From e7e40159edbb604e0707c379a441fc4128e5a47b Mon Sep 17 00:00:00 2001
From: Cyril Tovena <cyril.tovena@gmail.com>
Date: Mon, 7 Dec 2020 17:18:04 +0100
Subject: [PATCH 1/2] Add absent_over_time

This adds absent_over_time which is super useful when alerting, it can be combine with any logql selector including parsers and filter to returns a timeseries with 1  when logs go missing.

Fixes #2893

Signed-off-by: Cyril Tovena <cyril.tovena@gmail.com>
---
 docs/sources/logql/_index.md |   3 +-
 pkg/logql/ast.go             |   5 +-
 pkg/logql/ast_test.go        |   2 +
 pkg/logql/engine_test.go     |  35 +++++
 pkg/logql/evaluator.go       |  91 ++++++++++-
 pkg/logql/expr.y             |   3 +-
 pkg/logql/expr.y.go          | 296 ++++++++++++++++++-----------------
 pkg/logql/functions.go       |   6 +
 pkg/logql/lex.go             |   1 +
 pkg/logql/parser_test.go     |  18 +++
 10 files changed, 308 insertions(+), 152 deletions(-)

diff --git a/docs/sources/logql/_index.md b/docs/sources/logql/_index.md
index b5e28679db17..c65c2245e93d 100644
--- a/docs/sources/logql/_index.md
+++ b/docs/sources/logql/_index.md
@@ -430,8 +430,9 @@ Supported function for operating over unwrapped ranges are:
 - `stdvar_over_time(unwrapped-range)`: the population standard variance of the values in the specified interval.
 - `stddev_over_time(unwrapped-range)`: the population standard deviation of the values in the specified interval.
 - `quantile_over_time(scalar,unwrapped-range)`: the φ-quantile (0 ≤ φ ≤ 1) of the values in the specified interval.
+- `absent_over_time(unwrapped-range)`: returns an empty vector if the range vector passed to it has any elements and a 1-element vector with the value 1 if the range vector passed to it has no elements. (`absent_over_time` is useful for alerting on when no time series and logs stream exist for label combination for a certain amount of time.)
 
-Except for `sum_over_time`, unwrapped range aggregations support grouping.
+Except for `sum_over_time` and `absent_over_time`, unwrapped range aggregations support grouping.
 
 ```logql
 <aggr-op>([parameter,] <unwrapped-range>) [without|by (<label list>)]
diff --git a/pkg/logql/ast.go b/pkg/logql/ast.go
index f2cd49a0bfef..87b0ba3fa5b8 100644
--- a/pkg/logql/ast.go
+++ b/pkg/logql/ast.go
@@ -487,6 +487,7 @@ const (
 	OpRangeTypeStdvar    = "stdvar_over_time"
 	OpRangeTypeStddev    = "stddev_over_time"
 	OpRangeTypeQuantile  = "quantile_over_time"
+	OpRangeTypeAbsent    = "absent_over_time"
 
 	// binops - logical/set
 	OpTypeOr     = "or"
@@ -608,14 +609,14 @@ func (e rangeAggregationExpr) validate() error {
 	}
 	if e.left.unwrap != nil {
 		switch e.operation {
-		case OpRangeTypeAvg, OpRangeTypeSum, OpRangeTypeMax, OpRangeTypeMin, OpRangeTypeStddev, OpRangeTypeStdvar, OpRangeTypeQuantile:
+		case OpRangeTypeAvg, OpRangeTypeSum, OpRangeTypeMax, OpRangeTypeMin, OpRangeTypeStddev, OpRangeTypeStdvar, OpRangeTypeQuantile, OpRangeTypeAbsent:
 			return nil
 		default:
 			return fmt.Errorf("invalid aggregation %s with unwrap", e.operation)
 		}
 	}
 	switch e.operation {
-	case OpRangeTypeBytes, OpRangeTypeBytesRate, OpRangeTypeCount, OpRangeTypeRate:
+	case OpRangeTypeBytes, OpRangeTypeBytesRate, OpRangeTypeCount, OpRangeTypeRate, OpRangeTypeAbsent:
 		return nil
 	default:
 		return fmt.Errorf("invalid aggregation %s without unwrap", e.operation)
diff --git a/pkg/logql/ast_test.go b/pkg/logql/ast_test.go
index e94100bbbb8c..a790024824bc 100644
--- a/pkg/logql/ast_test.go
+++ b/pkg/logql/ast_test.go
@@ -58,6 +58,7 @@ func Test_SampleExpr_String(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []string{
 		`rate( ( {job="mysql"} |="error" !="timeout" ) [10s] )`,
+		`absent_over_time( ( {job="mysql"} |="error" !="timeout" ) [10s] )`,
 		`sum without(a) ( rate ( ( {job="mysql"} |="error" !="timeout" ) [10s] ) )`,
 		`sum by(a) (rate( ( {job="mysql"} |="error" !="timeout" ) [10s] ) )`,
 		`sum(count_over_time({job="mysql"}[5m]))`,
@@ -101,6 +102,7 @@ func Test_SampleExpr_String(t *testing.T) {
 			count_over_time({namespace="tns"} | logfmt | label_format foo=bar[5m])
 		)`,
