Preserve labels during Aggregation

[Raghu Udiyar]

Hello

When using aggregations such as `max(metric1) by (lable1)`, all the other labels are stripped. Is it possible to preserve the labels, akin to selecting the `max` series.

This is more of a filter, not an aggregation.

Thanks

[Stuart Clark]

I'm not quite sure I understand what you are wanting.

Normal aggregations (sum, max, avg, etc.) will have to remove at least one label, otherwise nothing will be being aggregated (the output will just be the same as the input).

Are you maybe wanting the topk operator?

Could you give an example of what you are trying to achieve so we might be able to assist better?

Thanks

[Raghu Udiyar]

I supposed it wouldn't be an aggregation - its more like a filter. What I want is to return the series with the max value, with all labels intact. 

[Stuart Clark]

On 17/12/2020 22:43, Raghu Udiyar wrote:
> I supposed it wouldn't be an aggregation - its more like a filter.
> What I want is to return the series with the max value, with all

> labels intact. --

It does sound a bit like you are wanting topk. Does that do what you are
looking for?

[Raghu Udiyar]

The use case is to alert on the disk usage deviation from the mean, within a cluster of hosts. The alert should indicate which host deviates from the median disk usage. 

So this could be written as:

metric format: `disk_usage_pct{cluster=foo, instance=foo01}`

`max(disk_usage_pct) by (cluster) - median(disk_usage_pct) by (cluster)`

This will give the % deviation. But it'll mask the `instance` tag, since the above aggregate across the `cluster` label. 

Is there a way to preserve the `instance` label?