{"id":44,"date":"2025-10-29T12:00:00","date_gmt":"2025-10-29T12:00:00","guid":{"rendered":"https:\/\/rezachegini.com\/?p=44"},"modified":"2026-10-30T06:39:56","modified_gmt":"2026-10-30T06:39:56","slug":"understanding-prometheus-functions","status":"publish","type":"post","link":"https:\/\/rezachegini.com\/?p=44","title":{"rendered":"Understanding Prometheus Functions"},"content":{"rendered":"<p class=\"wp-block-paragraph\">I recently started learning Prometheus, and I wanted to understand how its functions work. Prometheus functions help me change, calculate, and analyze metric data. They make it easier to build dashboards and alerts in Grafana.<\/p>\n<p class=\"wp-block-paragraph\">Prometheus works with two main data types:<\/p>\n<ul class=\"wp-block-list\"><li><strong>Instant vector:<\/strong> one value for each time series at one moment in time<\/li><li><strong>Range vector:<\/strong> many values for each time series across a time range (for example [5m])<\/li><\/ul>\n<p class=\"wp-block-paragraph\">When a function ends with _over_time, it works with a range vector. Other functions usually work with instant vectors.<\/p>\n<h3 class=\"wp-block-heading\">1. Existence Check Functions<\/h3>\n<h3 class=\"wp-block-heading\">absent()<\/h3>\n<p class=\"wp-block-paragraph\">Checks if a metric exists in Prometheus.<\/p>\n<p class=\"wp-block-paragraph\">How it works<\/p>\n<ul class=\"wp-block-list\"><li>If the metric exists, it returns nothing (empty result).<\/li><li>If the metric does not exist, it returns 1.<\/li><\/ul>\n<p class=\"wp-block-paragraph\">Syntax<\/p>\n<pre class=\"wp-block-code\"><code>absent(v instant-vector)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Examples<\/p>\n<pre class=\"wp-block-code\"><code>absent(node_cpu_seconds_total)\nabsent(node_cpu_seconds_total{cpu=\"random\"})<\/code><\/pre>\n<p class=\"wp-block-paragraph\">The first query returns empty because the metric exists. The second one returns 1 because there is no CPU labeled \u201crandom\u201d.<\/p>\n<p class=\"wp-block-paragraph\">Practical use<\/p>\n<pre class=\"wp-block-code\"><code>absent(up{job=\"node_exporter\"}) == 1<\/code><\/pre>\n<p class=\"wp-block-paragraph\">This alert fires when the node exporter stops sending metrics.<\/p>\n<h3 class=\"wp-block-heading\">absent_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Same idea, but checks data over a time range.<\/p>\n<p class=\"wp-block-paragraph\">How it works<\/p>\n<ul class=\"wp-block-list\"><li>It looks for samples inside a time range (for example [5m]).<\/li><li>If there are no samples, it returns 1.<\/li><li>If there are samples, it returns nothing.<\/li><\/ul>\n<p class=\"wp-block-paragraph\">Syntax<\/p>\n<pre class=\"wp-block-code\"><code>absent_over_time(v range-vector)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Example<\/p>\n<pre class=\"wp-block-code\"><code>absent_over_time(mysql_up[5m]) == 1<\/code><\/pre>\n<p class=\"wp-block-paragraph\">This helps detect if a service did not report data during the last 5 minutes.<\/p>\n<h3 class=\"wp-block-heading\">2. Mathematical Functions<\/h3>\n<p class=\"wp-block-paragraph\">These functions perform basic math on metric values.<\/p>\n<h3 class=\"wp-block-heading\">abs()<\/h3>\n<p class=\"wp-block-paragraph\">Makes all numbers positive.<\/p>\n<pre class=\"wp-block-code\"><code>abs(node_filesystem_free_bytes)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Useful when I only care about the size of a change, not if it increased or decreased.<\/p>\n<h3 class=\"wp-block-heading\">ceil()<\/h3>\n<p class=\"wp-block-paragraph\">Rounds numbers up to the next integer.<\/p>\n<pre class=\"wp-block-code\"><code>ceil(node_load1)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">If the value is 1.2, it becomes 2. This helps when I want to plan resources conservatively.