{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/apply-prometheus-counter-rate-before-aggregating-instances/", "item": { "id": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/", "slug": "apply-prometheus-counter-rate-before-aggregating-instances", "url": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances.md", "json": "https://update.dsesecurity.com/api/v1/posts/apply-prometheus-counter-rate-before-aggregating-instances/" }, "title": "Apply Prometheus counter rate before aggregating instances", "summary": "Summing counters first can conceal the reset behavior needed for an accurate rate.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:15:40+00:00", "modified_at": "2026-10-20T18:34:33+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 254, "potentially_affected": "Review PromQL counter rate calculation before aggregate functions are applied.", "dse_recommendation": "DSE recommends preserving the original per-instance counter series through rate calculation and aggregating only afterward at the required service level.", "primary_source": { "name": "Prometheus documentation — Query functions", "url": "https://prometheus.io/docs/prometheus/latest/querying/functions/", "published_on": null, "authority": "prometheus.io" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Summing counters first can conceal the reset behavior needed for an accurate rate.

\n

Source facts

\n

Prometheus documents that rate should be applied before aggregation or aggregation-over-time functions. Rate detects counter resets in each input series; aggregating first can prevent that detection when a target restarts. The function is intended for counters rather than arbitrary gauges. Expression order therefore affects the meaning of the resulting operational signal.

\n

Source: Prometheus documentation — Query functions.

\n

Applicability

\n

Review PromQL counter rate calculation before aggregate functions are applied.

\n

DSE recommendation

\n

DSE recommends preserving the original per-instance counter series through rate calculation and aggregating only afterward at the required service level. Review copied dashboard expressions for the order of operations, especially where instances restart independently. Keep metric type and units with the query so a gauge is not accidentally treated as a counter. Choose a window consistent with the scrape interval and the question being answered, and explain the aggregation labels retained in the output.

\n

Verification

\n

In a test dataset, compare the intended expression with one that aggregates raw counters first while a single instance resets. Inspect the per-instance rate and final aggregate against the known test behavior. Confirm the production query retains the required service boundaries without relying on a superficially similar but semantically different expression. Retain the raw per-instance test samples and reset time with both expression results. Ask the metric owner to explain the observed difference and approve the exact aggregation labels before changing a shared dashboard or recording rule.

\n

Official reference

\n

Prometheus documentation — Query functions. Reviewed October 20, 2026.

", "content_text": "Summing counters first can conceal the reset behavior needed for an accurate rate.\nSource facts\nPrometheus documents that rate should be applied before aggregation or aggregation-over-time functions. Rate detects counter resets in each input series; aggregating first can prevent that detection when a target restarts. The function is intended for counters rather than arbitrary gauges. Expression order therefore affects the meaning of the resulting operational signal.\nSource: Prometheus documentation — Query functions.\nApplicability\nReview PromQL counter rate calculation before aggregate functions are applied.\nDSE recommendation\nDSE recommends preserving the original per-instance counter series through rate calculation and aggregating only afterward at the required service level. Review copied dashboard expressions for the order of operations, especially where instances restart independently. Keep metric type and units with the query so a gauge is not accidentally treated as a counter. Choose a window consistent with the scrape interval and the question being answered, and explain the aggregation labels retained in the output.\nVerification\nIn a test dataset, compare the intended expression with one that aggregates raw counters first while a single instance resets. Inspect the per-instance rate and final aggregate against the known test behavior. Confirm the production query retains the required service boundaries without relying on a superficially similar but semantically different expression. Retain the raw per-instance test samples and reset time with both expression results. Ask the metric owner to explain the observed difference and approve the exact aggregation labels before changing a shared dashboard or recording rule.\nOfficial reference\nPrometheus documentation — Query functions. Reviewed October 20, 2026.", "content_markdown": "Summing counters first can conceal the reset behavior needed for an accurate rate.\n\n## Source facts\n\nPrometheus documents that rate should be applied before aggregation or aggregation-over-time functions. Rate detects counter resets in each input series; aggregating first can prevent that detection when a target restarts. The function is intended for counters rather than arbitrary gauges. Expression order therefore affects the meaning of the resulting operational signal.\n\nSource: [Prometheus documentation — Query functions](https://prometheus.io/docs/prometheus/latest/querying/functions/).\n\n## Applicability\n\nReview PromQL counter rate calculation before aggregate functions are applied.\n\n## DSE recommendation\n\nDSE recommends preserving the original per-instance counter series through rate calculation and aggregating only afterward at the required service level. Review copied dashboard expressions for the order of operations, especially where instances restart independently. Keep metric type and units with the query so a gauge is not accidentally treated as a counter. Choose a window consistent with the scrape interval and the question being answered, and explain the aggregation labels retained in the output.\n\n## Verification\n\nIn a test dataset, compare the intended expression with one that aggregates raw counters first while a single instance resets. Inspect the per-instance rate and final aggregate against the known test behavior. Confirm the production query retains the required service boundaries without relying on a superficially similar but semantically different expression. Retain the raw per-instance test samples and reset time with both expression results. Ask the metric owner to explain the observed difference and approve the exact aggregation labels before changing a shared dashboard or recording rule.\n\n## Official reference\n\n[Prometheus documentation — Query functions](https://prometheus.io/docs/prometheus/latest/querying/functions/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/", "url": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "IT", "item": "https://update.dsesecurity.com/topic/it/" }, { "@type": "ListItem", "position": 3, "name": "Apply Prometheus counter rate before aggregating instances", "item": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/#article", "identifier": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/", "url": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/", "headline": "Apply Prometheus counter rate before aggregating instances", "description": "Summing counters first can conceal the reset behavior needed for an accurate rate.", "abstract": "Summing counters first can conceal the reset behavior needed for an accurate rate.", "articleBody": "Summing counters first can conceal the reset behavior needed for an accurate rate.\nSource facts\nPrometheus documents that rate should be applied before aggregation or aggregation-over-time functions. Rate detects counter resets in each input series; aggregating first can prevent that detection when a target restarts. The function is intended for counters rather than arbitrary gauges. Expression order therefore affects the meaning of the resulting operational signal.\nSource: Prometheus documentation — Query functions.\nApplicability\nReview PromQL counter rate calculation before aggregate functions are applied.\nDSE recommendation\nDSE recommends preserving the original per-instance counter series through rate calculation and aggregating only afterward at the required service level. Review copied dashboard expressions for the order of operations, especially where instances restart independently. Keep metric type and units with the query so a gauge is not accidentally treated as a counter. Choose a window consistent with the scrape interval and the question being answered, and explain the aggregation labels retained in the output.\nVerification\nIn a test dataset, compare the intended expression with one that aggregates raw counters first while a single instance resets. Inspect the per-instance rate and final aggregate against the known test behavior. Confirm the production query retains the required service boundaries without relying on a superficially similar but semantically different expression. Retain the raw per-instance test samples and reset time with both expression results. Ask the metric owner to explain the observed difference and approve the exact aggregation labels before changing a shared dashboard or recording rule.\nOfficial reference\nPrometheus documentation — Query functions. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:15:40+00:00", "dateModified": "2026-10-20T18:34:33+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Apply Prometheus counter rate before aggregating instances" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 254, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Prometheus documentation — Query functions", "url": "https://prometheus.io/docs/prometheus/latest/querying/functions/" } } ] } }