prompt

.github/workflows/build.yml

@@ -65,7 +65,7 @@ jobs:
             arch: amd64
     steps:
       - name: Code checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 
@@ -73,19 +73,11 @@ jobs:
         id: go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
-          cache: false
+          cache-dependency-path: |
+            go.sum
+            Makefile
+            app/**/Makefile
           go-version-file: 'go.mod'
-
-      - name: Cache Go build artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: go-build-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('go.sum', 'Makefile') }}
-          restore-keys: |
-            go-build-${{ matrix.os }}-${{ matrix.arch }}-
-
       - run: go version
 
       - name: Build victoria-metrics for ${{ matrix.os }}-${{ matrix.arch }}

.github/workflows/changelog-linter.yml

@@ -13,7 +13,7 @@ jobs:
       contents: read
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           # needed for proper diff
           fetch-depth: 0

.github/workflows/check-commit-signed.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0  # we need full history for commit verification
           persist-credentials: false

.github/workflows/check-licenses.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Code checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/codeql-analysis-go.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 
@@ -54,14 +54,14 @@ jobs:
           restore-keys: go-artifacts-${{ runner.os }}-codeql-analyze-${{ steps.go.outputs.go-version }}-
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a  # v4.36.3
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7  # v4.35.3
         with:
           category: 'language:go'

.github/workflows/docs.yaml

@@ -18,13 +18,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Code checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           path: __vm
           persist-credentials: false
 
       - name: Checkout private code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: VictoriaMetrics/vmdocs
           token: ${{ secrets.VM_BOT_GH_TOKEN }}

.github/workflows/test.yml

@@ -34,7 +34,7 @@ jobs:
     runs-on: 'vm-runner'
     steps:
       - name: Code checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 
@@ -79,7 +79,7 @@ jobs:
 
     steps:
       - name: Code checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 
@@ -106,7 +106,7 @@ jobs:
 
     steps:
       - name: Code checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/vmui.yml

@@ -26,11 +26,13 @@ jobs:
   vmui-checks:
     name: VMUI Checks (lint, test, typecheck)
     permissions:
+      checks: write
       contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     steps:
       - name: Code checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 
@@ -68,6 +70,12 @@ jobs:
         env:
           VMUI_SKIP_INSTALL: true
 
+      - name: Annotate Code Linting Results
+        uses: ataylorme/eslint-annotate-action@d57a1193d4c59cbfbf3f86c271f42612f9dbd9e9  # 3.0.0
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          report-json: app/vmui/packages/vmui/vmui-lint-report.json
+
       - name: Check overall status
         run: |
           echo "Lint status: ${{ steps.lint.outcome }}"

.golangci.yml

@@ -23,4 +23,3 @@ linters:
         text: 'SA(4003|1019|5011):'
     paths:
       - ^app/vmui/
-      - app/vmui/packages/vmui/node_modules/

Makefile

@@ -447,7 +447,7 @@ vet:
 	go vet ./app/...
 	go vet ./apptest/...
 
-check-all: fmt vet golangci-lint
+check-all: fmt vet golangci-lint govulncheck
 
 clean-checkers: remove-golangci-lint remove-govulncheck
 
@@ -471,9 +471,8 @@ test-full-386:
 
 apptest:
 	$(MAKE) victoria-metrics-race vmagent-race vmalert-race vmauth-race vmctl-race vmbackup-race vmrestore-race
-	go test ./apptest/... -skip="^Test(Cluster|Mixed|Legacy).*"
+	go test ./apptest/... -skip="^Test(Cluster|Legacy).*"
 
-# App tests for legacy indexDB
 apptest-legacy: victoria-metrics-race vmbackup-race vmrestore-race
 	OS=$$(uname | tr '[:upper:]' '[:lower:]'); \
 	ARCH=$$(uname -m | tr '[:upper:]' '[:lower:]' | sed 's/x86_64/amd64/'); \
@@ -490,22 +489,6 @@ apptest-legacy: victoria-metrics-race vmbackup-race vmrestore-race
 	VMSTORAGE_V1_132_0_PATH=$${DIR}/vmstorage-prod \
 	go test ./apptest/tests -run="^TestLegacySingle.*"
 
-# App tests for mixed setups where vmsingle and vmcluster coexist.
-apptest-mixed: victoria-metrics-race
-	OS=$$(uname | tr '[:upper:]' '[:lower:]'); \
-	ARCH=$$(uname -m | tr '[:upper:]' '[:lower:]' | sed 's/x86_64/amd64/'); \
-	VERSION=v1.147.0; \
-	VMSINGLE=victoria-metrics-$${OS}-$${ARCH}-$${VERSION}.tar.gz; \
-	VMCLUSTER=victoria-metrics-$${OS}-$${ARCH}-$${VERSION}-cluster.tar.gz; \
-	URL=https://github.com/VictoriaMetrics/VictoriaMetrics/releases/download/$${VERSION}; \
-	DIR=/tmp/$${VERSION}; \
-	test -d $${DIR} || (mkdir $${DIR} && \
-		curl --output-dir /tmp -LO $${URL}/$${VMSINGLE} && tar xzf /tmp/$${VMSINGLE} -C $${DIR} && \
-		curl --output-dir /tmp -LO $${URL}/$${VMCLUSTER} && tar xzf /tmp/$${VMCLUSTER} -C $${DIR} \
-	); \
-	VMSELECT_PATH=$${DIR}/vmselect-prod \
-	go test ./apptest/tests -run="^TestMixed.*"
-
 benchmark:
 	go test -run=NO_TESTS -bench=. ./lib/...
 	go test -run=NO_TESTS -bench=. ./app/...

README.md

@@ -2,6 +2,7 @@
 
 [![Latest Release](https://img.shields.io/github/v/release/VictoriaMetrics/VictoriaMetrics?sort=semver&label=&filter=!*-victorialogs&logo=github&labelColor=gray&color=gray&link=https%3A%2F%2Fgithub.com%2FVictoriaMetrics%2FVictoriaMetrics%2Freleases%2Flatest)](https://github.com/VictoriaMetrics/VictoriaMetrics/releases)
 [![Docker Pulls](https://img.shields.io/docker/pulls/victoriametrics/victoria-metrics?label=&logo=docker&logoColor=white&labelColor=2496ED&color=2496ED&link=https%3A%2F%2Fhub.docker.com%2Fr%2Fvictoriametrics%2Fvictoria-metrics)](https://hub.docker.com/u/victoriametrics)
+[![Go Report](https://goreportcard.com/badge/github.com/VictoriaMetrics/VictoriaMetrics?link=https%3A%2F%2Fgoreportcard.com%2Freport%2Fgithub.com%2FVictoriaMetrics%2FVictoriaMetrics)](https://goreportcard.com/report/github.com/VictoriaMetrics/VictoriaMetrics)
 [![Build Status](https://github.com/VictoriaMetrics/VictoriaMetrics/actions/workflows/build.yml/badge.svg?branch=master&link=https%3A%2F%2Fgithub.com%2FVictoriaMetrics%2FVictoriaMetrics%2Factions)](https://github.com/VictoriaMetrics/VictoriaMetrics/actions/workflows/build.yml)
 [![License](https://img.shields.io/github/license/VictoriaMetrics/VictoriaMetrics?labelColor=green&label=&link=https%3A%2F%2Fgithub.com%2FVictoriaMetrics%2FVictoriaMetrics%2Fblob%2Fmaster%2FLICENSE)](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/LICENSE)
 [![Join Slack](https://img.shields.io/badge/Join%20Slack-4A154B?logo=slack)](https://slack.victoriametrics.com)
@@ -41,8 +42,8 @@ VictoriaMetrics is optimized for timeseries data, even when old time series are
 * **Ideal for big data**: Works well with large amounts of time series data from APM, Kubernetes, IoT sensors, connected cars, industrial telemetry, financial data and various [Enterprise workloads](https://docs.victoriametrics.com/victoriametrics/enterprise/).
 * **Query language**: Supports both PromQL and the more performant MetricsQL.
 * **Easy to setup**: No dependencies, single [small binary](https://medium.com/@valyala/stripping-dependency-bloat-in-victoriametrics-docker-image-983fb5912b0d), configuration through command-line flags, but the default is also fine-tuned; backup and restore with [instant snapshots](https://medium.com/@valyala/how-victoriametrics-makes-instant-snapshots-for-multi-terabyte-time-series-data-e1f3fb0e0282).
-* **Global query view**: Multiple Prometheus instances or any other data sources may ingest data into VictoriaMetrics and be queried via a single query.
-* **Various Protocols**: Support metric scraping, ingestion and backfilling in various protocols.
+* **Global query view**: Multiple Prometheus instances or any other data sources may ingest data into VictoriaMetrics and queried via a single query.
+* **Various Protocols**: Support metric scraping, ingestion and backfilling in various protocol.
     * [Prometheus exporters](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#how-to-scrape-prometheus-exporters-such-as-node-exporter), [Prometheus remote write API](https://docs.victoriametrics.com/victoriametrics/integrations/prometheus/), [Prometheus exposition format](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#how-to-import-data-in-prometheus-exposition-format).
     * [InfluxDB line protocol](https://docs.victoriametrics.com/victoriametrics/integrations/influxdb/) over HTTP, TCP and UDP.
     * [Graphite plaintext protocol](https://docs.victoriametrics.com/victoriametrics/integrations/graphite/#ingesting) with [tags](https://graphite.readthedocs.io/en/latest/tags.html#carbon).
@@ -78,7 +79,7 @@ We strictly apply security measures in everything we do. VictoriaMetrics has ach
 Some good benchmarks VictoriaMetrics achieved:
 
