Combing alert conditions, missing labels

[Boden Garman]

Hi all,

I have the following data

bgpPeerAdminStatus{bgpPeerAdminStatus="start",bgpPeerRemoteAddr="10.0.0.66",bgpPeerRemoteAs="1",instance="10.0.0.1",job="snmp-cisco-bgp"} 1
bgpPeerState{bgpPeerRemoteAddr="10.0.0.66",bgpPeerRemoteAs="1",bgpPeerState="idle",instance="10.0.0.1",job="snmp-cisco-bgp"} 1

and the alert

  - alert: BGPPeer
    expr: bgpPeerAdminStatus{bgpPeerAdminStatus="start"} == 1 and on(instance, bgpPeerRemoteAddr) bgpPeerState{bgpPeerState!="established"} == 1
    for: 1m
    labels:
      team: noc
    annotations:
      summary: "BGP Peer {{ $labels.bgpPeerRemoteAs }} state is {{ $labels.bgpPeerState }}"
      description: "BGP Peer {{ $labels.bgpPeerRemoteAs }} (remote address: {{ $labels.bgpPeerRemoteAddr }}) has state {{ $labels.bgpPeerState }}"

The alert is working, but it doesn't return the bgpPeerState from the RHS of the expression. Writing this I just realised I can reverse the expression and get the peer state, but I guess my question still remains - how can I combine conditions but keep all the labels from both sides even when they don't match? group_left doesn't work with the boolean operators - 'no grouping allowed for "and" operation'

Thanks!

[Boden Garman]

Hi all,

I guess this isn't possible in PromQL

Is there another way to check two conditions for a single alert?

Boden

[Matthias Rampke]

You can't group_left on `and`, but you can on `*` – since in this case both metrics are fixed at 1 anyway it would not make a practical difference to multiply them.

/MR

--
You received this message because you are subscribed to the Google Groups "Prometheus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to prometheus-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-users/1196dbca-f286-49fd-9396-d1d58e879df0%40googlegroups.com.