Aggregation

Collapse dimensions deliberately

Aggregation operators (sum, avg, min, max, count, topk, bottomk, quantile) combine series. by (label) keeps only the listed labels; without (label) removes the listed labels and keeps the rest. Aggregating a rate by route gives per-route traffic across all instances; topk(5, ...) finds the busiest series. count by (version) (up) is a quick inventory of running versions if a version label exists.

Aggregation examples

PromQL.

# requests per second per route, across all instances
sum by (route) (rate(http_requests_total{job="orders-api"}[5m]))

# error ratio for the whole service
sum(rate(http_requests_total{job="orders-api", status=~"5.."}[5m]))
  /
sum(rate(http_requests_total{job="orders-api"}[5m]))

# five busiest routes
topk(5, sum by (route) (rate(http_requests_total[5m])))

# CPU busy fraction per host (node_exporter)
1 - avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m]))

Use without to keep useful labels

without (instance, pod) keeps all other labels, so new labels added later are preserved automatically.

Quick check: What does sum by (route) (...) do?

• Removes the route label
• Adds series together, keeping only the route label
• Sorts by route
• Filters to one route