Prometheus & Grafana cheatsheet

A one-page reference for metrics-based observability. For the full stack — Alertmanager routing, Thanos/Mimir, logs, and APM tradeoffs — see the complete guide.

📖 Full guide: Prometheus & Grafana → 🟠Intermediate

⏱️Learn this in 5 minutes5 min

1. Begin with the Instant vs. range vector card
2. Then the rate() vs irate() and Aggregation cards
3. Treat the other 5 cards as lookups — scan by card title when you need one
4. Open the full guide when a card isn't enough

Instant vs. range vector

http_requests_total          # instant vector: one value per series, now
http_requests_total[5m]      # range vector: samples over the last 5m

Range vectors feed into functions like rate() — you can't graph one directly.

rate() vs irate()

rate(http_requests_total[5m])    # per-second avg — use for alerts/dashboards
irate(http_requests_total[5m])   # last-two-points only — noisy, ad-hoc only

Rule of thumb: window ≥ 4x the scrape interval, or you get NaN/wild swings.

Aggregation

sum(rate(http_requests_total[5m])) by (route)
sum(rate(http_requests_total{status=~"5.."}[5m]))
histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m]))

Golden signals / RED / USE

Framework	Signals
Golden Signals	latency, traffic, errors, saturation
RED (services)	rate, errors, duration
USE (resources)	utilization, saturation, errors

SLIs, SLOs, error budgets

SLI: the measured indicator (e.g. % requests < 300ms)
SLO: the target (e.g. 99.9% over 30 days)
Error budget: 100% - SLO — how much unreliability you can spend

Burn-rate alerts (fast + slow window) catch budget-draining incidents without paging on every blip.

Alerting

- alert: HighErrorRate
  expr: sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m])) > 0.05
  for: 10m
  labels: { severity: page }

Alertmanager handles routing, grouping, dedup, and silences on top of Prometheus's raw alert rules.

Grafana basics

• Dashboards = panels, each backed by a PromQL (or other datasource) query.
• Variables ($env, $instance) make one dashboard reusable across scopes.
• Alerting can live in Grafana itself or be delegated to Alertmanager.

Long-term storage & logs

Thanos/Mimir/Cortex extend Prometheus retention beyond local disk with object-storage backends. Logs (ELK/EFK) and metrics are complementary — metrics tell you something is wrong, logs tell you what.

See: Common Pitfalls