 * **Minimal memory footprint**: handling millions of unique timeseries with [10x less RAM](https://medium.com/@valyala/insert-benchmarks-with-inch-influxdb-vs-victoriametrics-e31a41ae2893) than InfluxDB, up to [7x less RAM](https://valyala.medium.com/prometheus-vs-victoriametrics-benchmark-on-node-exporter-metrics-4ca29c75590f) than Prometheus, Thanos or Cortex.
-* **Highly scalable and performant** for [data ingestion](https://medium.com/@valyala/high-cardinality-tsdb-benchmarks-victoriametrics-vs-timescaledb-vs-influxdb-13e6ee64dd6b) and [querying](https://medium.com/@valyala/when-size-matters-benchmarking-victoriametrics-vs-timescale-and-influxdb-6035811952d4), [20x outperforms](https://medium.com/@valyala/insert-benchmarks-with-inch-influxdb-vs-victoriametrics-e31a41ae2893) InfluxDB and TimescaleDB.
+* **Highly scalable and performance** for [data ingestion](https://medium.com/@valyala/high-cardinality-tsdb-benchmarks-victoriametrics-vs-timescaledb-vs-influxdb-13e6ee64dd6b) and [querying](https://medium.com/@valyala/when-size-matters-benchmarking-victoriametrics-vs-timescale-and-influxdb-6035811952d4), [20x outperforms](https://medium.com/@valyala/insert-benchmarks-with-inch-influxdb-vs-victoriametrics-e31a41ae2893) InfluxDB and TimescaleDB.
 * **High data compression**: [70x more data points](https://medium.com/@valyala/when-size-matters-benchmarking-victoriametrics-vs-timescale-and-influxdb-6035811952d4) may be stored into limited storage than TimescaleDB, [7x less storage](https://valyala.medium.com/prometheus-vs-victoriametrics-benchmark-on-node-exporter-metrics-4ca29c75590f) space is required than Prometheus, Thanos or Cortex.
 * **Reducing storage costs**: [10x more effective](https://docs.victoriametrics.com/victoriametrics/casestudies/#grammarly) than Graphite according to the Grammarly case study.
 * **A single-node VictoriaMetrics** can replace medium-sized clusters built with competing solutions such as Thanos, M3DB, Cortex, InfluxDB or TimescaleDB. See [VictoriaMetrics vs Thanos](https://medium.com/@valyala/comparing-thanos-to-victoriametrics-cluster-b193bea1683), [Measuring vertical scalability](https://medium.com/@valyala/measuring-vertical-scalability-for-time-series-databases-in-google-cloud-92550d78d8ae), [Remote write storage wars - PromCon 2019](https://promcon.io/2019-munich/talks/remote-write-storage-wars/).
@@ -86,7 +87,7 @@ Some good benchmarks VictoriaMetrics achieved:
 
 ## Community and contributions
 
-Feel free to ask any questions regarding VictoriaMetrics:
+Feel free asking any questions regarding VictoriaMetrics:
 
 * [Slack Inviter](https://slack.victoriametrics.com/) and [Slack channel](https://victoriametrics.slack.com/)
 * [X (Twitter)](https://x.com/VictoriaMetrics/)

app/victoria-metrics/main.go

@@ -22,7 +22,6 @@ import (
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/procutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promscrape"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/pushmetrics"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/querytracer/push"
 )
 
 var (
@@ -64,7 +63,6 @@ func main() {
 	flag.CommandLine.SetOutput(os.Stdout)
 	flag.Usage = usage
 	envflag.Parse()
-	initSecretFlags()
 	buildinfo.Init()
 	logger.Init()
 
@@ -91,7 +89,7 @@ func main() {
 	}
 	logger.Infof("starting VictoriaMetrics at %q...", listenAddrs)
 	startTime := time.Now()
-	vmstorage.Init(*vmselectMaxConcurrentRequests, *vmselectMaxQueueDuration, promql.ResetRollupResultCacheIfNeeded)
+	vmstorage.Init(*vmselectMaxConcurrentRequests, promql.ResetRollupResultCacheIfNeeded)
 	vmselect.Init(*vmselectMaxConcurrentRequests, *vmselectMaxQueueDuration)
 	vminsertcommon.StartIngestionRateLimiter(*maxIngestionRate)
 	vminsert.Init()
@@ -104,10 +102,8 @@ func main() {
 	logger.Infof("started VictoriaMetrics in %.3f seconds", time.Since(startTime).Seconds())
 
 	pushmetrics.Init()
-	push.Init()
 	sig := procutil.WaitForSigterm()
 	logger.Infof("received signal %s", sig)
-	push.Stop()
 	pushmetrics.Stop()
 
 	stopSelfScraper()
@@ -174,9 +170,3 @@ See the docs at https://docs.victoriametrics.com/victoriametrics/
 `
 	flagutil.Usage(s)
 }
-
-// initSecretFlags manages the secret flags for this app and must be called after flag parsing and before logger init.
-func initSecretFlags() {
-	pushmetrics.InitSecretFlags()
-	vmselect.InitSecretFlags()
-}

app/vmagent/influx/request_handler.go

@@ -51,7 +51,7 @@ func InsertHandlerForHTTP(at *auth.Token, req *http.Request) error {
 	}
 	q := req.URL.Query()
 	precision := q.Get("precision")
-	// Read db tag from https://docs.influxdata.com/influxdb/v1/api/write/#operation/PostWrite
+	// Read db tag from https://docs.influxdata.com/influxdb/v1.7/tools/api/#write-http-endpoint
 	db := q.Get("db")
 	encoding := req.Header.Get("Content-Encoding")
 	isStreamMode := req.Header.Get("Stream-Mode") == "1"

app/vmagent/main.go

@@ -84,7 +84,7 @@ var (
 	maxLabelNameLen        = flag.Int("maxLabelNameLen", 0, "The maximum length of label names in the accepted time series. Series with longer label name are ignored. In this case the vm_rows_ignored_total{reason=\"too_long_label_name\"} metric at /metrics page is incremented")
 	maxLabelValueLen       = flag.Int("maxLabelValueLen", 0, "The maximum length of label values in the accepted time series. Series with longer label value are ignored. In this case the vm_rows_ignored_total{reason=\"too_long_label_value\"} metric at /metrics page is incremented")
 
-	enableMultitenancyViaHeaders = flag.Bool("enableMultitenancyViaHeaders", true, "Enables multitenancy via HTTP headers. "+
+	enableMultitenancyViaHeaders = flag.Bool("enableMultitenancyViaHeaders", false, "Enables multitenancy via HTTP headers. "+
 		"See https://docs.victoriametrics.com/victoriametrics/vmagent/#multitenancy")
 )
 
