Range aggregation operators
Range aggregations turn a log stream into a metric by applying a function over a sliding time window — the range in square brackets, such as [5m]. Use them to chart log volume, throughput, and error counts, or as the basis for alerts.
absent_over_time
Returns a single series with value 1 when the selector matches no log lines in the range window, and returns nothing when lines exist. This inversion is what alerting needs for silence detection: a service that has stopped logging entirely produces no series for a normal alert rule to fire on.
Parameters
| Parameter | Required | Description |
|---|---|---|
|
Required |
Stream selector, optionally followed by a filter/parser pipeline. |
|
Required |
The silence window, such as |
Example
Check whether a service has logged anything in the last five minutes. Because no payments-service source exists on this cluster, the query returns 1 — the signal an alert rule would fire on.
absent_over_time({source="payments-service"}[5m])| source | Value |
|---|---|
payments-service |
1 |
|
When log lines exist, the result is empty — dashboards show no data, and alert rules do not fire. The returned series carries the equality matchers from the selector as labels, so the alert knows which service went silent. |
bytes_over_time
Sums the size in bytes of the log lines of each stream within the range window. Use it to see which sources, namespaces, or clusters generate log volume — the first question when managing ingest cost.
bytes_rate
Computes the per-second byte throughput of each stream in the range window — bytes_over_time divided by the window length. Use it to compare logging bandwidth across sources or to alert on sudden surges in log volume.
count_over_time
Counts the log lines of each stream within the range window. This is the fundamental log-to-metric operator: wrap it in sum by (…) to chart log volume by any label, or compare error counts across services and levels.
Parameters
| Parameter | Required | Description |
|---|---|---|
|
Required |
Stream selector, optionally followed by a filter/parser pipeline. |
|
Required |
The window to count over, such as |
Example
Count Grafana log lines by level over the last five minutes. The sum by (level) aggregation collapses the per-stream counts into one series per level.
sum by (level) (count_over_time({source="grafana"}[5m]))| level | Value |
|---|---|
debug |
7,900 |
error |
63,685 |
info |
75,079 |
warn |
11 |
|
In a range query (as charted on a dashboard), the window slides: each evaluation step counts the lines in the trailing |
rate
Computes the per-second rate of log lines in the range window — count_over_time divided by the window length. Rates are comparable across window sizes, which makes rate the usual choice for dashboards and alert thresholds.
Parameters
| Parameter | Required | Description |
|---|---|---|
|
Required |
Stream selector, optionally followed by a filter/parser pipeline. |
|
Required |
The window to compute the rate over, such as |
Example
Measure Grafana’s logging rate per level in lines per second, averaged over the last five minutes.
sum by (level) (rate({source="grafana"}[5m]))| level | Value |
|---|---|
debug |
26.4 |
error |
215.65 |
info |
255.40 |
warn |
0.03667 |
|
Add a line filter to rate specific events: |
