Metricbeat and advanced Prometheus queries

I'm trying to use the metricbeat prometheus module to run a query like :

  'match[]' : 'sum(increase(unix_bytes[5m])) by (process)'

however I get an error "Unable to decode response from prometheus endpoint". Am I kidding myself that I'm gonna be able to execute this type of query?

Secondly in the prometheus module does the period: 300s directive tell metricbeat to query the last 5m or do I need to do that in the query? The module is pretty sparsely documented!

Hi @hilt86 :slightly_smiling_face:

Please, can you try wrapping that PromQL queries between {}? It seems like it might be a requirement of the Federation API of Prometheus:

  'match[]' : '{sum(increase(unix_bytes[5m])) by (process)}'

yeah same error...what is the difference between the /metrics and /federate endpoints?

Any other pointers?

Should I expect this to work @Mario_Castro or could you provide further assistance please?