@@ -115,7 +115,7 @@ func main() {
 	flag.CommandLine.SetOutput(os.Stdout)
 	flag.Usage = usage
 	envflag.Parse()
-	initSecretFlags()
+	remotewrite.InitSecretFlags()
 	buildinfo.Init()
 	logger.Init()
 	opentelemetry.Init()
@@ -462,9 +462,7 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool {
 		return true
 	case "/prometheus/metric-relabel-debug", "/metric-relabel-debug":
 		promscrapeMetricRelabelDebugRequests.Inc()
-		rwGlobalRelabelConfigs := remotewrite.GetRemoteWriteRelabelConfigString()
-		rwURLRelabelConfigss := remotewrite.GetURLRelabelConfigString()
-		promscrape.WriteMetricRelabelDebug(w, r, rwGlobalRelabelConfigs, rwURLRelabelConfigss)
+		promscrape.WriteMetricRelabelDebug(w, r)
 		return true
 	case "/prometheus/target-relabel-debug", "/target-relabel-debug":
 		promscrapeTargetRelabelDebugRequests.Inc()
@@ -843,9 +841,3 @@ See the docs at https://docs.victoriametrics.com/victoriametrics/vmagent/ .
 `
 	flagutil.Usage(s)
 }
-
-// initSecretFlags manages the secret flags for this app and must be called after flag parsing and before logger init.
-func initSecretFlags() {
-	remotewrite.InitSecretFlags()
-	pushmetrics.InitSecretFlags()
-}

app/vmagent/opentelemetry/request_handler.go

@@ -63,7 +63,6 @@ func insertRows(at *auth.Token, tss []prompb.TimeSeries, mms []prompb.MetricMeta
 
 	rowsTotal := 0
 	tssDst := ctx.WriteRequest.Timeseries[:0]
-	mmsDst := ctx.WriteRequest.Metadata[:0]
 	labels := ctx.Labels[:0]
 	samples := ctx.Samples[:0]
 	for i := range tss {
@@ -83,19 +82,7 @@ func insertRows(at *auth.Token, tss []prompb.TimeSeries, mms []prompb.MetricMeta
 
 	var metadataTotal int
 	if prommetadata.IsEnabled() {
-		for i := range mms {
-			mm := &mms[i]
-			mmsDst = append(mmsDst, prompb.MetricMetadata{
-				MetricFamilyName: mm.MetricFamilyName,
-				Help:             mm.Help,
-				Type:             mm.Type,
-				Unit:             mm.Unit,
-
-				AccountID: mm.AccountID,
-				ProjectID: mm.ProjectID,
-			})
-		}
-		ctx.WriteRequest.Metadata = mmsDst
+		ctx.WriteRequest.Metadata = mms
 		metadataTotal = len(mms)
 	}
 

app/vmagent/prometheusimport/request_handler_test.go

@@ -52,7 +52,6 @@ func setUp() {
 
 func tearDown() {
 	protoparserutil.StopUnmarshalWorkers()
-	remotewrite.Stop()
 	srv.Close()
 	logger.ResetOutputForTest()
 	tmpDataDir := flag.Lookup("remoteWrite.tmpDataPath").Value.String()

app/vmagent/promremotewrite/request_handler.go

@@ -35,9 +35,6 @@ func InsertHandler(at *auth.Token, req *http.Request) error {
 }
 
 func insertRows(at *auth.Token, timeseries []prompb.TimeSeries, mms []prompb.MetricMetadata, extraLabels []prompb.Label) error {
-	if len(extraLabels) == 0 && !prommetadata.IsEnabled() && at == nil {
-		return insertRowsFast(at, timeseries)
-	}
 	ctx := common.GetPushCtx()
 	defer common.PutPushCtx(ctx)
 
@@ -105,17 +102,3 @@ func insertRows(at *auth.Token, timeseries []prompb.TimeSeries, mms []prompb.Met
 	rowsPerInsert.Update(float64(rowsTotal))
 	return nil
 }
-
-func insertRowsFast(at *auth.Token, timeseries []prompb.TimeSeries) error {
-	rowsTotal := 0
-	for i := range timeseries {
-		rowsTotal += len(timeseries[i].Samples)
-	}
-	wr := &prompb.WriteRequest{Timeseries: timeseries}
-	if !remotewrite.TryPush(at, wr) {
-		return remotewrite.ErrQueueFullHTTPRetry
-	}
-	rowsInserted.Add(rowsTotal)
-	rowsPerInsert.Update(float64(rowsTotal))
-	return nil
-}

app/vmagent/remotewrite/client.go

@@ -151,23 +151,17 @@ func newHTTPClient(argIdx int, remoteWriteURL, sanitizedURL string, fq *persiste
 		}
 		tr.Proxy = http.ProxyURL(pu)
 	}
-
 	hc := &http.Client{
 		Transport: authCfg.NewRoundTripper(tr),
 		Timeout:   sendTimeout.GetOptionalArg(argIdx),
 	}
-	rwURL, err := url.Parse(remoteWriteURL)
-	if err != nil {
-		logger.Fatalf("BUG: cannot parse already parsed -remoteWrite.url=%q: %s", remoteWriteURL, err)
-	}
-	hc.Transport, rwURL = httputil.NewLoadBalancerTransport(hc.Transport, rwURL)
 	retryMaxIntervalFlag := retryMaxTime
 	if retryMaxInterval.String() != "" {
 		retryMaxIntervalFlag = retryMaxInterval
 	}
 	c := &client{
 		sanitizedURL:     sanitizedURL,
-		remoteWriteURL:   rwURL.String(),
+		remoteWriteURL:   remoteWriteURL,
 		authCfg:          authCfg,
 		awsCfg:           awsCfg,
 		fq:               fq,
@@ -193,7 +187,7 @@ func newHTTPClient(argIdx int, remoteWriteURL, sanitizedURL string, fq *persiste
 	return c
 }
 
-func (c *client) init(argIdx int, sanitizedURL string) {
+func (c *client) init(argIdx, concurrency int, sanitizedURL string) {
 	limitReached := metrics.GetOrCreateCounter(fmt.Sprintf(`vmagent_remotewrite_rate_limit_reached_total{url=%q}`, c.sanitizedURL))
 	if bytesPerSec := rateLimit.GetOptionalArg(argIdx); bytesPerSec > 0 {
 		logger.Infof("applying %d bytes per second rate limit for -remoteWrite.url=%q", bytesPerSec, sanitizedURL)
@@ -210,20 +204,11 @@ func (c *client) init(argIdx int, sanitizedURL string) {
 	c.packetsDropped = metrics.GetOrCreateCounter(fmt.Sprintf(`vmagent_remotewrite_packets_dropped_total{url=%q}`, c.sanitizedURL))
 	c.retriesCount = metrics.GetOrCreateCounter(fmt.Sprintf(`vmagent_remotewrite_retries_count_total{url=%q}`, c.sanitizedURL))
 	c.sendDuration = metrics.GetOrCreateFloatCounter(fmt.Sprintf(`vmagent_remotewrite_send_duration_seconds_total{url=%q}`, c.sanitizedURL))
-	workers := queues.GetOptionalArg(argIdx)
-	if workers <= 0 {
-		workers = 1
-	}
-	inmemoryWorkers := inmemoryQueues.GetOptionalArg(argIdx)
-	for range inmemoryWorkers {
-		c.wg.Go(func() {
-			c.runWorker(c.fq.MustReadInMemoryBlockBlocking)
-		})
-	}
-	for range workers {
-		c.wg.Go(func() {
-			c.runWorker(c.fq.MustReadBlock)
-		})
+	metrics.GetOrCreateGauge(fmt.Sprintf(`vmagent_remotewrite_queues{url=%q}`, c.sanitizedURL), func() float64 {
+		return float64(concurrency)
+	})
+	for range concurrency {
+		c.wg.Go(c.runWorker)
 	}
 	logger.Infof("initialized client for -remoteWrite.url=%q", c.sanitizedURL)
 }
@@ -317,12 +302,12 @@ func getAWSAPIConfig(argIdx int) (*awsapi.Config, error) {
 	return cfg, nil
 }
 
