What is PromQL and how do you write basic queries?
Learn PromQL, the Prometheus query language: select metrics, filter with label matchers, use range vectors, aggregate with by/without, and compute error ratios.
Expected Interview Answer
PromQL (Prometheus Query Language) is the functional query language used to select and aggregate time-series data stored in Prometheus, returning instant vectors, range vectors, scalars, or strings.
A basic query selects a metric by name and narrows it with label matchers in braces, for example http_requests_total{job="api", status="500"}. Adding a time range in square brackets like [5m] turns it into a range vector for functions such as rate(). Aggregation operators like sum, avg, and max with by/without clauses collapse series across labels, and binary operators let you compute ratios such as error rate. Together these let you build everything from simple lookups to SLO dashboards.
- Selects and filters time series with label matchers
- Aggregates across instances with sum/avg/max and by/without
- Computes rates and derivatives over time ranges
- Powers alerts, dashboards and recording rules
- Expresses ratios and thresholds with binary operators
AI Mentor Explanation
PromQL is like the query language a scorer uses on a season database. Naming a metric is asking for 'all runs scored'; adding label matchers in braces is narrowing to 'runs by this batter against spin in away games'; a range in brackets is 'over the last five overs'; and aggregation with by is 'total runs grouped by each player' — a precise way to pull exactly the slice you want from millions of ball records.
Step-by-Step Explanation
Step 1
Select a metric
Start with the metric name, e.g. http_requests_total, which returns an instant vector of all matching series.
Step 2
Filter with label matchers
Add braces with matchers like {job="api", status=~"5.."} using =, !=, =~, or !~ to narrow the series.
Step 3
Add a time range
Append [5m] to produce a range vector needed by functions like rate() or increase().
Step 4
Aggregate across labels
Wrap with sum, avg, max, etc., and use by (label) or without (label) to control grouping.
Step 5
Combine with operators
Use binary operators to compute ratios, e.g. error rate = 5xx rate / total rate, or compare against thresholds.
What Interviewer Expects
- Knows the four PromQL value types (instant vector, range vector, scalar, string)
- Uses label matchers including regex =~ and !~
- Understands range vectors and why rate() needs one
- Explains aggregation with by/without
- Can build an error-ratio query with binary operators
Common Mistakes
- Applying rate() to an instant vector instead of a range vector
- Confusing by and without grouping semantics
- Forgetting quotes around label values
- Using = when a regex matcher =~ is intended
- Aggregating counters without first taking rate()
Best Answer (HR Friendly)
“PromQL is the language you use to ask Prometheus questions about its collected metrics. You name a metric, filter it by labels like service or status, optionally pick a time window, and then group or combine the results — for example to see the request rate per service or the overall error percentage.”
Code Example
http_requests_total{job="api", status=~"5.."}sum by (service) (
rate(http_requests_total[5m])
)sum(rate(http_requests_total{status=~"5.."}[5m]))
/
sum(rate(http_requests_total[5m]))Follow-up Questions
- What is the difference between an instant vector and a range vector?
- How do the regex matchers =~ and !~ work?
- When do you use by versus without in aggregation?
- How would you compute a request error ratio in PromQL?
- What are recording rules and why use them?
MCQ Practice
1. What does appending [5m] to a selector produce?
Square-bracket duration turns a selector into a range vector, required by functions like rate().
2. Which matcher selects series whose status matches a regex?
=~ is the regex-match operator; = is an exact match.
3. Which clause keeps only the listed labels when aggregating?
sum by (label) aggregates and keeps only the listed labels; without drops the listed ones.
Flash Cards
What are PromQL's value types? — Instant vector, range vector, scalar, and string.
How do you filter series? — Label matchers in braces using =, !=, =~, !~.
What creates a range vector? — A duration in square brackets, e.g. metric[5m].
How do you group an aggregation? — Use by (labels) to keep, or without (labels) to drop.
How to compute an error ratio? — sum(rate(5xx[5m])) / sum(rate(total[5m])).