 		`sum_over_time({namespace="tns"} |= "level=error" | json |foo>=5,bar<25ms | unwrap latency | __error__!~".*" | foo >5[5m])`,
+		`absent_over_time({namespace="tns"} |= "level=error" | json |foo>=5,bar<25ms | unwrap latency | __error__!~".*" | foo >5[5m])`,
 		`sum by (job) (
 			sum_over_time(
 				{namespace="tns"} |= "level=error" | json | avg=5 and bar<25ms | unwrap duration(latency)  | __error__!~".*" [5m]
diff --git a/pkg/logql/engine_test.go b/pkg/logql/engine_test.go
index 343264b3eb7c..18000f68ce32 100644
--- a/pkg/logql/engine_test.go
+++ b/pkg/logql/engine_test.go
@@ -105,6 +105,22 @@ func TestEngine_LogsInstantQuery(t *testing.T) {
 			},
 			promql.Vector{promql.Sample{Point: promql.Point{T: 5 * 60 * 1000, V: 30}, Metric: labels.Labels{labels.Label{Name: "app", Value: "foo"}}}},
 		},
+		{
+			`absent_over_time(({app="foo"} |~".+bar")[5m])`, time.Unix(5*60, 0), logproto.BACKWARD, 10,
+			[][]logproto.Series{
+				{newSeries(testSize, factor(10, identity), `{app="foo"}`)}, // 10 , 20 , 30 .. 300 = 30 total
+			},
+			[]SelectSampleParams{
+				{&logproto.SampleQueryRequest{Start: time.Unix(0, 0), End: time.Unix(5*60, 0), Selector: `absent_over_time({app="foo"}|~".+bar"[5m])`}},
+			},
+			promql.Vector{},
+		},
+		{
+			`absent_over_time(({app="foo"} |~".+bar")[5m])`, time.Unix(5*60, 0), logproto.BACKWARD, 10,
+			[][]logproto.Series{},
+			[]SelectSampleParams{},
+			promql.Vector{promql.Sample{Point: promql.Point{T: 5 * 60 * 1000, V: 1}, Metric: labels.Labels{labels.Label{Name: "app", Value: "foo"}}}},
+		},
 		{
 			`avg(count_over_time({app=~"foo|bar"} |~".+bar" [1m]))`, time.Unix(60, 0), logproto.FORWARD, 100,
 			[][]logproto.Series{
@@ -868,6 +884,22 @@ func TestEngine_RangeQuery(t *testing.T) {
 				},
 			},
 		},
+		{
+			`absent_over_time(({app="foo"} |~".+bar")[1m])`, time.Unix(60, 0), time.Unix(180, 0), 30 * time.Second, 0, logproto.FORWARD, 100,
+			[][]logproto.Series{
+				{newSeries(1, constant(50), `{app="foo"}`)},
+			},
+			[]SelectSampleParams{
+				{&logproto.SampleQueryRequest{Start: time.Unix(0, 0), End: time.Unix(180, 0), Selector: `absent_over_time({app="foo"}|~".+bar"[1m])`}},
+			},
+			promql.Matrix{
+				promql.Series{
+					Metric: labels.Labels{{Name: "app", Value: "foo"}},
+					Points: []promql.Point{
+						{T: 120000, V: 1}, {T: 150000, V: 1}, {T: 180000, V: 1}},
+				},
+			},
+		},
 		{
 			`topk(2,rate(({app=~"foo|bar"} |~".+bar")[1m]))`, time.Unix(60, 0), time.Unix(180, 0), 30 * time.Second, 0, logproto.FORWARD, 100,
 			[][]logproto.Series{
@@ -1836,6 +1868,9 @@ func (q *querierRecorder) SelectSamples(ctx context.Context, p SelectSampleParam
 		}
 	}
 	recordID := paramsID(p)
+	if len(q.series) == 0 {
+		return iter.NoopIterator, nil
+	}
 	series, ok := q.series[recordID]
 	if !ok {
 		return nil, fmt.Errorf("no series found for id: %s has: %+v", recordID, q.series)
diff --git a/pkg/logql/evaluator.go b/pkg/logql/evaluator.go
index d32de9ed1b52..1b499fe5b64c 100644
--- a/pkg/logql/evaluator.go
+++ b/pkg/logql/evaluator.go
@@ -417,14 +417,21 @@ func rangeAggEvaluator(
 	if err != nil {
 		return nil, err
 	}
+	iter := newRangeVectorIterator(
+		it,
+		expr.left.interval.Nanoseconds(),
+		q.Step().Nanoseconds(),
+		q.Start().UnixNano(), q.End().UnixNano(),
+	)
+	if expr.operation == OpRangeTypeAbsent {
+		return &absentRangeVectorEvaluator{
+			iter: iter,
+			lbs:  absentLabels(expr),
+		}, nil
+	}
 	return &rangeVectorEvaluator{
-		iter: newRangeVectorIterator(
-			it,
-			expr.left.interval.Nanoseconds(),
-			q.Step().Nanoseconds(),
-			q.Start().UnixNano(), q.End().UnixNano(),
-		),
-		agg: agg,
+		iter: iter,
+		agg:  agg,
 	}, nil
 }
 
@@ -460,6 +467,50 @@ func (r rangeVectorEvaluator) Error() error {
 	return r.iter.Error()
 }
 
+type absentRangeVectorEvaluator struct {
+	iter RangeVectorIterator
+	lbs  labels.Labels
+
+	err error
+}
+
+func (r *absentRangeVectorEvaluator) Next() (bool, int64, promql.Vector) {
+	next := r.iter.Next()
+	if !next {
+		return false, 0, promql.Vector{}
+	}
+	ts, vec := r.iter.At(one)
+	for _, s := range vec {
+		// Errors are not allowed in metrics.