<\/p>\n<h3 class=\"wp-block-heading\">floor()<\/h3>\n<p class=\"wp-block-paragraph\">Rounds numbers down to the nearest lower integer.<\/p>\n<pre class=\"wp-block-code\"><code>floor(node_memory_MemAvailable_bytes \/ 1024 \/ 1024 \/ 1024)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">If the value is 5.9, it becomes 5. This is good for showing available resources in whole numbers.<\/p>\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Function<\/th><th>Input<\/th><th>Output<\/th><th>Use<\/th><\/tr><\/thead><tbody><tr><td>abs()<\/td><td>-5.7<\/td><td>5.7<\/td><td>remove negatives<\/td><\/tr><tr><td>ceil()<\/td><td>5.2<\/td><td>6<\/td><td>round up<\/td><\/tr><tr><td>floor()<\/td><td>5.9<\/td><td>5<\/td><td>round down<\/td><\/tr><\/tbody><\/table><\/figure>\n<h3 class=\"wp-block-heading\">3. Range Limiting Functions<\/h3>\n<p class=\"wp-block-paragraph\">These functions control or limit metric values. They are useful for keeping dashboards readable and focusing on important ranges.<\/p>\n<h3 class=\"wp-block-heading\">clamp()<\/h3>\n<p class=\"wp-block-paragraph\">Keeps values inside a specific range.<\/p>\n<p class=\"wp-block-paragraph\">Syntax<\/p>\n<pre class=\"wp-block-code\"><code>clamp(v instant-vector, min, max)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Example<\/p>\n<pre class=\"wp-block-code\"><code>clamp(http_request_duration_seconds, 0, 10)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Values smaller than 0 become 0. Values greater than 10 become 10.<\/p>\n<h3 class=\"wp-block-heading\">clamp_min()<\/h3>\n<p class=\"wp-block-paragraph\">Sets a minimum value.<\/p>\n<p class=\"wp-block-paragraph\">Syntax<\/p>\n<pre class=\"wp-block-code\"><code>clamp_min(v instant-vector, min)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Example<\/p>\n<pre class=\"wp-block-code\"><code>clamp_min(node_filesystem_size_bytes, 1000000000)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Values smaller than 1GB become 1GB.<\/p>\n<h3 class=\"wp-block-heading\">clamp_max()<\/h3>\n<p class=\"wp-block-paragraph\">Sets a maximum value.<\/p>\n<p class=\"wp-block-paragraph\">Syntax<\/p>\n<pre class=\"wp-block-code\"><code>clamp_max(v instant-vector, max)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Example<\/p>\n<pre class=\"wp-block-code\"><code>clamp_max(rate(node_cpu_seconds_total[5m]) * 100, 100)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Values greater than 100 are set to 100.<\/p>\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Function<\/th><th>Input<\/th><th>Output<\/th><th>Use<\/th><\/tr><\/thead><tbody><tr><td>clamp(v,100,1000)<\/td><td>50<\/td><td>100<\/td><td>keep inside range<\/td><\/tr><tr><td>clamp_min(v,100)<\/td><td>50<\/td><td>100<\/td><td>set minimum<\/td><\/tr><tr><td>clamp_max(v,1000)<\/td><td>5000<\/td><td>1000<\/td><td>set maximum<\/td><\/tr><\/tbody><\/table><\/figure>\n<h3 class=\"wp-block-heading\">4. Time Functions<\/h3>\n<p class=\"wp-block-paragraph\">Prometheus includes functions that work with time values. All times use the UTC timezone.<\/p>\n<h3 class=\"wp-block-heading\">time()<\/h3>\n<p class=\"wp-block-paragraph\">Returns the current time in Unix format (seconds since 1970).<\/p>\n<pre class=\"wp-block-code\"><code>time()<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Useful for comparing current time with timestamps from metrics.<\/p>\n<h3 class=\"wp-block-heading\">timestamp()<\/h3>\n<p class=\"wp-block-paragraph\">Shows the time when each metric was collected.<\/p>\n<pre class=\"wp-block-code\"><code>timestamp(node_cpu_seconds_total)<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Example<\/p>\n<pre class=\"wp-block-code\"><code>time() - timestamp(up{job=\"node_exporter\"}) &gt; 120<\/code><\/pre>\n<p class=\"wp-block-paragraph\">This shows if the exporter has not sent data for more than 2 minutes.