Prometheus Certified Associate: PromQL study guide

PromQL tests selection, rate logic, aggregation, and histogram math. Expect questions that ask why a query returns nothing, why a ratio is wrong, or which function handles counter resets.

Core rules

Instant vector selectors return the latest sample; range vectors use [5m]. Matchers support =, !=, =~, !~; regex is fully anchored.
rate() and increase() expect counters and extrapolate over the range; irate() uses the last two samples and is spiky, so prefer rate() for alerts and dashboards. A range should contain at least two samples; use at least 4x the scrape interval.
Aggregate with sum by (label) or sum without (label). Binary matching defaults to exact label sets; use on, ignoring, group_left, and group_right deliberately.
offset shifts query time; @ pins evaluation to a timestamp; subqueries use [range:step].

Worked example

Error ratio: sum(rate(http_requests_total{job='api',status=~'5..'}[5m])) / sum(rate(http_requests_total{job='api'}[5m])) Both sides are summed to a single vector so matching is trivial. Without sum, each label combination divides by its own total, which is usually not the service-wide ratio. Wrap with > 0.05 for an alert.

Histogram p95: histogram_quantile(0.95, sum by (le) (rate(http_request_duration_seconds_bucket[5m]))) The le label must survive aggregation; buckets are cumulative and need +Inf.

Traps

Applying rate() to a gauge.
Averaging already-computed ratios instead of dividing sums.
Using irate() for slow-burn alerts.
Assuming absent() fires when a series exists with value zero; it only fires when no series matches.