+		if s.Metric.Has(log.ErrorLabel) {
+			r.err = newPipelineErr(s.Metric)
+			return false, 0, promql.Vector{}
+		}
+	}
+	if len(vec) > 0 {
+		return next, ts, promql.Vector{}
+	}
+	// values are missing.
+	return next, ts, promql.Vector{
+		promql.Sample{
+			Point: promql.Point{
+				T: ts,
+				V: 1.,
+			},
+			Metric: r.lbs,
+		},
+	}
+}
+
+func (r absentRangeVectorEvaluator) Close() error { return r.iter.Close() }
+
+func (r absentRangeVectorEvaluator) Error() error {
+	if r.err != nil {
+		return r.err
+	}
+	return r.iter.Error()
+}
+
 // binOpExpr explicitly does not handle when both legs are literals as
 // it makes the type system simpler and these are reduced in mustNewBinOpExpr
 func binOpStepEvaluator(
@@ -898,3 +949,29 @@ func literalStepEvaluator(
 		eval.Error,
 	)
 }
+
+func absentLabels(expr SampleExpr) labels.Labels {
+	m := labels.Labels{}
+
+	lm := expr.Selector().Matchers()
+	if len(lm) == 0 {
+		return m
+	}
+
+	empty := []string{}
+	for _, ma := range lm {
+		if ma.Name == labels.MetricName {
+			continue
+		}
+		if ma.Type == labels.MatchEqual && !m.Has(ma.Name) {
+			m = labels.NewBuilder(m).Set(ma.Name, ma.Value).Labels()
+		} else {
+			empty = append(empty, ma.Name)
+		}
+	}
+
+	for _, v := range empty {
+		m = labels.NewBuilder(m).Del(v).Labels()
+	}
+	return m
+}
diff --git a/pkg/logql/expr.y b/pkg/logql/expr.y
index fd6a2be995a9..efd4f07e6e1b 100644
--- a/pkg/logql/expr.y
+++ b/pkg/logql/expr.y
@@ -90,7 +90,7 @@ import (
                   OPEN_PARENTHESIS CLOSE_PARENTHESIS BY WITHOUT COUNT_OVER_TIME RATE SUM AVG MAX MIN COUNT STDDEV STDVAR BOTTOMK TOPK
                   BYTES_OVER_TIME BYTES_RATE BOOL JSON REGEXP LOGFMT PIPE LINE_FMT LABEL_FMT UNWRAP AVG_OVER_TIME SUM_OVER_TIME MIN_OVER_TIME
                   MAX_OVER_TIME STDVAR_OVER_TIME STDDEV_OVER_TIME QUANTILE_OVER_TIME BYTES_CONV DURATION_CONV DURATION_SECONDS_CONV
-
+                  ABSENT_OVER_TIME
 // Operators are listed with increasing precedence.
 %left <binOp> OR
 %left <binOp> AND UNLESS
@@ -331,6 +331,7 @@ rangeOp:
     | STDVAR_OVER_TIME   { $$ = OpRangeTypeStdvar }
     | STDDEV_OVER_TIME   { $$ = OpRangeTypeStddev }
     | QUANTILE_OVER_TIME { $$ = OpRangeTypeQuantile }
+    | ABSENT_OVER_TIME   { $$ = OpRangeTypeAbsent }
     ;
 
 
diff --git a/pkg/logql/expr.y.go b/pkg/logql/expr.y.go
index 8c37220aee78..1dbefb14f2c9 100644
--- a/pkg/logql/expr.y.go
+++ b/pkg/logql/expr.y.go
@@ -107,21 +107,22 @@ const QUANTILE_OVER_TIME = 57396
 const BYTES_CONV = 57397
 const DURATION_CONV = 57398
 const DURATION_SECONDS_CONV = 57399
-const OR = 57400
-const AND = 57401
-const UNLESS = 57402
-const CMP_EQ = 57403
-const NEQ = 57404
-const LT = 57405
-const LTE = 57406
-const GT = 57407
-const GTE = 57408
-const ADD = 57409
-const SUB = 57410
-const MUL = 57411
-const DIV = 57412
-const MOD = 57413
-const POW = 57414
+const ABSENT_OVER_TIME = 57400
+const OR = 57401
+const AND = 57402
+const UNLESS = 57403
+const CMP_EQ = 57404
+const NEQ = 57405
+const LT = 57406
+const LTE = 57407
+const GT = 57408
+const GTE = 57409
+const ADD = 57410
+const SUB = 57411
+const MUL = 57412
+const DIV = 57413
+const MOD = 57414
+const POW = 57415
 
 var exprToknames = [...]string{
 	"$end",
@@ -181,6 +182,7 @@ var exprToknames = [...]string{
 	"BYTES_CONV",
 	"DURATION_CONV",
 	"DURATION_SECONDS_CONV",
+	"ABSENT_OVER_TIME",