<\/p>\n<h3 class=\"wp-block-heading\">day_of_month()<\/h3>\n<p class=\"wp-block-paragraph\">Gives the day of the month (1\u201331).<\/p>\n<pre class=\"wp-block-code\"><code>day_of_month(timestamp(node_cpu_seconds_total))<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Helps when creating monthly reports or filters.<\/p>\n<h3 class=\"wp-block-heading\">day_of_week()<\/h3>\n<p class=\"wp-block-paragraph\">Gives the day of the week (1\u20137). 1 = Monday, 7 = Sunday.<\/p>\n<pre class=\"wp-block-code\"><code>day_of_week(timestamp(http_requests_total))<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Helps compare weekday and weekend performance.<\/p>\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Function<\/th><th>Returns<\/th><th>Use<\/th><\/tr><\/thead><tbody><tr><td>time()<\/td><td>current Unix time<\/td><td>time calculations<\/td><\/tr><tr><td>timestamp(v)<\/td><td>scrape time<\/td><td>check freshness<\/td><\/tr><tr><td>day_of_week(v)<\/td><td>1\u20137<\/td><td>weekday analysis<\/td><\/tr><tr><td>day_of_month(v)<\/td><td>1\u201331<\/td><td>monthly patterns<\/td><\/tr><\/tbody><\/table><\/figure>\n<h3 class=\"wp-block-heading\">5. Sorting Functions<\/h3>\n<p class=\"wp-block-paragraph\">These functions change the order of query results. They help find the smallest or largest metric values.<\/p>\n<h3 class=\"wp-block-heading\">sort()<\/h3>\n<p class=\"wp-block-paragraph\">Sorts results from smallest to largest.<\/p>\n<pre class=\"wp-block-code\"><code>sort(node_filesystem_avail_bytes{mountpoint=\"\/\"})<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Useful to find systems with the lowest values, like least free space.<\/p>\n<h3 class=\"wp-block-heading\">sort_desc()<\/h3>\n<p class=\"wp-block-paragraph\">Sorts results from largest to smallest.<\/p>\n<pre class=\"wp-block-code\"><code>sort_desc(rate(node_network_receive_bytes_total[5m]))<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Often used with topk() to show the top N values.<\/p>\n<pre class=\"wp-block-code\"><code>topk(5, sort_desc(rate(node_network_receive_bytes_total[5m])))<\/code><\/pre>\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Function<\/th><th>Order<\/th><th>Example<\/th><th>Use<\/th><\/tr><\/thead><tbody><tr><td>sort()<\/td><td>ascending<\/td><td>1, 2, 3<\/td><td>find low values<\/td><\/tr><tr><td>sort_desc()<\/td><td>descending<\/td><td>3, 2, 1<\/td><td>find top usage<\/td><\/tr><\/tbody><\/table><\/figure>\n<h3 class=\"wp-block-heading\">6. Aggregation Over Time Functions<\/h3>\n<p class=\"wp-block-paragraph\">These functions calculate averages, sums, or other values over time ranges. They are very useful for creating dashboards that show trends, not just single points.<\/p>\n<h3 class=\"wp-block-heading\">avg_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Calculates the average of all values within a specified range.<\/p>\n<p class=\"wp-block-paragraph\">Example:<\/p>\n<pre class=\"wp-block-code\"><code>avg_over_time(http_request_duration_seconds[5m])<\/code><\/pre>\n<h3 class=\"wp-block-heading\">sum_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Returns the sum of all values within a range.<\/p>\n<p class=\"wp-block-paragraph\">Example:<\/p>\n<pre class=\"wp-block-code\"><code>sum_over_time(increase(http_requests_total[1m])[5m:])<\/code><\/pre>\n<h3 class=\"wp-block-heading\">min_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Finds the smallest value within the time range.<\/p>\n<p class=\"wp-block-paragraph\">Example:<\/p>\n<pre class=\"wp-block-code\"><code>min_over_time(node_filesystem_avail_bytes{mountpoint=\"\/\"}[24h])<\/code><\/pre>\n<h3 class=\"wp-block-heading\">max_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Finds the largest value within the time range.