Grouping in range vector

[cyriltovena]

LogQL v2 introduces new range vector aggregation over labels values instead of logs using unwrap. Values that can be extracted from logs and so high cardinality.

We added by/without grouping clause on non-associative operations (avg_over_time, quantile_over_time, stddev_ove...).

We didn't added this for rate,count_over_time, bytes_rate and even max_over_time, because Prometheus doesn't have this.

This would allow to:

• Reduce labels required at the edges (ingester, querier storage) and so improve performance.
• We don't need to parse all labels now.
• We can write query quicker rate() by (cluster), instead of sum by (cluster) (rate())

[owen-d]

Two things:

1. I think the "auto parsers" like json, logfmt should allow optional parameters like | json foo bar which would only parse out the desired fields (foo and bar in this case). This would help reduce cardinality when desired and it occurs at the edge (queriers).
2. I'd like to be able to group by () in <agg>_over_time because we have no other way to run these operations and reduce all results to a single series.

[chancez]

You still can't group by in a sum(count_over_time(...)) by (...) so is there an alternative approach or should this be re-opened?

[CrazyByDefault]

currently stuck trying to get a query to do this exact thing -

sum by (path) (count_over_time({some logql} | json | status!=200 | status!=404 | unwrap path [$__interval]))

[patsevanton]

For example:

sum(count_over_time({cluster=~".+"}[1m])) by (cluster)