14 11:14:45 +08:00
}
2022-09-15 18:26:24 +08:00
if ( ! this . showMetrics ) {
params . limit = this . $refs . logDetail ? this . $refs . logDetail . getLimit ( ) : 100
2022-11-11 17:22:46 +08:00
params . direction = this . $refs . logDetail ? this . $refs . logDetail . getDescending ( ) : 'backward'
2022-09-15 18:26:24 +08:00
}
2022-10-20 16:25:03 +08:00
this . $store . dispatch ( 'dispatchHomeLoading' , true )
2022-09-14 11:14:45 +08:00
this . $get ( '/visual/explore/snapshot' , params , 'blob' ) . then ( res => {
2022-10-20 16:25:03 +08:00
this . $store . dispatch ( 'dispatchHomeLoading' , false )
2022-09-14 11:14:45 +08:00
const self = this
let fileName = this . showMetrics ? 'Metrics explore' : 'Logs explore'
const resFileName = ''
if ( resFileName ) {
fileName = resFileName
}
if ( res . type == 'application/json' ) {
const reader = new FileReader ( ) // 创建一个FileReader实例
reader . readAsText ( res , 'utf-8' ) // 读取文件,结果用字符串形式表示
reader . onload = function ( ) { // 读取完成后,**获取reader.result**
const { msg } = JSON . parse ( reader . result )
self . $message . error ( msg ) // 弹出错误提示
}
return
}
if ( window . navigator . msSaveOrOpenBlob ) {
// 兼容ie11
const blobObject = new Blob ( [ res ] )
window . navigator . msSaveOrOpenBlob ( blobObject , fileName + '.html' )
} else {
const blob = new Blob ( [ res ] )
const link = document . createElement ( 'a' )
const href = window . URL . createObjectURL ( blob ) // 下载链接
link . href = href
link . download = fileName + '.html' // 下载后文件名
document . body . appendChild ( link )
link . click ( ) // 点击下载
document . body . removeChild ( link ) // 下载完成移除元素
window . URL . revokeObjectURL ( href ) // 释放blob对象
}
} , ( ) => {
this . $message . error ( '123' )
} )
2021-08-02 19:51:53 +08:00
}
} ,
2022-10-24 16:11:36 +08:00
computed : {
language ( ) {
return this . $store . getters . getLanguage
2023-05-19 17:55:25 +08:00
} ,
position ( ) {
const exploreItems = this . $parent . exploreItems
const tabIndex = exploreItems . indexOf ( this . tabIndex )
return tabIndex ? 'right' : 'left'
2022-10-24 16:11:36 +08:00
}
} ,
2021-08-02 19:51:53 +08:00
watch : {
promqlCount ( n , o ) {
2022-10-25 16:24:06 +08:00
// this.expressionChange()
2021-08-02 19:51:53 +08:00
} ,
showMetrics ( n , o ) { // 更换type后，
if ( n !== o ) {
this . collapseValue = [ '1' , '2' ]
}
} ,
expressions : {
immediate : true ,
handler ( n , o ) {
2022-07-01 15:42:08 +08:00
// if (n.length == 1 && (!n[0] || n[0] == '')) {
// this.showIntroduce = true
// } else if (n.length > 1) {
// const temp = n.find((item, index) => {
// return item != ''
// })
// if (!temp) {
// this.showIntroduce = true
// } else {
// // this.showIntroduce = false
// }
// } else {
// // this.showIntroduce = false
// }
const temp = n . some ( ( item , index ) => {
2022-07-01 17:34:28 +08:00
return item != '' && this . promqlKeys [ index ] . state
2022-07-01 15:42:08 +08:00
} )
if ( ! temp ) {
2021-08-02 19:51:53 +08:00
this . showIntroduce = true
2023-03-14 10:47:48 +08:00
this . saveDisabled = true
2021-08-02 19:51:53 +08:00
}
}
}
}
}
< / script >
