Wavefront to Prometheus query

Question

I am trying to convert this Wavefront alert to Prometheus:

msum(1200s, sum(ts("receiver.processingDelayInMs" and function="max", cluster="101*")>900000))>2)

This query determines if max latency exceeds 900,000, if yes then output = 1 or else 0 and msum then sums it over 1200s to determine if more than 2 clusters are affected, then send alert. I tried a similar query in Prometheus (same metric but different naming):

    sum_over_time(
  sum(receiver_processingDelay_seconds_max{cluster="101.*"})
  > bool 900
) by (cluster) > bool 1.75

I get error:

bad_data: invalid parameter "query": 1:127: parse error: ranges only allowed for vector selectors bad_data: 1:127: parse error: ranges only allowed for vector selectors

How to fix it?

Answer 1

I'm not familiar with Wavefront, so I don't understand your initial query. But based on your description I suggest:

count(last_over_time(receiver_processingDelay_seconds_max{cluster="101.*"} > 900)[20m:]) >= 2

It gets all time series receiver_processingDelay_seconds_max with value more than 900 and calculates number of present during last 20 minutes.