Transform functions

Transform functions rewrite series labels or reorder results without changing values.

label_join

Writes a new label whose value is the values of several source labels joined with a separator. Use it to build a single display or matching key from multiple dimensions.

Syntax

label_join(<expr>, "<dst>", "<separator>", "<src1>", "<src2>", ...)
none

Parameters

Parameter Required Description

<expr>

Required

The expression to transform.

<dst>

Required

The label to write.

<separator>

Required

String placed between values.

<srcN>

Required

One or more source labels to join.

Example

Build an instance_zone key from the service name and availability zone of Kloudfuse query-service pods.

label_join(
  sum by (app_kubernetes_io_name, availability_zone) (go_goroutines{app_kubernetes_io_name="query-service"}),
  "instance_zone", "/", "app_kubernetes_io_name", "availability_zone"
)
Expected output
instance_zone Value

query-service/canadacentral-1

22

query-service/us-central1-a

2,473

query-service/ap-south-1a

1,029

query-service/us-gov-west-1a

22

query-service/us-west1-a

5,483

Missing source labels contribute an empty string.

label_replace

Adds or overwrites a label on every series by matching a regular expression against an existing label and expanding a replacement template with the capture groups. Series whose source label does not match pass through unchanged.

Syntax

label_replace(<expr>, "<dst>", "<replacement>", "<src>", "<regex>")
none

Parameters

Parameter Required Description

<expr>

Required

The expression to transform.

<dst>

Required

The label to write.

<replacement>

Required

Template for the new value; $1, $2 reference capture groups.

<src>

Required

The label to match against.

<regex>

Required

An anchored RE2 expression.

Example

Derive a short service label from app_kubernetes_io_name by stripping the -service suffix.

label_replace(
  sum by (app_kubernetes_io_name) (go_goroutines{app_kubernetes_io_name=~".*query-service"}),
  "service", "$1", "app_kubernetes_io_name", "(.*)-service"
)
Expected output
service Value

rum-query

1,316

query

64,523

trace-query

3,058

logs-query

19,486

events-query

3,019

The source label is left untouched; drop it from view with a surrounding aggregation if needed.

sort_desc

Orders the series of an instant query by value, largest first — the natural order for leaderboard-style panels.

Syntax

sort_desc(<expr>)
none

Example

List Kloudfuse query services from most to fewest goroutines.

sort_desc(sum by (app_kubernetes_io_name) (go_goroutines{app_kubernetes_io_name=~".*query-service"}))
Expected output
app_kubernetes_io_name Value

query-service

64,589

logs-query-service

19,522

trace-query-service

3,060

events-query-service

3,018

rum-query-service

1,315

In range queries, sorting has no effect — each step is evaluated independently.

sort

Orders the series of an instant query by value, smallest first. Sorting affects presentation only — labels and values are unchanged — and applies to instant queries, where the result is a flat list.

Syntax

sort(<expr>)
none

Example

List Kloudfuse query services from fewest to most goroutines.

sort(sum by (app_kubernetes_io_name) (go_goroutines{app_kubernetes_io_name=~".*query-service"}))
Expected output
app_kubernetes_io_name Value

rum-query-service

1,319

events-query-service

3,019

trace-query-service

3,057

logs-query-service

19,524

query-service

64,559

To limit as well as order, use topk/bottomk.