Two Queries in One

Hi Guys!

How can i add two pattern queries in one.

For example y I have this count.

Query One

sum(count_over_time({app="nginx-ingress-microk8s-controller", namespace="ingress"} | pattern `<remote_addr> - - [<time_local>] "<method> / HTTP/<http_version>" <status> <body_bytes_sent> "-" "<user_agent>" <request_time> <query_time> [<referer>] [] <pod_ip>:<pod_port> <server_response_time> <_> <_> <log_id>` | user_agent="curl/8.1.2" | referer=`app-dominio-app-dominio-80` [$__interval]))

And the another one is:

Query Two

sum(count_over_time({app="nginx-ingress-microk8s-controller",namespace="ingress"} | pattern `<remote_addr> - - [<time_local>] "<method> <request> HTTP/<http_version>" <status> <body_bytes_sent> "<user_agent>" <request_time> <_> <_> <_> <status_ingress> [<resource_name>] <_> <_> <_> <log_id>` | method="GET" [$__interval]))

How can i sum both to have the total?

PD: The idea of each query is to count the number of GETs on domain. They are different because the domains are different and because the clients are different.

I understand that the structure is like this:


Once I get each one right, I would want to do something like this: sum(if QUERY1 OR QUERY2 happend)

I am ok?

Guys! I was trying.

Both queries alone work fine!

{app="nginx-ingress-microk8s-controller", namespace="ingress"} 
| pattern `<remote_addr> - - [<time_local>] "<method> <request> HTTP/<http_version>" <status> <body_bytes_sent> "<referer>" "<user_agent>" <request_time> <_> <_> <_> <status_ingress> [<resource_name>] <_> <_> <_> <log_id>`
| method=`GET` |  referer=``


{app="nginx-ingress-microk8s-controller", namespace="ingress"} 
| pattern `<remote_addr> - - [<time_local>] "<method> / HTTP/<http_version>" <status> <body_bytes_sent> "-" "<user_agent>" <request_time> <query_time> [<referer>] [] <pod_ip>:<pod_port> <server_response_time> <_> <_> <log_id>` 
| method=`GET` |  referer=`app-dominio-app-dominio-80`

But i can count both in the same query.

I want to count to create a timeline dashboard…


sum(count_over_time({app="nginx-ingress-microk8s-controller", namespace="ingress"}

| pattern `<remote_addr> - - [<time_local>] "GET / HTTP/<http_version>" <status> <body_bytes_sent> "-" "<user_agent>" <request_time> <query_time> [<referer>] [] <pod_ip>:<pod_port> <server_response_time> <_> <_> <log_id>`

| referer="app-dominio-app-dominio-80"



Can you try ‘Transform’ → ‘Add filed from calculation’


Thanks @gvln5241 .

What do you think of the Queries? To count and sum the GET’s within the interval?


Take a look, if i copy your solution.

The result of Query A its 1, Query B its 13.

I think i need to change the output of the query to a number! Not?

When i choose the fields for the operation, only have {} and time.

Thanks @gvln5241

yes, NaN = Not a Number.
Can you convert to Number type (before using ‘Add field from calculation’ transformation)

And you can change the names also for readability.

1 Like