-func (c *client) runWorker(readBlock func(dst []byte) ([]byte, bool)) {
+func (c *client) runWorker() {
 	var ok bool
 	var block []byte
 	ch := make(chan bool, 1)
 	for {
-		block, ok = readBlock(block[:0])
+		block, ok = c.fq.MustReadBlock(block[:0])
 		if !ok {
 			return
 		}

app/vmagent/remotewrite/obfuscate.go

@@ -1,108 +0,0 @@
-package remotewrite
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"slices"
-	"strings"
-	"sync"
-
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/bytesutil"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/prompb"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promrelabel"
-)
-
-type obfuscateLabelsCtx struct {
-	labels []prompb.Label
-
-	// buf holds allocations for cached results below
-	buf []byte
-
-	// cacheResults maps original label values to their SHA-256 hex digests,
-	// avoiding redundant hashing of repeated values within a single batch.
-	cacheResults map[string]string
-}
-
-func (olctx *obfuscateLabelsCtx) reset() {
-	promrelabel.CleanLabels(olctx.labels)
-	olctx.labels = olctx.labels[:0]
-	clear(olctx.cacheResults)
-	olctx.buf = olctx.buf[:0]
-}
-
-var obfuscateLabelsCtxPool = &sync.Pool{
-	New: func() any {
-		return &obfuscateLabelsCtx{
-			cacheResults: make(map[string]string),
-		}
-	},
-}
-
-func getObfuscateLabelsCtx() *obfuscateLabelsCtx {
-	return obfuscateLabelsCtxPool.Get().(*obfuscateLabelsCtx)
-}
-
-func putObfuscateLabelsCtx(ctx *obfuscateLabelsCtx) {
-	ctx.reset()
-	obfuscateLabelsCtxPool.Put(ctx)
-}
-
-func (olctx *obfuscateLabelsCtx) obfuscate(tss []prompb.TimeSeries, obfuscateLabels []string) []prompb.TimeSeries {
-	if len(obfuscateLabels) == 0 || len(tss) == 0 {
-		return tss
-	}
-	labels := olctx.labels
-	for i := range tss {
-		ts := &tss[i]
-		labelsLen := len(labels)
-		labels = append(labels, ts.Labels...)
-		found := false
-		for _, labelName := range obfuscateLabels {
-			tmp := promrelabel.GetLabelByName(labels[labelsLen:], labelName)
-			if tmp == nil {
-				continue
-			}
-			found = true
-			if obfuscatedValue, ok := olctx.cacheResults[tmp.Value]; ok {
-				// fast path: the obfuscated result was calculated before
-				tmp.Value = obfuscatedValue
-				continue
-			}
-
-			digest := sha256.Sum256(bytesutil.ToUnsafeBytes(tmp.Value))
-			buf := olctx.buf
-			bufLen := len(buf)
-			buf = hex.AppendEncode(buf, digest[:])
-			obfuscatedValue := bytesutil.ToUnsafeString(buf[bufLen:])
-
-			olctx.buf = buf
-			olctx.cacheResults[tmp.Value] = obfuscatedValue
-			tmp.Value = obfuscatedValue
-		}
-		if found {
-			ts.Labels = labels[labelsLen:]
-		} else {
-			labels = labels[:labelsLen]
-		}
-	}
-	olctx.labels = labels
-	return tss
-}
-
-func (rwctx *remoteWriteCtx) initObfuscateLabels() {
-	if len(*obfuscateLabels) == 0 {
-		return
-	}
-	idx := rwctx.idx
-	rwObfuscateLabels := obfuscateLabels.GetOptionalArg(idx)
-	rwObfuscateLabelsList := strings.Split(rwObfuscateLabels, "^^")
-
-	for _, label := range rwObfuscateLabelsList {
-		if label == "" {
-			continue
-		}
-		if !slices.Contains(rwctx.obfuscateLabels, label) {
-			rwctx.obfuscateLabels = append(rwctx.obfuscateLabels, label)
-		}
-	}
-}

app/vmagent/remotewrite/obfuscate_test.go

@@ -1,186 +0,0 @@
-package remotewrite
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"reflect"
-	"testing"
-
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/prompb"
-
-	"github.com/VictoriaMetrics/metrics"
-)
-
-func TestRemoteWriteObfuscateLabels(t *testing.T) {
-	f := func(obfuscateLabelList string, inputTss []prompb.TimeSeries, expectedTss []prompb.TimeSeries) {
-		t.Helper()
-		rwctx := &remoteWriteCtx{
-			idx: 0,
-		}
-		olctx := &obfuscateLabelsCtx{
-			cacheResults: make(map[string]string),
-		}
-		defer metrics.UnregisterAllMetrics()
-		originValue := *obfuscateLabels
-		defer func() {
-			*obfuscateLabels = originValue
-		}()
-		*obfuscateLabels = []string{obfuscateLabelList}
-		rwctx.initObfuscateLabels()
-
-		outputTss := olctx.obfuscate(inputTss, rwctx.obfuscateLabels)
-
-		if !reflect.DeepEqual(expectedTss, outputTss) {
-			t.Fatalf("unexpected samples;\ngot\n%v\nwant\n%v", outputTss, expectedTss)
-		}
-	}
-
-	sha256Result := func(str string) string {
-		sha256Result := sha256.Sum256([]byte(str))
-		return hex.EncodeToString(sha256Result[:])
-	}
-
-	// 1. obfuscation is not set.
-	f("",
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: "123"},
-					{Name: "instance", Value: "1234"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: "123"},
-					{Name: "instance", Value: "1234"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-	)
-
-	// 1. obfuscation is set for another rwctx.
-	f(",ip",
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: "123"},
-					{Name: "instance", Value: "1234"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: "123"},
-					{Name: "instance", Value: "1234"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-	)
-
-	// 2. obfuscate the value of "ip" label
-	f("ip",
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: "123"},
-					{Name: "instance", Value: "1234"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: sha256Result("123")},
-					{Name: "instance", Value: "1234"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-	)
-
-	// 3. obfuscate the values of "ip" and "instance"
-	f("ip^^instance",
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: "123"},
-					{Name: "instance", Value: "1234"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-			{
-				Labels: []prompb.Label{
-					{Name: "job", Value: "123"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: sha256Result("123")},
-					{Name: "instance", Value: sha256Result("1234")},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-			{
-				Labels: []prompb.Label{
-					{Name: "job", Value: "123"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-	)
-
-	// 4. duplicate label names in config must produce single SHA-256, not double
-	f("ip^^ip",
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: "123"},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-		[]prompb.TimeSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "ip", Value: sha256Result("123")},
-				},
-				Samples: []prompb.Sample{
-					{Value: 1, Timestamp: 0},
-				},
-			},
-		},
-	)
-}

app/vmagent/remotewrite/obfuscate_timing_test.go

@@ -1,94 +0,0 @@
-package remotewrite
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"reflect"
-	"testing"
-
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/prompb"
-
-	"github.com/VictoriaMetrics/metrics"
-)
-
-func BenchmarkRemoteWriteObfuscateLabels(b *testing.B) {
-	originValue := *obfuscateLabels
-	defer func() {
-		*obfuscateLabels = originValue
-	}()
-	*obfuscateLabels = []string{"ip^^instance"}
-	sha256Result := func(str string) string {
-		sha256Result := sha256.Sum256([]byte(str))
-		return hex.EncodeToString(sha256Result[:])
-	}
-	expected := []prompb.TimeSeries{
-		{
-			Labels: []prompb.Label{
-				{Name: "ip", Value: sha256Result("123")},
-				{Name: "instance", Value: sha256Result("12345")},
-				{Name: "__name__", Value: "http_requests_total"},
-			},
-			Samples: []prompb.Sample{
-				{Value: 1, Timestamp: 0},
-			},
-		},
-		{
-			Labels: []prompb.Label{
-				{Name: "ip", Value: sha256Result("1236")},
-				{Name: "instance", Value: sha256Result("some-long-instante-string")},
-				{Name: "__name__", Value: "concurrent_requests"},
-			},
-			Samples: []prompb.Sample{
-				{Value: 1, Timestamp: 0},
-			},
-		},
-	}
-	defer metrics.UnregisterAllMetrics()
-
-	inputTss := []prompb.TimeSeries{
-		{
-			Labels: []prompb.Label{
-				{Name: "ip", Value: "123"},
-				{Name: "instance", Value: "12345"},
-				{Name: "__name__", Value: "http_requests_total"},
-			},
-			Samples: []prompb.Sample{
-				{Value: 1, Timestamp: 0},
-			},
-		},
-		{
-			Labels: []prompb.Label{
-				{Name: "ip", Value: "1236"},
-				{Name: "instance", Value: "some-long-instante-string"},
-				{Name: "__name__", Value: "concurrent_requests"},
-			},
-			Samples: []prompb.Sample{
-				{Value: 1, Timestamp: 0},
-			},
-		},
-	}
-	b.ResetTimer()
-	b.ReportAllocs()
-
-	b.RunParallel(func(pb *testing.PB) {
-		rwctx := &remoteWriteCtx{
-			idx: 0,
-		}
-		olctx := &obfuscateLabelsCtx{
-			cacheResults: make(map[string]string),
-		}
-		rwctx.initObfuscateLabels()
-		var localTss []prompb.TimeSeries
-		for pb.Next() {
-			// always make a shallow copy because obfuscate changes input
-			localTss = localTss[:0]
-			localTss = append(localTss, inputTss...)
-			olctx.reset()
-			outputTss := olctx.obfuscate(localTss, rwctx.obfuscateLabels)
-			if !reflect.DeepEqual(expected, outputTss) {
-				b.Fatalf("unexpected output: got: \n%v\n want: \n%v\n", outputTss, expected)
-			}
-		}
-	})
-
-}

