Range Aggregations

Most useful queries aggregate logs over time:

• count_over_time({service="api",level="error"}[5m]) — error count last 5 min.
• rate({service="api"}[5m]) — entries/sec rate.
• sum by (status) (count_over_time({service="api"} | json [5m])) — group by status code.

Implementation idea:

For sum by (label):

Step parameter: queries return one data point per step (e.g. step=15s). Backend may store 1m resolution and downsample on demand.

Ranged matrix vs instant: PromQL distinction. [5m] means "the last 5m of points at each evaluation time". The client may evaluate at multiple times to draw a graph.

Cost: aggregations scan ALL matching entries. If service=api has 1B entries, count_over_time reads them all. Solutions:

• Pre-aggregate (sample on ingestion).
• Use approximate counts (HyperLogLog).
• Limit time range.