Logical operators are most easily understood as their set theory counterparts, as shown in the following table. These operators are the only ones in PromQL that work many-to-many. There are three logical operators that can be used between expressions:

The and logical operator works by only returning the matches from the left-hand side if the expression on the right-hand side has results with matching label key/value pairs. All other time series from the left-hand side that do not have a match on the right-hand side are dropped. The resulting time series will keep the name from the left operand. This is why it is also called the intersection operator. The and operator is often used like an if statement: by using the expression on the right as the condition to return the one on the left.

Using the following instant vector as an example, we'll validate the previous statement:

node_filesystem_avail_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/Users"} 1003970
node_filesystem_avail_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/data"} 141200
node_filesystem_size_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/Users"} 2506855
node_filesystem_size_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/data"} 172935

We'll be applying the following expression:

node_filesystem_size_bytes > 100000 and node_filesystem_size_bytes < 200000

This will return the following:

node_filesystem_avail_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/data"} 141200
node_filesystem_size_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/data"} 172935

The union logical operator, or, works by returning the elements from the left-hand side, except if there are no matches, it will return the elements from the right-hand side. Again, both sides need to have matching label names/values.

We can reuse the previous data sample and apply the following expression:

node_filesystem_avail_bytes > 200000 or node_filesystem_avail_bytes < 2500000

The result will be as follows:

node_filesystem_avail_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/Users"} 1003970

Finally, the unless logical operator will return the elements from the first expression that do not match the label name/value pairs from the second. In set theory, this is called a complement. Practically speaking, this operator works in the opposite way to and, which means it can also be used as an if not statement.

Once again, we'll be using the same sample data that we used previously while applying the following expression:

node_filesystem_avail_bytes unless node_filesystem_avail_bytes < 200000

This, in turn, provides us with the following result:

node_filesystem_avail_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/Users"} 1003970
node_filesystem_size_bytes{instance="172.17.0.13:9100", job="node-exporter-service", mountpoint="/Users"} 2506855