app/vmagent/remotewrite/pendingseries.go

@@ -209,12 +209,13 @@ func (wr *writeRequest) tryPushMetadata(mms []prompb.MetricMetadata) bool {
 func (wr *writeRequest) copyMetadata(dst, src *prompb.MetricMetadata) {
 	// Direct copy for non-string fields, which are safe by value.
 	dst.Type = src.Type
+	dst.Unit = src.Unit
 
 	dst.AccountID = src.AccountID
 	dst.ProjectID = src.ProjectID
 
 	// Pre-allocate memory for all string fields.
-	neededBufLen := len(src.MetricFamilyName) + len(src.Help) + len(src.Unit)
+	neededBufLen := len(src.MetricFamilyName) + len(src.Help)
 	bufLen := len(wr.metadatabuf)
 	wr.metadatabuf = slicesutil.SetLength(wr.metadatabuf, bufLen+neededBufLen)
 	buf := wr.metadatabuf[:bufLen]
@@ -229,11 +230,6 @@ func (wr *writeRequest) copyMetadata(dst, src *prompb.MetricMetadata) {
 	buf = append(buf, src.Help...)
 	dst.Help = bytesutil.ToUnsafeString(buf[bufLen:])
 
-	// Copy Unit
-	bufLen = len(buf)
-	buf = append(buf, src.Unit...)
-	dst.Unit = bytesutil.ToUnsafeString(buf[bufLen:])
-
 	wr.metadatabuf = buf
 }
 

app/vmagent/remotewrite/relabel.go

@@ -12,7 +12,6 @@ import (
 	"github.com/VictoriaMetrics/metrics"
 	"gopkg.in/yaml.v2"
 
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/bytesutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/fasttime"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/flagutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
@@ -83,16 +82,6 @@ func WriteRelabelConfigData(w io.Writer) {
 	_, _ = w.Write(*p)
 }
 
-// GetRemoteWriteRelabelConfigString returns -remoteWrite.relabelConfig contents in string
-func GetRemoteWriteRelabelConfigString() string {
-	var bb bytesutil.ByteBuffer
-	WriteRelabelConfigData(&bb)
-	if bb.Len() == 0 {
-		return ""
-	}
-	return string(bb.B)
-}
-
 // WriteURLRelabelConfigData writes -remoteWrite.urlRelabelConfig contents to w
 func WriteURLRelabelConfigData(w io.Writer) {
 	p := remoteWriteURLRelabelConfigData.Load()
@@ -119,24 +108,6 @@ func WriteURLRelabelConfigData(w io.Writer) {
 	_, _ = w.Write(d)
 }
 
-// GetURLRelabelConfigString returns -remoteWrite.urlRelabelConfig contents in []string
-func GetURLRelabelConfigString() []string {
-	p := remoteWriteURLRelabelConfigData.Load()
-	if p == nil {
-		return nil
-	}
-	var ss []string
-	for i := range *remoteWriteURLs {
-		cfgData := (*p)[i]
-		var cfgDataBytes []byte
-		if cfgData != nil {
-			cfgDataBytes, _ = yaml.Marshal(cfgData)
-		}
-		ss = append(ss, string(cfgDataBytes))
-	}
-	return ss
-}
-
 func reloadRelabelConfigs() {
 	rcs := allRelabelConfigs.Load()
 	if !rcs.isSet() {

app/vmagent/remotewrite/remotewrite.go

@@ -12,18 +12,19 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/VictoriaMetrics/metrics"
 	"github.com/cespare/xxhash/v2"
 
+	"github.com/VictoriaMetrics/metrics"
+
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/auth"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/bloomfilter"
+	"github.com/VictoriaMetrics/VictoriaMetrics/lib/bytesutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/cgroup"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/consistenthash"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/flagutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/fs"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httpserver"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/mdx"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/memory"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/persistentqueue"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/procutil"
@@ -65,9 +66,6 @@ var (
 	queues = flagutil.NewArrayInt("remoteWrite.queues", cgroup.AvailableCPUs()*2, "The number of concurrent queues to each -remoteWrite.url. Set more queues if default number of queues "+
 		"isn't enough for sending high volume of collected data to remote storage. "+
 		"Default value depends on the number of available CPU cores. It should work fine in most cases since it minimizes resource usage")
-	inmemoryQueues = flagutil.NewArrayInt("remoteWrite.inmemoryQueues", 0, "The number of additional workers per each -remoteWrite.url, which send only recently ingested data from the in-memory queue, "+
-		"while the file-based queue at -remoteWrite.tmpDataPath is drained by workers configured via -remoteWrite.queues. "+
-		"This reduces delivery lag for fresh samples when the file-based queue contains a backlog accumulated during remote storage outages.")
 	showRemoteWriteURL = flag.Bool("remoteWrite.showURL", false, "Whether to show -remoteWrite.url in the exported metrics. "+
 		"It is hidden by default, since it can contain sensitive info such as auth key")
 	maxPendingBytesPerURL = flagutil.NewArrayBytes("remoteWrite.maxDiskUsagePerURL", 0, "The maximum file-based buffer size in bytes at -remoteWrite.tmpDataPath "+
@@ -105,14 +103,6 @@ var (
 		"cannot be pushed into the configured -remoteWrite.url systems in a timely manner. See https://docs.victoriametrics.com/victoriametrics/vmagent/#disabling-on-disk-persistence")
 	disableMetadataPerURL = flagutil.NewArrayBool("remoteWrite.disableMetadata", "Whether to disable sending metadata to the corresponding -remoteWrite.url. "+
 		"By default, metadata sending is controlled by the global -enableMetadata flag")
-
-	enableMdx = flagutil.NewArrayBool("remoteWrite.mdx.enable", "Whether to only retain metrics from VictoriaMetrics services before sending them to the corresponding -remoteWrite.url. "+
-		"Can be combined with -remoteWrite.obfuscateLabels to hide sensitive label values in the forwarded metrics. "+
-		"Please see https://docs.victoriametrics.com/victoriametrics/vmagent/#monitoring-data-exchange")
-	obfuscateLabels = flagutil.NewArrayString("remoteWrite.obfuscateLabels", "List of label names whose values will be obfuscated before being sent to the corresponding -remoteWrite.url. "+
-		"Multiple label names should be separated by `^^`, e.g. \"job^^instance,ip\". "+
-		"Can be combined with -remoteWrite.mdx.enable to hide sensitive label values in VictoriaMetrics self-monitoring metrics. "+
-		"Please see https://docs.victoriametrics.com/victoriametrics/vmagent/#obfuscating-label-values")
 )
 
 var (
@@ -156,8 +146,7 @@ var maxQueues = cgroup.AvailableCPUs() * 16
 
 const persistentQueueDirname = "persistent-queue"
 
-// InitSecretFlags manages the secret flags for this pkg and must be called by app-level initSecretFlags.
-// It should run before logger initialization and package Init() (if exists).
+// InitSecretFlags must be called after flag.Parse and before any logging.
 func InitSecretFlags() {
 	if !*showRemoteWriteURL {
 		// remoteWrite.url can contain authentication codes, so hide it at `/metrics` output.
@@ -170,8 +159,8 @@ func InitSecretFlags() {
 }
 
 var (
-	shardByURLLabelsFilter       []string
-	shardByURLIgnoreLabelsFilter []string
+	shardByURLLabelsMap       map[string]struct{}
+	shardByURLIgnoreLabelsMap map[string]struct{}
 )
 
