PromQL cheat sheet: common queries with examples

Ready-made PromQL expressions for everyday monitoring tasks: rate on counters, aggregations, quantiles from histograms, top-N and alert starters. Copy and adapt them to your own metrics.

Selectors and matchers

http_requests_total{job="api", code=~"5.."}

• = exact match, != negation
• =~ regex match, !~ regex negation

Rate on counters

sum(rate(http_requests_total[5m])) by (code)

rate() is for counters (monotonic). The [5m] window must cover at least 4 scrapes.

Aggregations

avg by (instance) (node_load1)
topk(5, sum by (pod) (container_memory_working_set_bytes))

Quantiles from histograms

histogram_quantile(0.99, sum(rate(http_request_duration_seconds_bucket[5m])) by (le))

Group by le only inside histogram_quantile.

Error rate

sum(rate(http_requests_total{code=~"5.."}[5m]))
/
sum(rate(http_requests_total[5m]))

Alert starters

# Host is down
up{job="node"} == 0

# CPU above 90% for five minutes
avg by (instance) (rate(node_cpu_seconds_total{mode!="idle"}[5m])) > 0.9

# Disk will fill up soon
predict_linear(node_filesystem_avail_bytes[6h], 4*3600) < 0

Tips

• increase(x[1h]) — total counter growth over an hour
• irate() for snappy graphs, rate() for alerts
• Filter by labels first, aggregate second — cheaper on cardinality