Write expression queries

Server-side expressions enable you to manipulate data returned from queries with math and other operations. Expressions create new data and do not manipulate the data returned by data sources.

About expressions

Server-side expressions allow you to manipulate data returned from queries with math and other operations. Expressions create new data and do not manipulate the data returned by data sources, aside from some minor data restructuring to make the data acceptable input for expressions.

Using expressions

Expressions are primarily used by Grafana Alerting. The processing is done server-side, so expressions can operate without a browser session. However, expressions can also be used with backend data sources and visualization.

Expressions are meant to augment data sources by enabling queries from different data sources to be combined or by providing operations unavailable in a data source.

Expressions work with data source queries that return time series or number data. They also operate on multiple-dimensional data. For example, a query that returns multiple series, where each series is identified by labels or tags.

An individual expression takes one or more queries or other expressions as input and adds data to the result. Each individual expression or query is represented by a variable that is a named identifier known as its RefID (e.g., the default letter A or B).

To reference the output of an individual expression or a data source query in another expression, this identifier is used as a variable.

Types of expressions

Expressions work with two types of data.

Each collection is returned from a single data source query or expression and represented by the RefID. Each collection is a set, where each item in the set is uniquely identified by its dimensions which are stored as labels or key-value pairs.

Data source queries

Server-side expressions only support data source queries for backend data sources. The data is generally assumed to be labeled time series data. In the future we intended to add an assertion of the query return type (number or time series) data so expressions can handle errors better.

Data source queries, when used with expressions, are run by the expression engine. When it does this, it restructures data to be either one time series or one number per data frame. So for example if using a data source that returns multiple series on one frame in the table view, you might notice it looks different when run with expressions.

Currently, the only non-time series format (number) is supported when using data frames are you have a table response that returns a data frame with no time, string columns, and one number column:

The example above will produce a number that works with expressions. The string columns become labels and the number column the corresponding value. For example {"Loc": "MIA", "Host": "A"} with a value of 1.

Operations

You can use the following operations in expressions: math, reduce, and resample.

Math

Math is for free-form math formulas on time series or number data. Math operations take numbers and time series as input and changes them to different numbers and time series.

Data from other queries or expressions are referenced with the RefID prefixed with a dollar sign, for example $A. If the variable has spaces in the name, then you can use a brace syntax like ${my variable}.

Numeric constants can be in decimal (2.24), octal (with a leading zero like 072), or hex (with a leading 0x like 0x2A). Exponentials and signs are also supported (e.g., -0.8e-2).

Operators

The arithmetic (+, binary and unary -, *, /, %, exponent **), relational (<, >, ==, !=, >=, <=), and logical (&&, ||, and unary !) operators are supported.

How the operation behaves with data depends on if it is a number or time series data.

With binary operations, such as $A + $B or $A || $B, the operator is applied in the following ways depending on the type of data:

Summary:

Because expressions work with multiple series or numbers represented by a single variable, binary operations also perform a union (join) between the two variables. This is done based on the identifying labels associated with each individual series or number.

So if you have numbers with labels like {host=web01} in $A and another number in $B with the same labels then the operation is performed between those two items within each variable, and the result will share the same labels. The rules for the behavior of this union are as follows:

The relational and logical operators return 0 for false 1 for true.

Math Functions

While most functions exist in the own expression operations, the math operation does have some functions that similar to math operators or symbols. When functions can take either numbers or series, than the same type as the argument will be returned. When it is a series, the operation of performed for the value of each point in the series.

abs

abs returns the absolute value of its argument which can be a number or a series. For example abs(-1) or abs($A).

is_inf

is_inf takes a number or a series and returns 1 for Inf values (negative or positive) and 0 for other values. For example is_inf($A).

is_nan

is_nan takes a number or a series and returns 1 for NaN values and 0 for other values. For example is_nan($A). This function exists because NaN is not equal to NaN.

is_null

is_null takes a number or a series and returns 1 for null values and 0 for other values. For example is_null($A).

is_number

is_number takes a number or a series and returns 1 for all real number values and 0 for other values (which are null, Inf+, Inf-, and NaN). For example is_number($A).

log

Log returns the natural logarithm of its argument which can be a number or a series. If the value is less than 0, NaN is returned. For example log(-1) or log($A).

inf, infn, nan, and null

The inf, infn, nan, and null functions all return a single value of the name. They primarily exist for testing. Example: null().

round

Round returns a rounded integer value. For example, round(3.123) or round($A).

ceil

Ceil rounds the number up to the nearest integer value. For example, ceil(3.123) returns 4.

floor

Floor rounds the number down to the nearest integer value. For example, floor(3.123) returns 3.

Reduce

Reduce takes one or more time series returned from a query or an expression and turns each series into a single number. The labels of the time series are kept as labels on each outputted reduced number.

Fields:

Reduction Functions

Count

Count returns the number of points in each series.

Mean

Mean returns the total of all values in each series divided by the number of points in that series. In strict mode if any values in the series are null or nan, or if the series is empty, NaN is returned.

Min and Max

Min and Max return the smallest or largest value in the series respectively. In strict mode if any values in the series are null or nan, or if the series is empty, NaN is returned.

Sum

Sum returns the total of all values in the series. If series is of zero length, the sum will be 0. In strict mode if there are any NaN or Null values in the series, NaN is returned.

Last

Last returns the last number in the series. If the series has no values then returns NaN.

Reduction Modes

Strict

In Strict mode the input series is processed as is. If any values in the series are non-numeric (null, NaN or +-Inf), NaN is returned.

Drop Non-Numeric

In this mode all non-numeric values (null, NaN or +-Inf) in the input series are filtered out before running the reduction function.

Replace Non-Numeric

In this mode all non-numeric values are replaced by a pre-defined value.

Resample

Resample changes the time stamps in each time series to have a consistent time interval. The main use case is so you can resample time series that do not share the same timestamps so math can be performed between them. This can be done by resample each of the two series, and then in a Math operation referencing the resampled variables.

Fields:

Write an expression

If your data source supports them, then Grafana displays the Expression button and shows any existing expressions in the query editor list.

Special cases

When any queried data source returns no series or numbers, the expression engine returns NoData. For example, if a request contains two data source queries that are merged by an expression, if NoData is returned by at least one of the data source queries, then the returned result for the entire query is NoData. For more information about how Grafana Alerting processes NoData results, see Handling no data or error cases.