 // Init initializes remotewrite.
@@ -218,8 +207,8 @@ func Init() {
 		logger.Fatalf("-remoteWrite.shardByURL.labels and -remoteWrite.shardByURL.ignoreLabels cannot be set simultaneously; " +
 			"see https://docs.victoriametrics.com/victoriametrics/vmagent/#sharding-among-remote-storages")
 	}
-	shardByURLLabelsFilter = slices.Clone(*shardByURLLabels)
-	shardByURLIgnoreLabelsFilter = slices.Clone(*shardByURLIgnoreLabels)
+	shardByURLLabelsMap = newMapFromStrings(*shardByURLLabels)
+	shardByURLIgnoreLabelsMap = newMapFromStrings(*shardByURLIgnoreLabels)
 
 	initLabelsGlobal()
 
@@ -246,8 +235,6 @@ func Init() {
 	dropDanglingQueues()
 
 	// Start config reloader.
-	configReloaderStopCh = make(chan struct{})
-	configReloaderWG = sync.WaitGroup{}
 	configReloaderWG.Go(func() {
 		for {
 			select {
@@ -317,10 +304,6 @@ func initRemoteWriteCtxs(urls []string) {
 	}
 	fs.RegisterPathFsMetrics(*tmpDataPath)
 
-	if slices.Contains(*enableMdx, true) && *shardByURL {
-		logger.Fatalf("-remoteWrite.mdx.enable and -remoteWrite.shardByURL cannot be set to true simultaneously.")
-	}
-
 	if *shardByURL {
 		consistentHashNodes := make([]string, 0, len(urls))
 		for i, url := range urls {
@@ -334,7 +317,7 @@ func initRemoteWriteCtxs(urls []string) {
 }
 
 var (
-	configReloaderStopCh chan struct{}
+	configReloaderStopCh = make(chan struct{})
 	configReloaderWG     sync.WaitGroup
 )
 
@@ -579,14 +562,6 @@ func tryPushMetadataToRemoteStorages(at *auth.Token, rwctxs []*remoteWriteCtx, m
 			mm.ProjectID = at.ProjectID
 		}
 	}
-	tmp := mms[:0]
-	for _, mm := range mms {
-		if timeserieslimits.IsMetricMetadataExceeding(&mm) {
-			continue
-		}
-		tmp = append(tmp, mm)
-	}
-	mms = tmp
 	// Do not shard metadata even if -remoteWrite.shardByURL is set, just replicate it among rwctxs.
 	// Since metadata is usually small and there is no guarantee that metadata can be sent to
 	// the same remote storage with the corresponding metrics.
@@ -720,18 +695,18 @@ func shardAmountRemoteWriteCtx(tssBlock []prompb.TimeSeries, shards [][]prompb.T
 
 	for _, ts := range tssBlock {
 		hashLabels := ts.Labels
-		if len(shardByURLLabelsFilter) > 0 {
+		if len(shardByURLLabelsMap) > 0 {
 			hashLabels = tmpLabels.Labels[:0]
 			for _, label := range ts.Labels {
-				if slices.Contains(shardByURLLabelsFilter, label.Name) {
+				if _, ok := shardByURLLabelsMap[label.Name]; ok {
 					hashLabels = append(hashLabels, label)
 				}
 			}
 			tmpLabels.Labels = hashLabels
-		} else if len(shardByURLIgnoreLabelsFilter) > 0 {
+		} else if len(shardByURLIgnoreLabelsMap) > 0 {
 			hashLabels = tmpLabels.Labels[:0]
 			for _, label := range ts.Labels {
-				if !slices.Contains(shardByURLIgnoreLabelsFilter, label.Name) {
+				if _, ok := shardByURLIgnoreLabelsMap[label.Name]; !ok {
 					hashLabels = append(hashLabels, label)
 				}
 			}
@@ -832,26 +807,34 @@ var (
 // it omits the '=' separator between label name and value for backward compatibility.
 // Changing it would re-shard all series across remoteWrite targets.
 func getLabelsHashForShard(labels []prompb.Label) uint64 {
-	var d xxhash.Digest
-	d.Reset()
+	bb := labelsHashBufPool.Get()
+	b := bb.B[:0]
 	for _, label := range labels {
-		_, _ = d.WriteString(label.Name)
-		_, _ = d.WriteString(label.Value)
+		b = append(b, label.Name...)
+		b = append(b, label.Value...)
 	}
-	return d.Sum64()
+	h := xxhash.Sum64(b)
+	bb.B = b
+	labelsHashBufPool.Put(bb)
+	return h
 }
 
 func getLabelsHash(labels []prompb.Label) uint64 {
-	var d xxhash.Digest
-	d.Reset()
+	bb := labelsHashBufPool.Get()
+	b := bb.B[:0]
 	for _, label := range labels {
-		_, _ = d.WriteString(label.Name)
-		_, _ = d.WriteString("=")
-		_, _ = d.WriteString(label.Value)
+		b = append(b, label.Name...)
+		b = append(b, '=')
+		b = append(b, label.Value...)
 	}
-	return d.Sum64()
+	h := xxhash.Sum64(b)
+	bb.B = b
+	labelsHashBufPool.Put(bb)
+	return h
 }
 
+var labelsHashBufPool bytesutil.ByteBufferPool
+
 func logSkippedSeries(labels []prompb.Label, flagName string, flagValue int) {
 	select {
 	case <-logSkippedSeriesTicker.C:
@@ -876,7 +859,6 @@ type remoteWriteCtx struct {
 
 	sas          atomic.Pointer[streamaggr.Aggregators]
 	deduplicator *streamaggr.Deduplicator
-	mdxFilter    *mdx.Filter
 
 	streamAggrKeepInput bool
 	streamAggrDropInput bool
@@ -889,11 +871,8 @@ type remoteWriteCtx struct {
 	pss        []*pendingSeries
 	pssNextIdx atomic.Uint64
 
-	obfuscateLabels []string
-
 	rowsPushedAfterRelabel *metrics.Counter
 	rowsDroppedByRelabel   *metrics.Counter
-	mdxRowsPreserved       *metrics.Counter
 
 	pushFailures                 *metrics.Counter
 	metadataDroppedOnPushFailure *metrics.Counter
@@ -927,8 +906,7 @@ func newRemoteWriteCtx(argIdx int, remoteWriteURL *url.URL, sanitizedURL string)
 	}
 
 	isPQDisabled := disableOnDiskQueue.GetOptionalArg(argIdx)
-	inmemoryQueueSize := inmemoryQueues.GetOptionalArg(argIdx)
-	queuesSize := queues.GetOptionalArg(argIdx) + inmemoryQueueSize
+	queuesSize := queues.GetOptionalArg(argIdx)
 	if queuesSize > maxQueues {
 		queuesSize = maxQueues
 	} else if queuesSize <= 0 {
@@ -945,13 +923,7 @@ func newRemoteWriteCtx(argIdx int, remoteWriteURL *url.URL, sanitizedURL string)
 	if maxInmemoryBlocks < 2 {
 		maxInmemoryBlocks = 2
 	}
-	fqOpts := persistentqueue.OpenFastQueueOpts{
-		MaxInmemoryBlocks:      maxInmemoryBlocks,
-		MaxPendingBytes:        maxPendingBytes,
-		IsPQDisabled:           isPQDisabled,
-		PrioritizeInmemoryData: inmemoryQueueSize > 0,
-	}
-	fq := persistentqueue.MustOpenFastQueueWithOpts(queuePath, sanitizedURL, fqOpts)
+	fq := persistentqueue.MustOpenFastQueue(queuePath, sanitizedURL, maxInmemoryBlocks, maxPendingBytes, isPQDisabled)
 	_ = metrics.GetOrCreateGauge(fmt.Sprintf(`vmagent_remotewrite_pending_data_bytes{path=%q, url=%q}`, queuePath, sanitizedURL), func() float64 {
 		return float64(fq.GetPendingBytes())
 	})
@@ -964,9 +936,6 @@ func newRemoteWriteCtx(argIdx int, remoteWriteURL *url.URL, sanitizedURL string)
 		}
 		return 0
 	})
-	metrics.GetOrCreateGauge(fmt.Sprintf(`vmagent_remotewrite_queues{url=%q}`, sanitizedURL), func() float64 {
-		return float64(queuesSize)
-	})
 
 	var c *client
 	switch remoteWriteURL.Scheme {
@@ -975,7 +944,7 @@ func newRemoteWriteCtx(argIdx int, remoteWriteURL *url.URL, sanitizedURL string)
 	default:
 		logger.Fatalf("unsupported scheme: %s for remoteWriteURL: %s, want `http`, `https`", remoteWriteURL.Scheme, sanitizedURL)
 	}
-	c.init(argIdx, sanitizedURL)
+	c.init(argIdx, queuesSize, sanitizedURL)
 
