Is there a difference between `| keep` and `by ()`?

Grafana Loki
1

Hi! Consider the following queries:

max_over_time(
   {job="LDCSEC12"}
   | regexp `(?P<time>[^,]*),MinMaxAvg,(?P<category>[^,]*),(?P<name>[^,]*),(?P<count>[^,]*),(?P<min>[^,]*),(?P<avg>[^,]*),`
   | unwrap avg [$__auto]
) by (job)

vs:

max_over_time(
   {job="LDCSEC12"}
   | regexp `(?P<time>[^,]*),MinMaxAvg,(?P<category>[^,]*),(?P<name>[^,]*),(?P<count>[^,]*),(?P<min>[^,]*),(?P<avg>[^,]*),`
   | keep job, avg
   | unwrap avg [$__auto]
)

Is there a difference between them?

I do not see any difference in the results not in execution time. Are they equivalent? Is actually keep slightly preferred, as it removes the labels at an “earlier” (execution wise) step?

2

Functionally the two queries are the same. The keep keyword means to keep the labels specified and discard the rest. Generally not needed in normal queries. The only place I find useful is when creating rules in ruler sometimes you might wish to remove unnecessary labels so they don’t show up in your alert then it becomes useful.

1 Like