On Thursday, 3 June 2021 at 00:04:30 UTC+1 cal...@callumj.com wrote:
> With alerting rules the Prometheus API (and templating language) has
> access to the "Value" of an alert which appears to be the first metric
> specified without the comparator.
>
That statement isn't very accurate.
Firstly, PromQL works with values which are a *vector* or zero or more
values. For example, the expression
foo
might give the following vector of values (at the current point in time, or
the specific time which you are querying for):
[
foo{bar="a",baz="x"} 123
foo{bar="a",baz="y"} 456
foo{bar="b",baz="z"} 789
]
An expression like foo{bar="a"} is a filter: it will limit the vector to
just those values with label bar="a"
[
foo{bar="a",baz="x"} 123
foo{bar="a",baz="y"} 456
]
Similarly, an expression like foo > 200 is a filter: it will limit the
vector to just those with value over 200, which in this case would be
[
foo{bar="a",baz="y"} 456
foo{bar="b",baz="z"} 789
]
And the expression "foo > 1000" will give an empty vector.
An alerting rule is just an expression like this, and the alert triggers
whenever the vector is *not empty* - and generates multiple alerts if the
vector has multiple values. For each alert, the "Value" is simply the
value of the element of that vector. Prometheus is not working out "the
first metric specified without the comparator" or anything like that.
*Any* value generates an alert.
Given that foo > 200 does not return a "boolean", it's a filter which
narrows down the result set, these filters can be combined, e.g. "foo > 200
< 500".
If you *do* want boolean values (which I find quite rare in practice), then
there is another form "foo > bool 200", which will give you:
[
foo{bar="a",baz="x"} 0
foo{bar="a",baz="y"} 1
foo{bar="b",baz="z"} 1
]
This is completely useless for an alerting rule, because you will get three
alerts firing continuously: one alert with value 0 and two alerts with
value 1. *Any* value in a vector will generate an alert, even 0.
All the above is considering the case where the LHS is an instant vector
and the RHS is a scalar. You can also have expressions where both LHS and
RHS are vectors: in this case, the values in one vector will be matched to
those in the other vector which have identical label sets. For example:
node_filesystem_avail_bytes < node_filesystem_free_bytes
My apologies if you know all this already :-)
--
You received this message because you are subscribed to the Google Groups
"Prometheus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to prometheus-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/prometheus-users/1eb5f425-2d5d-4b10-80e8-0f3b6a2be822n%40googlegroups.com.