 	// Initialize pss
 	sf := significantFigures.GetOptionalArg(argIdx)
@@ -990,6 +959,7 @@ func newRemoteWriteCtx(argIdx int, remoteWriteURL *url.URL, sanitizedURL string)
 	for i := range pss {
 		pss[i] = newPendingSeries(fq, &c.useVMProto, sf, rd)
 	}
+
 	rwctx := &remoteWriteCtx{
 		idx:            argIdx,
 		fq:             fq,
@@ -1005,17 +975,6 @@ func newRemoteWriteCtx(argIdx int, remoteWriteURL *url.URL, sanitizedURL string)
 		rowsDroppedOnPushFailure:     metrics.GetOrCreateCounter(fmt.Sprintf(`vmagent_remotewrite_samples_dropped_total{path=%q,url=%q}`, queuePath, sanitizedURL)),
 	}
 	rwctx.initStreamAggrConfig()
-	rwctx.initObfuscateLabels()
-
-	if enableMdx.GetOptionalArg(argIdx) {
-		mdxFilter := mdx.NewFilter()
-		rwctx.mdxFilter = mdxFilter
-		rwctx.mdxRowsPreserved = metrics.GetOrCreateCounter(fmt.Sprintf(`vmagent_remotewrite_mdx_rows_preserved_total{path=%q,url=%q}`, queuePath, sanitizedURL))
-		_ = metrics.NewGauge(fmt.Sprintf(`vmagent_remotewrite_mdx_tracked_instances{path=%q,url=%q}`, queuePath, sanitizedURL), func() float64 {
-			return float64(mdxFilter.VMInstancesCount())
-		})
-
-	}
 
 	return rwctx
 }
@@ -1030,11 +989,6 @@ func (rwctx *remoteWriteCtx) MustStop() {
 		rwctx.deduplicator.MustStop()
 		rwctx.deduplicator = nil
 	}
-	if rwctx.mdxFilter != nil {
-		rwctx.mdxFilter.MustStop()
-		rwctx.mdxFilter = nil
-		rwctx.mdxRowsPreserved = nil
-	}
 
 	for _, ps := range rwctx.pss {
 		ps.MustStop()
@@ -1050,7 +1004,6 @@ func (rwctx *remoteWriteCtx) MustStop() {
 
 	rwctx.rowsPushedAfterRelabel = nil
 	rwctx.rowsDroppedByRelabel = nil
-
 }
 
 // TryPushTimeSeries sends tss series to the configured remote write endpoint
@@ -1058,41 +1011,16 @@ func (rwctx *remoteWriteCtx) MustStop() {
 // TryPushTimeSeries doesn't modify tss, so tss can be passed concurrently to TryPush across distinct rwctx instances.
 func (rwctx *remoteWriteCtx) TryPushTimeSeries(tss []prompb.TimeSeries, forceDropSamplesOnFailure bool) bool {
 	var rctx *relabelCtx
-	var mctx *mdx.Ctx
 	var v *[]prompb.TimeSeries
 	defer func() {
-		if v != nil {
-			*v = prompb.ResetTimeSeries(tss)
-			tssPool.Put(v)
-		}
-		if rctx != nil {
-			putRelabelCtx(rctx)
-		}
-		if mctx != nil {
-			mdx.PutContext(mctx)
+		if rctx == nil {
+			return
 		}
+		*v = prompb.ResetTimeSeries(tss)
+		tssPool.Put(v)
+		putRelabelCtx(rctx)
 	}()
 
-	copyTimeSeriesIfNeeded := func() {
-		if v == nil {
-			v = tssPool.Get().(*[]prompb.TimeSeries)
-			tss = append(*v, tss...)
-		}
-	}
-
-	if rwctx.mdxFilter != nil {
-		mctx = mdx.GetContext()
-		// Make a copy of tss before applying relabeling in order to prevent
-		// from affecting time series for other remoteWrite.mdx configs.
-		copyTimeSeriesIfNeeded()
-		tss = rwctx.mdxFilter.Filter(mctx, tss)
-		if len(tss) == 0 {
-			return true
-		}
-		rowsCount := getRowsCount(tss)
-		rwctx.mdxRowsPreserved.Add(rowsCount)
-	}
-
 	// Apply relabeling
 	rcs := allRelabelConfigs.Load()
 	pcs := rcs.perURL[rwctx.idx]
@@ -1102,7 +1030,8 @@ func (rwctx *remoteWriteCtx) TryPushTimeSeries(tss []prompb.TimeSeries, forceDro
 		// from affecting time series for other remoteWrite.url configs.
 		// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/467
 		// and https://github.com/VictoriaMetrics/VictoriaMetrics/issues/599
-		copyTimeSeriesIfNeeded()
+		v = tssPool.Get().(*[]prompb.TimeSeries)
+		tss = append(*v, tss...)
 		rowsCountBeforeRelabel := getRowsCount(tss)
 		tss = rctx.applyRelabeling(tss, pcs)
 		rowsCountAfterRelabel := getRowsCount(tss)
@@ -1120,7 +1049,8 @@ func (rwctx *remoteWriteCtx) TryPushTimeSeries(tss []prompb.TimeSeries, forceDro
 			if rctx == nil {
 				rctx = getRelabelCtx()
 				// Make a copy of tss before dropping aggregated series
-				copyTimeSeriesIfNeeded()
+				v = tssPool.Get().(*[]prompb.TimeSeries)
+				tss = append(*v, tss...)
 			}
 			tss = dropAggregatedSeries(tss, matchIdxs.B, rwctx.streamAggrDropInput)
 		} else if rwctx.streamAggrDropInput {
@@ -1128,7 +1058,8 @@ func (rwctx *remoteWriteCtx) TryPushTimeSeries(tss []prompb.TimeSeries, forceDro
 			if rctx == nil {
 				rctx = getRelabelCtx()
 				// Make a copy of tss before dropping aggregated series
-				copyTimeSeriesIfNeeded()
+				v = tssPool.Get().(*[]prompb.TimeSeries)
+				tss = append(*v, tss...)
 			}
 			tss = dropUnaggregatedSeries(tss, matchIdxs.B)
 		}
@@ -1209,41 +1140,24 @@ func (rwctx *remoteWriteCtx) tryPushMetadataInternal(mms []prompb.MetricMetadata
 func (rwctx *remoteWriteCtx) tryPushTimeSeriesInternal(tss []prompb.TimeSeries) bool {
 	var rctx *relabelCtx
 	var v *[]prompb.TimeSeries
-	var olctx *obfuscateLabelsCtx
 	defer func() {
-		if v != nil {
-			*v = prompb.ResetTimeSeries(tss)
-			tssPool.Put(v)
-		}
-		if rctx != nil {
-			putRelabelCtx(rctx)
-		}
-		if olctx != nil {
-			putObfuscateLabelsCtx(olctx)
+		if rctx == nil {
+			return
 		}
+		*v = prompb.ResetTimeSeries(tss)
+		tssPool.Put(v)
+		putRelabelCtx(rctx)
 	}()
 
-	copyTimeSeriesIfNeeded := func() {
-		if v == nil {
-			v = tssPool.Get().(*[]prompb.TimeSeries)
-			tss = append(*v, tss...)
-		}
-	}
-
 	if len(labelsGlobal) > 0 {
 		// Make a copy of tss before adding extra labels to prevent
 		// from affecting time series for other remoteWrite.url configs.
 		rctx = getRelabelCtx()
-		copyTimeSeriesIfNeeded()
+		v = tssPool.Get().(*[]prompb.TimeSeries)
+		tss = append(*v, tss...)
 		rctx.appendExtraLabels(tss, labelsGlobal)
 	}
 
