Metadata functions

These functions derive a new label, or overwrite an existing one, from the values of other labels.

`label_join`

Joins the values of the source labels src_label_1 .. src_label_N using separator and stores the result in the label dst_label. A missing source label contributes an empty string.

The destination can be a new label or an existing stored label (a dimension or __name__).

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. A call over a by(...) aggregation, directly or under topk, bottomk, limitk, or limit_ratio, is supported when the destination is a new label, such as label_replace(sum by (job) (x), "dst", "$1", "job", "(.*)").

Return type

instant_vector

Parameters

v (instant_vector): Instant vector input.
dst_label (scalar): Name of the label to set.
separator (scalar): String inserted between the source values.
src_label (scalar): Name of a label to join (repeatable).

Example

sum by (endpoint) (label_join(http_requests_total, "endpoint", "/", "job", "instance"))

Note

Differences from Prometheus

A call that isn't aggregated or is under without(...), and a destination label named step, which is an output column of the PROMQL command, aren't supported yet.

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. A call over anything other than a by(...) aggregation, such as sum(x), a without(...) aggregation, topk, or a binary operator, and a call that overwrites a grouping label, such as label_replace(sum by (job) (x), "job", "$1", "job", "(.*)"), aren't supported yet. Write a new label instead.

Reading or overwriting __name__ behaves like Prometheus only for Prometheus-style data that stores __name__ as a label; for OpenTelemetry-style metrics the metric name is not exposed as a readable or writable label here.

`label_replace`

Matches the regular expression regex against the value of the label src_label. On a match, sets the label dst_label to the expansion of replacement, substituting $1, $name, and ${name} with the matched capture groups; on no match the input series is returned unchanged.

The destination can be a new label or an existing stored label (a dimension or __name__). Regular expressions use the RE2 engine (RE2 syntax including (?P<name>), $1/$name/${name} replacement expansion, no backreferences, fully anchored as ^(?s:regex)$), matching Prometheus.

Return type

instant_vector

Parameters

v (instant_vector): Instant vector input.
dst_label (scalar): Name of the label to set.
replacement (scalar): Replacement value, with $1/$name/${name} capture-group expansion.
src_label (scalar): Name of the label to read.
regex (scalar): Regular expression matched against src_label.

Example

sum by (job2) (label_replace(http_requests_total, "job2", "$1", "job", "(.*)-server"))

Note

Differences from Prometheus

A call that isn't aggregated or is under without(...), and a destination label named step, which is an output column of the PROMQL command, aren't supported yet.

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. A call over anything other than a by(...) aggregation, such as sum(x), a without(...) aggregation, topk, or a binary operator, and a call that overwrites a grouping label, such as label_replace(sum by (job) (x), "job", "$1", "job", "(.*)"), aren't supported yet. Write a new label instead.