PromQL Cheat Sheet

Query Prometheus — vectors, rates, aggregations, and the functions that turn raw series into answers.

Observability6 sections · 42 commands
⌘K

Selectors & Vectors

7
up

All time series with that name

up{job='node'}

Filter by exact label

up{instance=~'10\.0\..*'}

Regex label match

up{job!~'kube-.*'}

Negative regex match

http_requests_total[5m]

Range vector over 5 minutes

http_requests_total offset 1h

Value from one hour ago

timestamp(http_requests_total)

Unix time of the sample

Counters & Rates

5
rate(counter_total[5m])

Per-second rate over 5m

irate(counter_total[5m])

Instant rate (noisy, spikes)

increase(counter_total[1h])

Total increase over an hour

deriv(gauge[5m])

Per-second slope of a gauge

resets(counter_total[5m])

How often the counter was reset

Aggregation

9
sum(rate(http_requests_total[5m]))

Total across all labels

sum by (job) (rate(...[5m]))

Group and collapse

sum without (instance) (...)

Sum except one label

avg by (pod) (...)

Average per pod

max/min by (instance) (...)

Peak or floor per instance

count by (status) (http_requests_total)

Count of series per group

topk(5, rate(node_cpu_seconds_total[5m]))

Top 5 series

bottomk(3, ...)

Bottom 3 series

count_values('code', http_requests_total)

Histogram of values

Arithmetic & Comparisons

7
node_memory_MemAvailable_bytes / 1024^3

Convert bytes to GiB

node_cpu_seconds_total{mode='idle'} * 0.8

Scale a value

node_memory_MemAvailable_bytes > 2e9

Filter by comparison

rate(node_network_receive_bytes_total[5m]) / 1024

Bytes per second → KB/s

(a - b) / (a + b)

Normalized relative diff

clamp_max(x, 100)

Bound a value

bool(up == 0)

Return 1/0 instead of filter

Common Functions

9
histogram_quantile(0.95, sum by (le) (rate(http_request_duration_seconds_bucket[5m])))

95th percentile latency

avg_over_time(gauge[1h])

Hourly average of a gauge

max_over_time(gauge[1h])

Peak over an hour

min_over_time(gauge[24h])

Lowest over a day

count_over_time(metric[5m])

Number of samples in range

quantile_over_time(0.99, metric[1h])

Percentile over time

absent(metric)

1 if no data (nice alert hook)

ceil(metric) / floor(metric)

Round results

label_replace(metric, 'dst', 'src', 'new', 'new')

Rewrite labels

Alerting & Recording Rules

5
expr: job_up == 0

Rule that fires an alert

rules: [{ record: 'job:rate:5m', expr: 'sum by (job) (rate(...[5m]))' }]

Define a recording rule

for: 5m

Firing condition must hold 5m

labels: { severity: critical }

Attach labels to alerts

annotations: { summary: '{{ $labels.job }} down' }

Template alert text