 	"OR",
 	"AND",
 	"UNLESS",
@@ -203,7 +205,7 @@ const exprEofCode = 1
 const exprErrCode = 2
 const exprInitialStackSize = 16
 
-//line pkg/logql/expr.y:348
+//line pkg/logql/expr.y:349
 
 //line yacctab:1
 var exprExca = [...]int{
@@ -214,86 +216,88 @@ var exprExca = [...]int{
 
 const exprPrivate = 57344
 
-const exprLast = 400
+const exprLast = 402
 
 var exprAct = [...]int{
 
-	70, 171, 53, 153, 145, 4, 179, 100, 63, 2,
-	52, 45, 61, 56, 5, 219, 120, 216, 237, 66,
-	14, 40, 41, 42, 43, 44, 45, 252, 11, 42,
-	43, 44, 45, 255, 237, 215, 6, 76, 259, 215,
-	17, 18, 28, 29, 31, 32, 30, 33, 34, 35,
-	36, 19, 20, 216, 244, 91, 116, 118, 119, 247,
-	94, 21, 22, 23, 24, 25, 26, 27, 92, 216,
-	216, 71, 72, 226, 216, 124, 155, 118, 119, 176,
-	15, 16, 167, 122, 129, 167, 130, 131, 132, 133,
+	71, 172, 54, 154, 146, 4, 180, 101, 64, 2,
+	53, 46, 62, 57, 5, 220, 121, 217, 253, 67,
+	107, 14, 41, 42, 43, 44, 45, 46, 77, 11,
+	43, 44, 45, 46, 148, 238, 216, 6, 104, 188,
+	260, 17, 18, 29, 30, 32, 33, 31, 34, 35,
+	36, 37, 19, 20, 239, 228, 92, 117, 119, 120,
+	230, 95, 21, 22, 23, 24, 25, 26, 27, 93,
+	217, 217, 28, 60, 149, 147, 125, 156, 119, 120,
+	58, 59, 15, 16, 123, 130, 248, 131, 132, 133,
 	134, 135, 136, 137, 138, 139, 140, 141, 142, 143,
-	69, 167, 71, 72, 234, 181, 117, 223, 150, 46,
-	47, 50, 51, 48, 49, 40, 41, 42, 43, 44,
-	45, 111, 162, 168, 183, 161, 156, 159, 160, 157,
-	158, 110, 178, 172, 250, 182, 217, 227, 174, 59,
-	175, 59, 229, 128, 127, 227, 57, 58, 57, 58,
-	228, 184, 185, 186, 37, 38, 39, 46, 47, 50,
-	51, 48, 49, 40, 41, 42, 43, 44, 45, 211,
-	126, 173, 213, 106, 218, 91, 221, 224, 94, 68,
-	188, 214, 11, 225, 122, 222, 212, 60, 181, 60,
-	123, 103, 230, 38, 39, 46, 47, 50, 51, 48,
-	49, 40, 41, 42, 43, 44, 45, 180, 177, 169,
-	115, 189, 258, 254, 217, 121, 235, 91, 238, 59,
-	113, 236, 74, 11, 246, 91, 57, 58, 170, 245,
-	125, 123, 73, 59, 112, 249, 253, 114, 11, 243,
-	57, 58, 166, 220, 231, 251, 6, 154, 256, 173,
-	17, 18, 28, 29, 31, 32, 30, 33, 34, 35,
-	36, 19, 20, 173, 106, 232, 233, 60, 240, 241,
-	242, 21, 22, 23, 24, 25, 26, 27, 147, 59,
-	170, 60, 103, 165, 164, 59, 57, 58, 59, 163,
-	15, 16, 57, 58, 106, 57, 58, 209, 75, 106,
-	210, 208, 106, 206, 3, 106, 207, 205, 151, 173,
-	149, 62, 103, 147, 144, 173, 147, 103, 55, 147,
-	103, 187, 194, 103, 164, 195, 193, 60, 109, 257,
-	97, 99, 98, 60, 104, 105, 60, 77, 78, 79,
-	80, 81, 82, 83, 84, 85, 86, 87, 88, 89,
-	90, 106, 148, 146, 65, 148, 146, 67, 191, 146,
-	163, 192, 190, 203, 101, 248, 204, 202, 200, 103,
-	197, 201, 199, 198, 196, 67, 154, 152, 96, 95,
-	54, 107, 102, 108, 93, 10, 9, 97, 99, 98,
-	13, 104, 105, 219, 8, 239, 12, 7, 64, 1,
+	144, 72, 73, 174, 241, 242, 243, 182, 118, 151,
+	47, 48, 51, 52, 49, 50, 41, 42, 43, 44,
+	45, 46, 61, 163, 227, 177, 184, 162, 157, 160,
+	161, 158, 159, 179, 173, 112, 183, 218, 111, 175,
+	60, 176, 60, 70, 251, 72, 73, 58, 59, 58,
+	59, 189, 185, 186, 187, 38, 39, 40, 47, 48,
+	51, 52, 49, 50, 41, 42, 43, 44, 45, 46,
+	212, 129, 174, 214, 128, 219, 92, 222, 225, 95,
+	127, 69, 215, 178, 226, 123, 223, 213, 168, 61,
+	168, 61, 182, 231, 39, 40, 47, 48, 51, 52,
+	49, 50, 41, 42, 43, 44, 45, 46, 238, 228,
+	235, 181, 224, 168, 229, 218, 122, 236, 92, 107,
+	60, 170, 237, 256, 11, 247, 92, 58, 59, 171,
+	246, 126, 124, 148, 60, 169, 250, 104, 116, 11,
