# Metricbeat Prometheus module not support match query

**URL:** <https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [April 19, 2019, 6:38am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571 "2019-04-19T06:38:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Post date:** [April 19, 2019, 6:38am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571/1 "2019-04-19T06:38:08Z")

</div>

Metricbeat: 7.0.0

config:  
metricbeat.modules:

- module: prometheus  
period: 10s  
hosts: ["\<prometheus\_url\>"]  
metrics\_path: '/federate'  
query:  
_'match[]': '{ **name**!=""}'_  
namespace: example

This will result in:  
"error": {  
"message": "Unable to decode response from prometheus endpoint"  
}

is this a bug?

config quotes from:

> [Dec 23rd, 2018: [EN][Observability] Querying metrics from Prometheus with Elastic Stack](https://discuss.elastic.co/t/dec-23rd-2018-en-observability-querying-metrics-from-prometheus-with-elastic-stack/161609)

---

<div class="post-metadata">

**Author:** ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Post date:** [April 22, 2019, 2:56am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571/2 "2019-04-22T02:56:26Z")

</div>

The query works in a curl though.

---

<div class="post-metadata">

**Author:** ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Post date:** [April 22, 2019, 2:06pm UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571/3 "2019-04-22T14:06:05Z")

</div>

Looks like this issue is due to the federate API returned too many events. is there a limit？

I further verified that when a query in a Prometheus directive returns over roughly 200k events, the error comes out. Had tuned the queue.mem.events and output.elasticsearch bulk\_max\_size, both have no help on this case.

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [April 23, 2019, 11:42am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571/4 "2019-04-23T11:42:39Z")

</div>

Thank you for your feedback @Jehutywong!

This sounds like a limit set somewhere in the client we use to scrape Prometheus metrics. Could you please open a new issue for it? [https://github.com/elastic/beats/issues/new/choose](https://github.com/elastic/beats/issues/new/choose)

As a workaround, you could limit the number of metrics you get by updating the query to match only a subset.

Best regards

---

<div class="post-metadata">

**Author:** ![Jehutywong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jehutywong/32/50527_2.png) [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\
**Post date:** [April 24, 2019, 1:43am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571/5 "2019-04-24T01:43:02Z")

</div>

Thanks @exekias

I have a case opened in github #11912

Cut query into pieces works but hard to make sure all subsets not over limit.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2019, 1:43am UTC](https://discuss.elastic.co/t/metricbeat-prometheus-module-not-support-match-query/177571/6 "2019-05-22T01:43:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.