How to filter out certain series from a subset of timeseries?

Question

We have a lot of series out of which I need to extract a subset and then filter out certain ones. How does one do it in PromQL. Would be great to be able to do it with just one regular expression, but I can't think of any, especially in such limited regex subset, without lookaheads (or something).

I ended up with something like this (real regex is obviously much more complicated):

up{instance=~"^.*:.*"} unless up{instance=~"^.*:10000$"}

Is this how it is done or is there a better best practice?

Answer 1

PromQL allows specifying multiple filters for the same label in a single time series selector. For example, the following query would find up series matching {instance=~"^.*:.*"} and simultaneously not matching {instance=~"^.*:10000$"}:

up{instance=~"^.*:.*", instance!~"^.*:10000$"}

Note that Prometheus automatically adds ^ and $ anchors to the beginning and the end of regexps, so the query can be simplified to:

up{instance=~".*:.*", instance!~".*:10000"}