+	190, 58, 59, 217, 221, 259, 252, 6, 107, 257,
+	174, 17, 18, 29, 30, 32, 33, 31, 34, 35,
+	36, 37, 19, 20, 174, 216, 104, 107, 255, 61,
+	254, 75, 21, 22, 23, 24, 25, 26, 27, 60,
+	245, 148, 28, 61, 171, 104, 58, 59, 74, 60,
+	114, 244, 15, 16, 11, 107, 58, 59, 107, 76,
+	217, 3, 124, 167, 113, 233, 234, 115, 63, 56,
+	166, 210, 148, 104, 211, 209, 104, 232, 165, 174,
+	155, 149, 147, 195, 164, 165, 196, 194, 61, 152,
+	150, 98, 100, 99, 145, 105, 106, 220, 61, 78,
+	79, 80, 81, 82, 83, 84, 85, 86, 87, 88,
+	89, 90, 91, 147, 107, 192, 110, 164, 193, 191,
+	207, 102, 204, 208, 206, 205, 203, 201, 153, 258,
+	202, 200, 104, 198, 97, 66, 199, 197, 68, 249,
+	68, 155, 96, 55, 108, 103, 109, 94, 10, 9,
+	98, 100, 99, 13, 105, 106, 8, 240, 12, 7,
+	65, 1,
 }
 var exprPact = [...]int{
 
-	13, -1000, 96, -1000, -1000, 274, 13, -1000, -1000, -1000,
-	-1000, 352, 156, 77, -1000, 225, 215, -1000, -1000, -1000,
+	14, -1000, 96, -1000, -1000, 265, 14, -1000, -1000, -1000,
+	-1000, 373, 158, 120, -1000, 281, 264, -1000, -1000, -1000,
 	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
-	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -3, -3, -3,
-	-3, -3, -3, -3, -3, -3, -3, -3, -3, -3,
-	-3, -3, 274, -1000, 125, 289, 322, -1000, -1000, -1000,
-	-1000, 107, 97, 96, 218, 194, -1000, 44, 208, 223,
-	147, 121, 120, -1000, -1000, 13, -1000, 13, 13, 13,
-	13, 13, 13, 13, 13, 13, 13, 13, 13, 13,
-	13, -1000, 308, -1000, 294, -1000, -1000, -1000, -1000, 304,
-	-1000, -1000, -1000, 168, 302, 371, 64, -1000, -1000, -1000,
-	-1000, -1000, -1000, -1000, 370, -1000, 283, 278, 277, 236,
-	99, 190, 271, 167, 55, 189, 13, 183, 100, 134,
-	48, 48, -40, -40, -61, -61, -61, -61, -46, -46,
-	-46, -46, -46, -46, -1000, 294, 168, 168, 168, -1000,
-	297, -1000, 161, -1000, 199, 354, 318, 366, 364, 359,
-	299, 293, -1000, -1000, -1000, -1000, -1000, -1000, 46, 167,
-	265, 26, 127, 346, 219, 83, 46, 13, 49, 126,
-	-1000, -1000, 118, -1000, 259, 294, 300, -1000, 242, 260,
+	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -12, -12,
+	-12, -12, -12, -12, -12, -12, -12, -12, -12, -12,
+	-12, -12, -12, 265, -1000, 126, 349, 350, -1000, -1000,
+	-1000, -1000, 114, 111, 96, 288, 222, -1000, 45, 209,
+	224, 157, 151, 148, -1000, -1000, 14, -1000, 14, 14,
+	14, 14, 14, 14, 14, 14, 14, 14, 14, 14,
+	14, 14, -1000, 328, -1000, 262, -1000, -1000, -1000, -1000,
+	324, -1000, -1000, -1000, 243, 323, 376, 65, -1000, -1000,
+	-1000, -1000, -1000, -1000, -1000, 375, -1000, 318, 312, 304,
+	297, 211, 202, 275, 279, 101, 164, 14, 187, 102,
+	134, 48, 48, -40, -40, -62, -62, -62, -62, -46,
+	-46, -46, -46, -46, -46, -1000, 262, 243, 243, 243,
+	-1000, 15, -1000, 132, -1000, 228, 351, 319, 369, 363,
+	358, 356, 307, -1000, -1000, -1000, -1000, -1000, -1000, 76,
+	279, 59, 27, 128, 290, 220, 188, 76, 14, 100,
+	190, -1000, -1000, 36, -1000, 214, 262, 293, -1000, 315,
+	300, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
 	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
-	-1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000, -1000,
-	-1000, -1000, 80, -27, 265, -1000, 168, -1000, 25, 213,
-	230, 30, 205, -1000, -1000, 35, -1000, 360, -1000, -1000,
-	-1000, -1000, -1000, -1000, 46, -27, 294, -1000, -1000, 111,
-	-1000, -1000, -1000, -17, 227, 204, 9, 46, -1000, -1000,
-	324, -27, -32, -1000, -1000, 203, -1000, 14, -1000, -1000,
