Miscellaneous operators

LogQL provides built-in functions that operate on metric query results: label_replace rewrites series labels with a regular expression, and vector produces a literal value — commonly used as a fallback so that empty results still return data.

label_replace

Adds or overwrites a label on every series by matching a regular expression against an existing label and expanding a replacement template with the capture groups. The original label is untouched. Use it to normalize names before joining two query results or to display friendlier series names.

Syntax

label_replace(<expr>, "<dst>", "<replacement>", "<src>", "<regex>")
none

Parameters

Parameter Required Description

<expr>

Required

The metric expression to transform.

<dst>

Required

The label to write.

<replacement>

Required

Template for the new value; $1, $2 refer to capture groups.

<src>

Required

The label to match against.

<regex>

Required

An anchored RE2 expression; when it does not match, the series passes through unchanged.

Example

Derive a service label from the source label on nginx log volume, prefixing it to match a service catalog’s naming.

label_replace(
  sum by (source) (count_over_time({source="nginx"}[5m])),
  "service", "ingress-$1", "source", "(.*)"
)
Expected output
service source Value

ingress-nginx

nginx

5,135,802

label_replace operates on metric query results; to rewrite labels inside a log pipeline, use label_format.

vector

Returns the given scalar as a single series with no labels. Its main job is the fallback idiom <query> or vector(0): when the query returns nothing — no errors logged, no lines matched — the result is an explicit 0 instead of an empty panel, which keeps dashboards and downstream arithmetic well-defined.

Syntax

vector(<scalar>)
none

Parameters

Parameter Required Description

<scalar>

Required

The numeric value to return.

Example

Count log lines from a service that does not exist on this cluster. The count itself is empty, so the or vector(0) fallback supplies the 0.

sum(count_over_time({source="payments-service"}[5m])) or vector(0)
Expected output
Value

0

The fallback series has no labels; if later stages match on labels, add them with label_replace.