Metricbeat and advanced Prometheus queries

Elastic Stack Beats
1

I'm trying to use the metricbeat prometheus module to run a query like :

query:
  'match[]' : 'sum(increase(unix_bytes[5m])) by (process)'

however I get an error "Unable to decode response from prometheus endpoint". Am I kidding myself that I'm gonna be able to execute this type of query?

Secondly in the prometheus module does the period: 300s directive tell metricbeat to query the last 5m or do I need to do that in the query? The module is pretty sparsely documented!

2

Hi @hilt86 :slightly_smiling_face:

Please, can you try wrapping that PromQL queries between {}? It seems like it might be a requirement of the Federation API of Prometheus:

query:
  'match[]' : '{sum(increase(unix_bytes[5m])) by (process)}'
3

yeah same error...what is the difference between the /metrics and /federate endpoints?

Any other pointers?

4

Should I expect this to work @Mario_Castro or could you provide further assistance please?

5

It should work, I'm just wondering if it's something related to the query syntax in Prometheus. Have you check the query.

About the metrics and federate endpoints, for something so especific maybe you should ask in a Prometheus forum. I have no clue, frankly :sweat_smile:

6

yeah it works in the prometheus interface....I'll try other queries and see what I find

7

Hi,
Is there any progress in this issue?
I am also trying to fetch the result from prometheus query. But /federate API in Prometheus doesn't seem to support "sum" query. This API works to scrape Prometheus' metrics.
So I added some code into Metricbeat and it works.
I am wondering if it's right way to work.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

9

Hey! This is expected to be solved by https://github.com/elastic/beats/pull/15177 where Metricbeat collects from Prometheus Query API directly. It is expected to be available in 7.7.