Binary operators

Binary operators combine two metric expressions, or an expression and a scalar. Between two vectors, LogQL matches series with identical label sets and applies the operation to each matched pair. Arithmetic and comparison operators follow the usual precedence order; use parentheses to override it.

Arithmetic operators

Combines two metric expressions — or an expression and a scalar — with +, -, *, /, %, or ^. Between two vectors, series with identical label sets are matched and the operation applies to each pair; unmatched series are dropped. The classic use is a ratio: errors divided by totals.

Syntax

<expr> <op> <expr>    where <op> is + - * / % ^
none

Parameters

Parameter Required Description

<expr>

Required

A metric expression or a scalar literal on either side.

Example

Compute Grafana’s error-log percentage: error lines divided by all lines, times 100. Both sides group by (source) so their label sets match.

  sum by (source) (count_over_time({source="grafana", level="error"}[5m]))
/
  sum by (source) (count_over_time({source="grafana"}[5m]))
* 100
Expected output
source Value

grafana

41.55

Division by zero yields no result for that series rather than an error.

Precedence follows arithmetic convention (^ highest, then * / %, then + -); parenthesize to override.

Comparison operators

Compares metric values with ==, !=, >, >=, <, or ⇐. Against a scalar, the comparison acts as a filter: series that fail the test are dropped, which is exactly the shape an alert condition needs. Add the bool modifier to keep every series and return 1 or 0 instead.

Syntax

<expr> > <scalar>    (also ==, !=, >=, <, <=; add bool to return 0/1)
none

Parameters

Parameter Required Description

<scalar>

Required

The threshold to compare against (or another vector for pairwise comparison).

bool

Optional

Returns 1/0 per series instead of filtering, as in > bool 100.

Example

Keep only the Grafana log levels that produced more than 100 lines in the last five minutes — quieter levels drop out of the result.

sum by (level) (count_over_time({source="grafana"}[5m])) > 100
Expected output
level Value

debug

9,461

error

75,432

info

94,655

Alert rules are typically written in this form: the alert fires while the filtered result is non-empty.

Set operators (and, or, unless)

Combines two vectors as sets keyed by label values: and keeps left-side series that have a match on the right, or returns the left side plus unmatched right-side series, and unless keeps left-side series that have no match on the right. Values always come from the left side.

Syntax

<expr> and <expr>  |  <expr> or <expr>  |  <expr> unless <expr>
none

Parameters

Parameter Required Description

<expr>

Required

Metric expressions on both sides; matching is by identical label sets.

Example

List Grafana’s log levels excluding any level that also produced error-level lines — unless subtracts the right-hand set from the left.

  sum by (level) (count_over_time({source="grafana"}[5m]))
unless
  sum by (level) (count_over_time({source="grafana", level="error"}[5m]))
Expected output
level Value

debug

9,778

info

98,609

warn

11

A common pattern is <query> or vector(0) to guarantee a result row even when the query matches nothing.