+	-1000, -1000, -1000, 186, -27, 59, -1000, 243, -1000, 26,
+	49, 282, 256, 206, -1000, -1000, 62, -1000, 374, -1000,
+	-1000, -1000, -1000, -1000, -1000, 76, -27, 262, -1000, -1000,
+	121, -1000, -1000, -1000, -26, 261, 259, 199, 76, -1000,
+	-1000, 364, -27, -32, -1000, -1000, 236, -1000, 16, -1000,
+	-1000,
 }
 var exprPgo = [...]int{
 
-	0, 399, 8, 13, 0, 6, 304, 5, 16, 7,
-	398, 397, 396, 395, 14, 394, 390, 386, 385, 298,
-	384, 10, 2, 383, 382, 381, 4, 380, 379, 378,
-	3, 377, 1, 364,
+	0, 401, 8, 13, 0, 6, 301, 5, 16, 7,
+	400, 399, 398, 397, 14, 396, 393, 389, 388, 299,
+	387, 10, 2, 386, 385, 384, 4, 383, 382, 374,
+	3, 368, 1, 361,
 }
 var exprR1 = [...]int{
 
@@ -311,7 +315,8 @@ var exprR1 = [...]int{
 	17, 17, 17, 17, 17, 17, 17, 17, 17, 19,
 	19, 18, 18, 18, 16, 16, 16, 16, 16, 16,
 	16, 16, 16, 12, 12, 12, 12, 12, 12, 12,
-	12, 12, 12, 12, 5, 5, 4, 4, 4, 4,
+	12, 12, 12, 12, 12, 5, 5, 4, 4, 4,
+	4,
 }
 var exprR2 = [...]int{
 
@@ -329,65 +334,68 @@ var exprR2 = [...]int{
 	4, 4, 4, 4, 4, 4, 4, 4, 4, 0,
 	1, 1, 2, 2, 1, 1, 1, 1, 1, 1,
 	1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
-	1, 1, 1, 1, 1, 3, 4, 4, 3, 3,
+	1, 1, 1, 1, 1, 1, 3, 4, 4, 3,
+	3,
 }
 var exprChk = [...]int{
 
 	-1000, -1, -2, -6, -7, -14, 23, -11, -15, -17,
-	-18, 15, -12, -16, 7, 67, 68, 27, 28, 38,
-	39, 48, 49, 50, 51, 52, 53, 54, 29, 30,
-	33, 31, 32, 34, 35, 36, 37, 58, 59, 60,
-	67, 68, 69, 70, 71, 72, 61, 62, 65, 66,
-	63, 64, -21, -22, -27, 44, -3, 21, 22, 14,
-	62, -7, -6, -2, -10, 2, -9, 5, 23, 23,
-	-4, 25, 26, 7, 7, -19, 40, -19, -19, -19,
+	-18, 15, -12, -16, 7, 68, 69, 27, 28, 38,
+	39, 48, 49, 50, 51, 52, 53, 54, 58, 29,
+	30, 33, 31, 32, 34, 35, 36, 37, 59, 60,
+	61, 68, 69, 70, 71, 72, 73, 62, 63, 66,
+	67, 64, 65, -21, -22, -27, 44, -3, 21, 22,
+	14, 63, -7, -6, -2, -10, 2, -9, 5, 23,
+	23, -4, 25, 26, 7, 7, -19, 40, -19, -19,
 	-19, -19, -19, -19, -19, -19, -19, -19, -19, -19,
-	-19, -22, -3, -20, -26, -28, -29, 41, 43, 42,
-	-9, -33, -24, 23, 45, 46, 5, -25, -23, 6,
-	24, 24, 16, 2, 19, 16, 12, 62, 13, 14,
-	-8, 7, -14, 23, -7, 7, 23, 23, 23, -2,
+	-19, -19, -22, -3, -20, -26, -28, -29, 41, 43,
+	42, -9, -33, -24, 23, 45, 46, 5, -25, -23,
+	6, 24, 24, 16, 2, 19, 16, 12, 63, 13,
+	14, -8, 7, -14, 23, -7, 7, 23, 23, 23,
 	-2, -2, -2, -2, -2, -2, -2, -2, -2, -2,
-	-2, -2, -2, -2, 6, -26, 59, 19, 58, 6,
-	-26, 6, -31, -30, 5, 12, 62, 65, 66, 63,
-	64, 61, -9, 6, 6, 6, 6, 2, 24, 19,
-	9, -32, -21, 44, -14, -8, 24, 19, -7, -5,
-	24, 5, -5, 24, -26, -26, -26, 24, 19, 12,
+	-2, -2, -2, -2, -2, 6, -26, 60, 19, 59,
+	6, -26, 6, -31, -30, 5, 12, 63, 66, 67,
+	64, 65, 62, -9, 6, 6, 6, 6, 2, 24,
+	19, 9, -32, -21, 44, -14, -8, 24, 19, -7,
+	-5, 24, 5, -5, 24, -26, -26, -26, 24, 19,
+	12, 8, 4, 7, 8, 4, 7, 8, 4, 7,
 	8, 4, 7, 8, 4, 7, 8, 4, 7, 8,
-	4, 7, 8, 4, 7, 8, 4, 7, 8, 4,
-	7, -4, -8, -32, -21, 9, 44, 9, -32, 47,
-	24, -32, -21, 24, -4, -7, 24, 19, 24, 24,
-	-30, 2, 5, 6, 24, -32, -26, 9, 5, -13,
-	55, 56, 57, 9, 24, 24, -32, 24, 5, -4,
-	23, -32, 44, 9, 9, 24, -4, 5, 9, 24,
+	4, 7, -4, -8, -32, -21, 9, 44, 9, -32,
+	47, 24, -32, -21, 24, -4, -7, 24, 19, 24,
+	24, -30, 2, 5, 6, 24, -32, -26, 9, 5,
+	-13, 55, 56, 57, 9, 24, 24, -32, 24, 5,
+	-4, 23, -32, 44, 9, 9, 24, -4, 5, 9,
+	24,
 }
 var exprDef = [...]int{
 
 	0, -2, 1, 2, 3, 9, 0, 4, 5, 6,
 	7, 0, 0, 0, 121, 0, 0, 133, 134, 135,
