Description
This article describes the fundamental application of Prometheus in FortiAnalyzer Big Data for analysis and Monitoring.
This article only provides a general application of Prometheus in FortiAnalyzer Big Data. For advanced applications, refer to Prometheus official documentation: Prometheus.
Scope
FortiAnalyzer Big Data.
Solution
FortiAnalyzer Big Data has implemented Prometheus in the design to ease the work of monitoring and analysis. The feature is located at Cluster Manager -> Monitor -> Log & Metrics -> Metrics (Prometheus) 
In Prometheus, there are four types of metrics to consider:
- COUNTER.
- GAUGE.
- HISTOGRAM.
- SUMMARY.
For more information, refer to METRIC TYPES to understand each of the metrics.
After a basic understanding of the metrics above, it is possible to utilize the query in Prometheus known as PromQL to obtain the data from the database. Prometheus contains multiple functions to query different types of metrics.
Hence, users need to understand the types of metrics and apply the functions accordingly.
Refer to the link below for a list of functions in Prometheus: Query Functions.
The PromQL will follow the format below:
Function_name (Metrics_name {Filter} [time_period])
For example:
rate(kudu_bytes_flushed{kubernetes_node="blade-10-0-1-2"}[5m])
Function_name = rate
Metrics_name = kudu_bytes_flushed
Filter = kubernetes_node="blade-10-0-1-2"
Time_period = 5m
Besides, PromQL supports basic operators for queries with different requirements:
== (equal to)
!= (does not equal)
> (greater than)
< (less than)
>= (greater than or equal to)
<= (less than or equal to)
=~{ A | B} --> return A or B
!~{ A | B} --> return not A or B
.*xxx --> for incomplete string
The example below shows the query to calculate the difference between data at 5m and 10 mins:
Lastly, Prometheus contains Instant Query and Range queries.
- Instant query: when querying Prometheus for a result of an expression on a single timestamp. e.g. for alerting.
- Range query: when querying Prometheus for an expression with start and end timestamps.
Related document:
