Firstly, given that you have put "or vector(0)", I think you may
misunderstand how alerting works in Prometheus.
PromQL expressions return vectors - a set of 0 or more values. In an
alerting expression, the alert is treated as firing if the vector is
non-empty - i.e. it contains 1 or more values, regardless of what those
values actually are. Therefore, the expression vector(0) gives an alert
which fires all of the time, which isn't very useful.
Next, PromQL comparison operators are filters, not booleans. Suppose you
have the following metrics in your database:
node_disk_space{instance="a"} 100
node_disk_space{instance="b"} 200
node_disk_space{instance="c"} 300
The PromQL expression "node_disk_space > 150" returns a vector of 2 values:
node_disk_space{instance="b"} 200
node_disk_space{instance="c"} 300
That is, the expression "node_disk_space" returns a vector of all metrics
with that metric name, and "node_disk_space > 150" filters it down to just
those metrics whose value is over 150. It does not return a "true" or
"false" value (or values).
Similarly, "and/or/unless" don't work like booleans either. The expression
"node_disk_space > 150 or vector(0)" will return the following:
node_disk_space{instance="b"} 200
node_disk_space{instance="c"} 300
{} 0
In this case you get a vector of 3 values. The explanation of how "or"
works is here:
https://prometheus.io/docs/prometheus/latest/querying/operators/#logical-set-binary-operators
It's another vector operator, which matches the label sets of the LHS and
RHS.
Now, let me go back to your original problem about time periods. I think
you're approach this the wrong way.
I believe the business rule amounts to this: "I only want to receive
alerts on this condition if the time falls between 8:30am and 9pm". It's
not that the problem doesn't happen outside business hours; it's that the
problem isn't important enough to send a notification outside of business
hours.
Therefore, the right way to handle this is with time periods within
alertmanager, to control when the alerts are sent - not within the PromQL
expression which determines whether there is a problem or not.
The way you do this is with time intervals in alertmanager routing trees.
See:
https://prometheus.io/docs/alerting/latest/configuration/#route
https://prometheus.io/docs/alerting/latest/configuration/#time_interval
Not only is this far easier to implement than attempting to do it in
PromQL, it's also more flexible - for example you can have the same alert
(from the same PromQL alerting rule) sent to different groups depending on
the time of day.
Note that you can add labels to your alert in the alerting rule to
categorise the alert, and you can match on those labels in your alert
routing tree. This gives you further flexibility to categorise your alerts
in whatever way is useful to you.
On Friday, 24 June 2022 at 23:20:42 UTC+1 [email protected] wrote:
> Hi,
> I'm try to write this simple code for Prometheus
> but I don't understand how can I include also minutes... with a valide
> range of hour.
>
> Alert could firing only between: *08:30 AM to all 09:00 P.M*.
>
> Here below the hours are in CET (+2 from Italy where I'm)
>
> (count by (exported_instance, counter_instance)
> (database_status{job="aaaa", exported_instance="myserver",
> status!="ONLINE"})
> and on() hour() >= 6 <= 19
> *......... miss minute .......*
> ) or vector(0)
>
> Thanks Alen
>
--
You received this message because you are subscribed to the Google Groups
"Prometheus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/prometheus-users/ac8929b1-7fc2-45d8-90b6-f1f411b2307cn%40googlegroups.com.
