Aggregation operators

avg

Averages the values of the input series, per group when by (…​) is given. Use it to compare typical per-stream levels across a dimension — for example, the average logging rate of each source.

Syntax

avg by (<labels>) (<metric expression>)

Parameters

Example

Compare the average per-stream logging rate of the ZooKeeper and Kafka clusters.

avg by (source) (rate({source=~"zookeeper|kafka"}[5m]))

bottomk

Returns the k input series with the smallest values, keeping their labels. Use it to find the quiet outliers — services logging suspiciously little are often as interesting as the noisy ones.

Syntax

bottomk(<k>, <metric expression>)

Parameters

Example

Find the two quietest of these five sources by log volume over the last five minutes.

bottomk(2, sum by (source) (
  count_over_time({source=~"zookeeper|kafka|busybox|filebeat|catalog-service"}[5m])
))

count

Counts how many series the inner expression produced, per group when by (…​) is given. Note the two levels of counting: count_over_time counts log lines within a stream, while count counts the resulting series — useful for questions like how many distinct streams are logging.

Syntax

count by (<labels>) (<metric expression>)

Parameters

Example

Count how many distinct log streams each source produced in the last five minutes — a quick way to see fleet size per component.

count by (source) (count_over_time({source=~"zookeeper|kafka|busybox"}[5m]))

max

Returns the largest value among the input series, per group when by (…​) is given. A common companion to sum on dashboards: the total tells you how much, the max tells you whether one member dominates.

Syntax

max by (<labels>) (<metric expression>)

Parameters

Example

Find the largest per-stream line count per log level for Grafana over the last five minutes.

max by (level) (count_over_time({source="grafana"}[5m]))

min

Returns the smallest value among the input series, per group when by (…​) is given. Use it to find the quietest member of a fleet or the lower bound of a metric across streams.

Syntax

min by (<labels>) (<metric expression>)

Parameters

Example

Find the lowest per-stream line count among all Grafana streams in the last five minutes.

min(count_over_time({source="grafana"}[5m]))

sort_desc

Sorts the input series by value in descending order — largest first. The natural choice for leaderboard-style panels where the biggest contributors should top the list.

Syntax

sort_desc(<metric expression>)

Example

List these sources' five-minute log volumes from loudest to quietest.

sort_desc(sum by (source) (
  count_over_time({source=~"zookeeper|kafka|busybox"}[5m])
))

sort

Sorts the input series by value in ascending order. Sorting affects presentation only — the series and values are unchanged — and applies to instant queries, where results are a flat list.

Syntax

sort(<metric expression>)

Example

List these sources' five-minute log volumes from quietest to loudest.

sort(sum by (source) (
  count_over_time({source=~"zookeeper|kafka|busybox"}[5m])
))

stddev

Computes the population standard deviation of the input series values, per group when by (…​) is given. Use it to quantify imbalance across a fleet — a high deviation in per-stream log counts means a few members are much noisier than the rest.

Syntax

stddev by (<labels>) (<metric expression>)

Parameters

Example

Measure how unevenly log volume is distributed across Grafana’s streams in the last five minutes.

stddev(count_over_time({source="grafana"}[5m]))

stdvar

Computes the population variance of the input series values — the square of stddev — per group when by (…​) is given.

Syntax

stdvar by (<labels>) (<metric expression>)

Parameters

Example

Compute the variance of per-stream log counts across Grafana’s streams in the last five minutes.

stdvar(count_over_time({source="grafana"}[5m]))

sum

Adds the values of all input series into one series, or one series per group with by (…​). sum is the most common wrapper around a range aggregation — it collapses per-stream detail into totals along the dimension you care about.

Syntax

sum by (<labels>) (<metric expression>)    (also: sum without (<labels>) (...))

Parameters

Example

Total Grafana’s log volume per level over the last five minutes, collapsing all per-stream series into four rows.

sum by (level) (count_over_time({source="grafana"}[5m]))

topk

Returns the k input series with the largest values, keeping their labels. topk answers ranking questions directly — the noisiest sources, the busiest namespaces — without pulling the full series list.

Syntax

topk(<k>, <metric expression>)

Parameters

Example

Rank the three chattiest of these five sources by log volume over the last five minutes.

topk(3, sum by (source) (
  count_over_time({source=~"zookeeper|kafka|busybox|filebeat|catalog-service"}[5m])
))