PromQL and LogQL playground

Auto / PromQL / LogQL: Auto treats a query with a log pipeline (|=, | logfmt, …) or a selector like {app="api"} as LogQL.

Range evaluates the query at every step over the last 15 minutes, 1 hour or 3 hours and draws it; Instant evaluates it once. Step is the resolution (auto: 15 s for 15 minutes, 30 s for an hour, 1 minute for 3 hours). at −min moves the end of the range back, e.g. 60 to look at api-3’s incident.

The graph breaks lines where a series has no value; tap a legend entry to hide a series, hover or touch the graph for the values at that step. Labels every series shares are shown once above the legend. The table lists each series' value at the end. Log queries show the matching lines, newest first, with a histogram. Full screen (F) gives the graph the whole screen.

Errors point at the place in the query, with Prometheus' wording where it has one (many-to-many matching not allowed, expected a range vector, …).

http_requests_total{job="api", instance, method, code} — counters; api-3 has an incident 75–60 minutes ago (25 % of requests fail, responses about 7× slower); api-2 restarts 20 minutes ago, so one scrape is missed (up = 0, staleness markers) and its counters reset.

http_request_duration_seconds — a classic histogram per instance: _bucket series with an le label, plus _sum and _count.

node_cpu_seconds_total{instance, cpu, mode}, node_memory_MemAvailable_bytes, node_memory_MemTotal_bytes, up — five nodes; node-5 is unreachable 25–15 minutes ago.

Logs: {app="api", instance} in logfmt, {app="worker"} in JSON (with a nested ctx object), {app="nginx"} in the plain combined log format.

Selectors: =, !=, =~, !~ with fully anchored regular expressions; a selector must have a name or a matcher that does not match the empty string. An instant selector takes the newest sample at most 5 minutes old (the lookback delta) and returns nothing if that sample is a staleness marker. Ranges are left-open, (t − range, t], as since Prometheus 3.0. offset (also negative) and @ (a Unix time, start(), end()) shift the evaluation time.

rate, increase, delta: the difference between the first and last sample in the window, plus the value before every counter reset, extrapolated to the window’s edges — but only half an average interval when the gap to an edge is more than 1.1 × the average interval (the series probably started or ended inside the window), and for counters never further back than where the counter would reach zero. That is why increase() is rarely an integer. irate and idelta use the last two samples.

Functions: abs ceil floor exp ln log2 log10 sqrt sgn round clamp clamp_min clamp_max, rate irate increase delta idelta deriv predict_linear changes resets, the *_over_time family (avg min max sum count last first present stddev stdvar quantile absent), histogram_quantile, label_replace label_join absent time vector scalar sort sort_desc timestamp. Functions drop the metric name except label_replace, label_join, sort, sort_desc, last_over_time and first_over_time.

Aggregations: sum avg min max count group stddev stdvar quantile topk bottomk count_values with by or without, before or after the parentheses. topk keeps the original labels and in a range query is evaluated at every step, so more than k series can appear on the graph.

Binary operators with Prometheus precedence (^ right-associative, then * / % atan2, + -, comparisons, and unless, or; unary minus binds below ^, so -2 ^ 2 = −4). Vector matching: one-to-one on all labels but the name, on(…), ignoring(…), group_left(…) and group_right(…) copying labels from the "one" side, set operators; comparisons filter unless given bool; arithmetic drops the metric name.

histogram_quantile: buckets grouped by every label except le, sorted, equal bounds merged, counts forced monotonic; rank = φ × the +Inf count; linear interpolation inside the first bucket whose count reaches the rank (from 0 for the first bucket); a rank in the +Inf bucket returns the highest finite bound; no +Inf bucket gives NaN.

Subqueries: expr[range:step] evaluates expr at multiples of the step inside the window.

LogQL: stream selectors; line filters |=, !=, |~, !~; parsers | json (nested keys joined with _), | logfmt, | regexp (Go (?P<name>…) groups), | pattern; label filters with strings, regexes, numbers and durations (duration > 100ms) joined by and, or or ,; | line_format "{{.label}}"; | drop, | keep; | unwrap label (also duration(label), bytes(label)). Range functions count_over_time, rate, bytes_over_time, bytes_rate, absent_over_time, and over unwrapped values sum avg min max first last stddev stdvar quantile _over_time, with by/without after the call; every PromQL aggregation and operator on top.

Float samples only: no native histograms, exemplars, recording rules or alerting rules; no @ modifier on LogQL; no holt_winters, double_exponential_smoothing, date functions, limitk, info() or experimental functions.

Regular expressions are JavaScript’s, with Go’s (?P<name>…) and (?i) translated; RE2 and JavaScript differ in a few corners (backreferences are accepted here, RE2 rejects them).

LogQL: no | label_format, | decolorize, | unpack, JSON parameters (| json a="b.c"), | line_format beyond {{.label}}, line-filter or chains or offset-free log queries over arbitrary times; a log query lists at most the newest 300 lines. Loki’s own query limits (max series, split intervals) are not modelled.

A range query evaluates every step independently (as Prometheus does); queries over 400,000 points stop with a warning.