-	136, 137, 138, 139, 140, 141, 142, 143, 124, 125,
-	126, 127, 128, 129, 130, 131, 132, 119, 119, 119,
+	136, 137, 138, 139, 140, 141, 142, 143, 144, 124,
+	125, 126, 127, 128, 129, 130, 131, 132, 119, 119,
 	119, 119, 119, 119, 119, 119, 119, 119, 119, 119,
-	119, 119, 10, 54, 56, 0, 0, 41, 42, 43,
-	44, 3, 2, 0, 0, 0, 48, 0, 0, 0,
-	0, 0, 0, 122, 123, 0, 120, 0, 0, 0,
+	119, 119, 119, 10, 54, 56, 0, 0, 41, 42,
+	43, 44, 3, 2, 0, 0, 0, 48, 0, 0,
+	0, 0, 0, 0, 122, 123, 0, 120, 0, 0,
 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-	0, 55, 0, 57, 58, 59, 60, 63, 64, 0,
-	73, 74, 75, 0, 0, 0, 0, 81, 82, 61,
-	8, 11, 45, 46, 0, 47, 0, 0, 0, 0,
-	0, 0, 0, 0, 3, 121, 0, 0, 0, 104,
-	105, 106, 107, 108, 109, 110, 111, 112, 113, 114,
-	115, 116, 117, 118, 62, 77, 0, 0, 0, 65,
-	0, 66, 72, 69, 0, 0, 0, 0, 0, 0,
-	0, 0, 49, 50, 51, 52, 53, 25, 32, 0,
-	12, 0, 0, 0, 0, 0, 36, 0, 3, 0,
-	148, 144, 0, 149, 78, 79, 80, 76, 0, 0,
-	88, 95, 102, 87, 94, 101, 83, 90, 97, 84,
-	91, 98, 85, 92, 99, 86, 93, 100, 89, 96,
-	103, 34, 0, 14, 22, 16, 0, 18, 0, 0,
-	0, 0, 0, 24, 38, 3, 37, 0, 146, 147,
-	70, 71, 67, 68, 33, 23, 28, 20, 26, 0,
-	29, 30, 31, 13, 0, 0, 0, 39, 145, 35,
-	0, 15, 0, 17, 19, 0, 40, 0, 21, 27,
+	0, 0, 55, 0, 57, 58, 59, 60, 63, 64,
+	0, 73, 74, 75, 0, 0, 0, 0, 81, 82,
+	61, 8, 11, 45, 46, 0, 47, 0, 0, 0,
+	0, 0, 0, 0, 0, 3, 121, 0, 0, 0,
+	104, 105, 106, 107, 108, 109, 110, 111, 112, 113,
+	114, 115, 116, 117, 118, 62, 77, 0, 0, 0,
+	65, 0, 66, 72, 69, 0, 0, 0, 0, 0,
+	0, 0, 0, 49, 50, 51, 52, 53, 25, 32,
+	0, 12, 0, 0, 0, 0, 0, 36, 0, 3,
+	0, 149, 145, 0, 150, 78, 79, 80, 76, 0,
+	0, 88, 95, 102, 87, 94, 101, 83, 90, 97,
+	84, 91, 98, 85, 92, 99, 86, 93, 100, 89,
+	96, 103, 34, 0, 14, 22, 16, 0, 18, 0,
+	0, 0, 0, 0, 24, 38, 3, 37, 0, 147,
+	148, 70, 71, 67, 68, 33, 23, 28, 20, 26,
+	0, 29, 30, 31, 13, 0, 0, 0, 39, 146,
+	35, 0, 15, 0, 17, 19, 0, 40, 0, 21,
+	27,
 }
 var exprTok1 = [...]int{
 
@@ -402,7 +410,7 @@ var exprTok2 = [...]int{
 	42, 43, 44, 45, 46, 47, 48, 49, 50, 51,
 	52, 53, 54, 55, 56, 57, 58, 59, 60, 61,
 	62, 63, 64, 65, 66, 67, 68, 69, 70, 71,
-	72,
+	72, 73,
 }
 var exprTok3 = [...]int{
 	0,
@@ -1592,37 +1600,43 @@ exprdefault:
 		}
 	case 144:
 		exprDollar = exprS[exprpt-1 : exprpt+1]
-//line pkg/logql/expr.y:338
+//line pkg/logql/expr.y:334
 		{
-			exprVAL.Labels = []string{exprDollar[1].str}
+			exprVAL.RangeOp = OpRangeTypeAbsent
 		}
 	case 145:
-		exprDollar = exprS[exprpt-3 : exprpt+1]
+		exprDollar = exprS[exprpt-1 : exprpt+1]
 //line pkg/logql/expr.y:339
 		{
-			exprVAL.Labels = append(exprDollar[1].Labels, exprDollar[3].str)
+			exprVAL.Labels = []string{exprDollar[1].str}
 		}
 	case 146:
-		exprDollar = exprS[exprpt-4 : exprpt+1]
-//line pkg/logql/expr.y:343
+		exprDollar = exprS[exprpt-3 : exprpt+1]
+//line pkg/logql/expr.y:340
 		{
-			exprVAL.Grouping = &grouping{without: false, groups: exprDollar[3].Labels}
+			exprVAL.Labels = append(exprDollar[1].Labels, exprDollar[3].str)
 		}
 	case 147:
 		exprDollar = exprS[exprpt-4 : exprpt+1]
 //line pkg/logql/expr.y:344
 		{
-			exprVAL.Grouping = &grouping{without: true, groups: exprDollar[3].Labels}
+			exprVAL.Grouping = &grouping{without: false, groups: exprDollar[3].Labels}
 		}
 	case 148:
-		exprDollar = exprS[exprpt-3 : exprpt+1]
+		exprDollar = exprS[exprpt-4 : exprpt+1]
 //line pkg/logql/expr.y:345
 		{