<\/p>\n<p class=\"wp-block-paragraph\">Example:<\/p>\n<pre class=\"wp-block-code\"><code>max_over_time(node_hwmon_temp_celsius[24h])<\/code><\/pre>\n<h3 class=\"wp-block-heading\">count_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Counts the number of samples within the time range.<\/p>\n<p class=\"wp-block-paragraph\">Example:<\/p>\n<pre class=\"wp-block-code\"><code>count_over_time(up{job=\"node_exporter\"}[5m])<\/code><\/pre>\n<h3 class=\"wp-block-heading\">stddev_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Shows the standard deviation, helping you understand how stable or variable a metric is.<\/p>\n<p class=\"wp-block-paragraph\">Example:<\/p>\n<pre class=\"wp-block-code\"><code>stddev_over_time(http_request_duration_seconds[10m])<\/code><\/pre>\n<h3 class=\"wp-block-heading\">stdvar_over_time()<\/h3>\n<p class=\"wp-block-paragraph\">Shows the variance, another indicator of how much values fluctuate within the range.<\/p>\n<p class=\"wp-block-paragraph\">Example:<\/p>\n<pre class=\"wp-block-code\"><code>stdvar_over_time(node_load1[10m])<\/code><\/pre>\n<h3 class=\"wp-block-heading\">7. Practical Examples for Dashboards<\/h3>\n<p class=\"wp-block-paragraph\">Top 5 CPUs by usage<\/p>\n<pre class=\"wp-block-code\"><code>topk(5, sort_desc(rate(node_cpu_seconds_total{mode=\"user\"}[5m])))<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Filesystems with least free space<\/p>\n<pre class=\"wp-block-code\"><code>topk(10, sort(node_filesystem_avail_bytes))<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Slowest HTTP responses<\/p>\n<pre class=\"wp-block-code\"><code>topk(5, sort_desc(http_request_duration_seconds))<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Average CPU usage (smoothed)<\/p>\n<pre class=\"wp-block-code\"><code>avg_over_time(rate(node_cpu_seconds_total{mode=\"user\"}[5m])[10m:1m])<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Peak memory usage in 24 hours<\/p>\n<pre class=\"wp-block-code\"><code>max_over_time(node_memory_MemUsed_bytes[24h])<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Detect exporter not reporting<\/p>\n<pre class=\"wp-block-code\"><code>time() - timestamp(up{job=\"node_exporter\"}) &gt; 120<\/code><\/pre>\n<p class=\"wp-block-paragraph\">Response time stability<\/p>\n<pre class=\"wp-block-code\"><code>stddev_over_time(http_request_duration_seconds[10m])<\/code><\/pre>","protected":false},"excerpt":{"rendered":"<p>I recently started learning Prometheus, and I wanted to understand how its functions work. Prometheus functions help me change, calculate, and analyze&hellip;<\/p>\n","protected":false},"author":2,"featured_media":46,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_rezaops_part":"2","_rezaops_linkedin_url":"https:\/\/www.linkedin.com\/pulse\/understanding-prometheus-functions-reza-chegini-xrg3c\/","footnotes":""},"categories":[10,14],"tags":[8,19,16,20],"series":[15],"class_list":["post-44","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops","category-observability","tag-devops","tag-monitoring","tag-prometheus","tag-promql","series-prometheus"],"jetpack_featured_media_url":"https:\/\/rezachegini.com\/wp-content\/uploads\/2026\/10\/understanding-prometheus-functions-cover.jpg","_links":{"self":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts\/44","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=44"}],"version-history":[{"count":1,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts\/44\/revisions"}],"predecessor-version":[{"id":45,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts\/44\/revisions\/45"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/media\/46"}],"wp:attachment":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=44"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=44"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=44"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fseries&post=44"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}