{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/", "slug": "dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it", "url": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/" }, "title": "Preserve a Prometheus discovery label before filtering metrics with it", "summary": "Keep the discovery and post-scrape relabeling stages in the correct order.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:39+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 219, "potentially_affected": "Use this review for an Azure Managed Prometheus PodMonitor or ServiceMonitor filter that depends on target-discovery metadata. Identify the original meta-label, the ordinary label chosen to preserve its value and the intended included targets. Keep this question separate from API migration or alert-rule deployment.", "dse_recommendation": "DSE recommends reviewing the two transformation stages together before changing collection.", "primary_source": { "name": "Create custom Prometheus scrape job from your Kubernetes cluster using CRDs - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-crd", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that discovered targets carry monitor-specific meta-labels and that labels beginning with double underscores are dropped after discovery. To filter metrics using that information, its guide first preserves the value with relabelings, then filters with metricRelabelings. The latter stage runs after scraping and before ingestion. Microsoft Learn.

\n

Applicability

\n

Use this review for an Azure Managed Prometheus PodMonitor or ServiceMonitor filter that depends on target-discovery metadata. Identify the original meta-label, the ordinary label chosen to preserve its value and the intended included targets. Keep this question separate from API migration or alert-rule deployment.

\n

DSE recommendation

\n

DSE recommends reviewing the two transformation stages together before changing collection. Write a small expected-result table containing an included target and an excluded target. Check that the preservation rule produces the exact label read by the later filter. Have the application owner confirm the excluded metrics are intentional before applying the change.

\n

Verification

\n

In a controlled target set, inspect discovery results and the resulting ingested labels. Confirm the preserved value exists where the metric filter expects it, then compare included and excluded series with the table. Investigate a missing target separately from a filtered metric. Retain sanitized label examples and the deployed monitor configuration with the outcome.

\n

Official references

\n

Microsoft Learn: Create custom Prometheus scrape job from your Kubernetes cluster using CRDs.

", "content_text": "Source facts\nMicrosoft states that discovered targets carry monitor-specific meta-labels and that labels beginning with double underscores are dropped after discovery. To filter metrics using that information, its guide first preserves the value with relabelings, then filters with metricRelabelings. The latter stage runs after scraping and before ingestion. Microsoft Learn.\nApplicability\nUse this review for an Azure Managed Prometheus PodMonitor or ServiceMonitor filter that depends on target-discovery metadata. Identify the original meta-label, the ordinary label chosen to preserve its value and the intended included targets. Keep this question separate from API migration or alert-rule deployment.\nDSE recommendation\nDSE recommends reviewing the two transformation stages together before changing collection. Write a small expected-result table containing an included target and an excluded target. Check that the preservation rule produces the exact label read by the later filter. Have the application owner confirm the excluded metrics are intentional before applying the change.\nVerification\nIn a controlled target set, inspect discovery results and the resulting ingested labels. Confirm the preserved value exists where the metric filter expects it, then compare included and excluded series with the table. Investigate a missing target separately from a filtered metric. Retain sanitized label examples and the deployed monitor configuration with the outcome.\nOfficial references\nMicrosoft Learn: Create custom Prometheus scrape job from your Kubernetes cluster using CRDs.", "content_markdown": "## Source facts\n\nMicrosoft states that discovered targets carry monitor-specific meta-labels and that labels beginning with double underscores are dropped after discovery. To filter metrics using that information, its guide first preserves the value with relabelings, then filters with metricRelabelings. The latter stage runs after scraping and before ingestion. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-crd).\n\n## Applicability\n\nUse this review for an Azure Managed Prometheus PodMonitor or ServiceMonitor filter that depends on target-discovery metadata. Identify the original meta-label, the ordinary label chosen to preserve its value and the intended included targets. Keep this question separate from API migration or alert-rule deployment.\n\n## DSE recommendation\n\nDSE recommends reviewing the two transformation stages together before changing collection. Write a small expected-result table containing an included target and an excluded target. Check that the preservation rule produces the exact label read by the later filter. Have the application owner confirm the excluded metrics are intentional before applying the change.\n\n## Verification\n\nIn a controlled target set, inspect discovery results and the resulting ingested labels. Confirm the preserved value exists where the metric filter expects it, then compare included and excluded series with the table. Investigate a missing target separately from a filtered metric. Retain sanitized label examples and the deployed monitor configuration with the outcome.\n\n## Official references\n\n[Microsoft Learn: Create custom Prometheus scrape job from your Kubernetes cluster using CRDs](https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-crd)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/", "url": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve a Prometheus discovery label before filtering metrics with it", "item": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/", "url": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/", "headline": "Preserve a Prometheus discovery label before filtering metrics with it", "description": "Keep the discovery and post-scrape relabeling stages in the correct order.", "abstract": "Keep the discovery and post-scrape relabeling stages in the correct order.", "articleBody": "Source facts\nMicrosoft states that discovered targets carry monitor-specific meta-labels and that labels beginning with double underscores are dropped after discovery. To filter metrics using that information, its guide first preserves the value with relabelings, then filters with metricRelabelings. The latter stage runs after scraping and before ingestion. Microsoft Learn.\nApplicability\nUse this review for an Azure Managed Prometheus PodMonitor or ServiceMonitor filter that depends on target-discovery metadata. Identify the original meta-label, the ordinary label chosen to preserve its value and the intended included targets. Keep this question separate from API migration or alert-rule deployment.\nDSE recommendation\nDSE recommends reviewing the two transformation stages together before changing collection. Write a small expected-result table containing an included target and an excluded target. Check that the preservation rule produces the exact label read by the later filter. Have the application owner confirm the excluded metrics are intentional before applying the change.\nVerification\nIn a controlled target set, inspect discovery results and the resulting ingested labels. Confirm the preserved value exists where the metric filter expects it, then compare included and excluded series with the table. Investigate a missing target separately from a filtered metric. Retain sanitized label examples and the deployed monitor configuration with the outcome.\nOfficial references\nMicrosoft Learn: Create custom Prometheus scrape job from your Kubernetes cluster using CRDs.", "datePublished": "2026-09-17T16:32:39+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-141-preserve-a-prometheus-discovery-label-before-filtering-metrics-with-it/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve a Prometheus discovery label before filtering metrics with it" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 219, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create custom Prometheus scrape job from your Kubernetes cluster using CRDs - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-scrape-crd" } } ] } }