-			exprVAL.Grouping = &grouping{without: false, groups: nil}
+			exprVAL.Grouping = &grouping{without: true, groups: exprDollar[3].Labels}
 		}
 	case 149:
 		exprDollar = exprS[exprpt-3 : exprpt+1]
 //line pkg/logql/expr.y:346
+		{
+			exprVAL.Grouping = &grouping{without: false, groups: nil}
+		}
+	case 150:
+		exprDollar = exprS[exprpt-3 : exprpt+1]
+//line pkg/logql/expr.y:347
 		{
 			exprVAL.Grouping = &grouping{without: true, groups: nil}
 		}
diff --git a/pkg/logql/functions.go b/pkg/logql/functions.go
index 0db954588f99..b274c4ed438d 100644
--- a/pkg/logql/functions.go
+++ b/pkg/logql/functions.go
@@ -105,6 +105,8 @@ func (r rangeAggregationExpr) aggregator() (RangeVectorAggregator, error) {
 		return stdvarOverTime, nil
 	case OpRangeTypeQuantile:
 		return quantileOverTime(*r.params), nil
+	case OpRangeTypeAbsent:
+		return one, nil
 	default:
 		return nil, fmt.Errorf(unsupportedErr, r.operation)
 	}
@@ -244,3 +246,7 @@ func quantile(q float64, values vectorByValueHeap) float64 {
 	weight := rank - math.Floor(rank)
 	return values[int(lowerIndex)].V*(1-weight) + values[int(upperIndex)].V*weight
 }
+
+func one(samples []promql.Point) float64 {
+	return 1.0
+}
diff --git a/pkg/logql/lex.go b/pkg/logql/lex.go
index 86112235600e..8a5ac67717e8 100644
--- a/pkg/logql/lex.go
+++ b/pkg/logql/lex.go
@@ -73,6 +73,7 @@ var functionTokens = map[string]int{
 	OpRangeTypeStdvar:    STDVAR_OVER_TIME,
 	OpRangeTypeStddev:    STDDEV_OVER_TIME,
 	OpRangeTypeQuantile:  QUANTILE_OVER_TIME,
+	OpRangeTypeAbsent:    ABSENT_OVER_TIME,
 
 	// vec ops
 	OpTypeSum:     SUM,
diff --git a/pkg/logql/parser_test.go b/pkg/logql/parser_test.go
index 2049c743242c..d2554848db83 100644
--- a/pkg/logql/parser_test.go
+++ b/pkg/logql/parser_test.go
@@ -152,6 +152,16 @@ func TestParse(t *testing.T) {
 				operation: "count_over_time",
 			},
 		},
+		{
+			in: `absent_over_time({ foo !~ "bar" }[1w])`,
+			exp: &rangeAggregationExpr{
+				left: &logRange{
+					left:     &matchersExpr{matchers: []*labels.Matcher{mustNewMatcher(labels.MatchNotRegexp, "foo", "bar")}},
+					interval: 7 * 24 * time.Hour,
+				},
+				operation: OpRangeTypeAbsent,
+			},
+		},
 		{
 			in: `sum(rate({ foo !~ "bar" }[5h]))`,
 			exp: mustNewVectorAggregationExpr(&rangeAggregationExpr{
@@ -275,6 +285,14 @@ func TestParse(t *testing.T) {
 				col:  1,
 			},
 		},
+		{
+			in: `absent_over_time({ foo !~ "bar" }[5h]) by (foo)`,
+			err: ParseError{
+				msg:  "grouping not allowed for absent_over_time aggregation",
+				line: 0,
+				col:  0,
+			},
+		},
 		{
 			in: `rate({ foo !~ "bar" }[5minutes])`,
 			err: ParseError{

From f3c0cf79a0584ce632b8a3856a9479393dfb234f Mon Sep 17 00:00:00 2001
From: Cyril Tovena <cyril.tovena@gmail.com>
Date: Mon, 7 Dec 2020 17:25:33 +0100
Subject: [PATCH 2/2] Adds comment.

Signed-off-by: Cyril Tovena <cyril.tovena@gmail.com>
---
 pkg/logql/evaluator.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkg/logql/evaluator.go b/pkg/logql/evaluator.go
index 1b499fe5b64c..9a4dbafa9b80 100644
--- a/pkg/logql/evaluator.go
+++ b/pkg/logql/evaluator.go
@@ -950,6 +950,8 @@ func literalStepEvaluator(
 	)
 }
 
+// absentLabels guesses labels based on labels matchers of a SampleExpr
+// This is to replace missing timeseries during absent_over_time aggregation.
 func absentLabels(expr SampleExpr) labels.Labels {
 	m := labels.Labels{}