-	if len(rwctx.obfuscateLabels) != 0 {
-		copyTimeSeriesIfNeeded()
-		olctx = getObfuscateLabelsCtx()
-		tss = olctx.obfuscate(tss, rwctx.obfuscateLabels)
-	}
-
 	pss := rwctx.pss
 	idx := rwctx.pssNextIdx.Add(1) % uint64(len(pss))
 
@@ -1264,6 +1178,15 @@ func getRowsCount(tss []prompb.TimeSeries) int {
 	}
 	return rowsCount
 }
+
+func newMapFromStrings(a []string) map[string]struct{} {
+	m := make(map[string]struct{}, len(a))
+	for _, s := range a {
+		m[s] = struct{}{}
+	}
+	return m
+}
+
 func getMaxHourlySeries() int {
 	limit := *maxHourlySeries
 	if limit == -1 || limit > math.MaxInt32 {

app/vmalert-tool/unittest/recording.go

@@ -6,6 +6,7 @@ import (
 	"net/url"
 	"reflect"
 	"sort"
+	"time"
 
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmalert/datasource"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/prompb"
@@ -93,3 +94,10 @@ Outer:
 	}
 	return
 }
+
+func durationToTime(pd *promutil.Duration) time.Time {
+	if pd == nil {
+		return time.Time{}
+	}
+	return time.UnixMilli(pd.Duration().Milliseconds())
+}

app/vmalert-tool/unittest/unittest.go

@@ -44,19 +44,12 @@ import (
 var (
 	storagePath    string
 	httpListenAddr string
-	// Insert series from 2000-01-01T00:00:00.
-	testStartTime          = time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)
+	// insert series from 1970-01-01T00:00:00
+	testStartTime          = time.Unix(0, 0).UTC()
 	testLogLevel           = "ERROR"
 	disableAlertgroupLabel bool
 )
 
-func durationToTime(pd *promutil.Duration) time.Time {
-	if pd == nil {
-		return testStartTime
-	}
-	return testStartTime.Add(pd.Duration())
-}
-
 const (
 	testStoragePath = "vmalert-unittest"
 )
@@ -289,8 +282,7 @@ func processFlags() {
 
 func setUp() {
 	const maxConcurrentRequests = 4
-	maxQueueDuration := 5 * time.Second
-	vmstorage.Init(maxConcurrentRequests, maxQueueDuration, promql.ResetRollupResultCacheIfNeeded)
+	vmstorage.Init(maxConcurrentRequests, promql.ResetRollupResultCacheIfNeeded)
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 	readyCheckFunc := func() bool {

app/vmalert/config/config_test.go

@@ -145,10 +145,10 @@ func TestRuleValidate(t *testing.T) {
 }
 
 func TestGroupValidate_Failure(t *testing.T) {
-	f := func(data []byte, validateExpressions bool, errStrExpected string) {
+	f := func(group *Group, validateExpressions bool, errStrExpected string) {
 		t.Helper()
 
-		_, err := parse(map[string][]byte{"test.yaml": data}, nil, validateExpressions)
+		err := group.Validate(nil, validateExpressions)
 		if err == nil {
 			t.Fatalf("expecting non-nil error")
 		}
@@ -158,238 +158,275 @@ func TestGroupValidate_Failure(t *testing.T) {
 		}
 	}
 
-	f([]byte(`
-groups:
-- name: ""
-`), false, "group name must be set")
+	f(&Group{}, false, "group name must be set")
 
-	f([]byte(`
-groups:
-- name: both record and alert are not set
-  rules:
-  - expr: "sum(up == 0 ) by (host)"
-    for: 10ms
-  - expr: "sumSeries(time('foo.bar',10))"
-`), false, "invalid rule")
+	f(&Group{
+		Name: "both record and alert are not set",
+		Rules: []Rule{
+			{
+				Expr: "sum(up == 0 ) by (host)",
+				For:  promutil.NewDuration(10 * time.Millisecond),
+			},
+			{
+				Expr: "sumSeries(time('foo.bar',10))",
+			},
+		},
+	}, false, "invalid rule")
 
-	f([]byte(`
-groups:
-- name: negative interval
-  interval: -1ms
-`), false, "interval shouldn't be lower than 0")
+	f(&Group{
+		Name:     "negative interval",
+		Interval: promutil.NewDuration(-1),
+	}, false, "interval shouldn't be lower than 0")
 
-	f([]byte(`
-groups:
-- name: too big eval_offset
-  interval: 1m
-  eval_offset: 2m
-`), false, "eval_offset should be smaller than interval")
+	f(&Group{
+		Name:       "too big eval_offset",
+		Interval:   promutil.NewDuration(time.Minute),
+		EvalOffset: promutil.NewDuration(2 * time.Minute),
+	}, false, "eval_offset should be smaller than interval")
 
-	f([]byte(`
-groups:
-- name: too big negative eval_offset
-  interval: 1m
-  eval_offset: -2m
-`), false, "eval_offset should be smaller than interval")
+	f(&Group{
+		Name:       "too big negative eval_offset",
+		Interval:   promutil.NewDuration(time.Minute),
+		EvalOffset: promutil.NewDuration(-2 * time.Minute),
+	}, false, "eval_offset should be smaller than interval")
 
-	f([]byte(`
-groups:
-- name: wrong limit
-  limit: -1
-`), false, "invalid limit")
+	limit := -1
+	f(&Group{
+		Name:  "wrong limit",
+		Limit: &limit,
+	}, false, "invalid limit")
 
-	f([]byte(`
-groups:
-- name: wrong concurrency
-  concurrency: -1
-`), false, "invalid concurrency")
+	f(&Group{
+		Name:        "wrong concurrency",
+		Concurrency: -1,
+	}, false, "invalid concurrency")
 
-	f([]byte(`
-groups:
-- name: test
-  rules:
-  - alert: alert
-    expr: up == 1
-  - alert: alert
-    expr: up == 1
-`), false, "duplicate")
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{
+				Alert: "alert",
+				Expr:  "up == 1",
+			},
+			{
+				Alert: "alert",
+				Expr:  "up == 1",
+			},
+		},
+	}, false, "duplicate")
 
-	f([]byte(`
-groups:
-- name: test
-  rules:
-  - alert: alert
-    expr: up == 1
-    labels:
-      summary: "{{ value|query }}"
-  - alert: alert
-    expr: up == 1
-    labels:
-      summary: "{{ value|query }}"
-`), false, "duplicate")
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"summary": "{{ value|query }}",
+			}},
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"summary": "{{ value|query }}",
+			}},
+		},
+	}, false, "duplicate")
 
-	f([]byte(`
-groups:
-- name: test
-  rules:
-  - record: record
-    expr: up == 1
-    labels:
-      summary: "{{ value|query }}"
-  - record: record
-    expr: up == 1
-    labels:
-      summary: "{{ value|query }}"
-`), false, "duplicate")
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{Record: "record", Expr: "up == 1", Labels: map[string]string{
+				"summary": "{{ value|query }}",
+			}},
+			{Record: "record", Expr: "up == 1", Labels: map[string]string{
+				"summary": "{{ value|query }}",
+			}},
+		},
+	}, false, "duplicate")
 
-	f([]byte(`
-groups:
-- name: test thanos
-  type: thanos
-  rules:
-  - alert: alert
-    expr: up == 1
-    labels:
-      description: "{{ value|query }}"
-`), true, "unknown datasource type")
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"summary": "{{ value|query }}",
+			}},
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"description": "{{ value|query }}",
+			}},
+		},
+	}, false, "duplicate")
+
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{Record: "alert", Expr: "up == 1", Labels: map[string]string{
+				"summary": "{{ value|query }}",
+			}},
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"summary": "{{ value|query }}",
+			}},
+		},
+	}, false, "duplicate")
+
+	f(&Group{
+		Name: "test thanos",
+		Type: NewRawType("thanos"),
+		Rules: []Rule{
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"description": "{{ value|query }}",
+			}},
+		},
+	}, true, "unknown datasource type")
 
 	// validate expressions
-	f([]byte(`
-groups:
-- name: test prometheus expr
-  type: prometheus
-  rules:
-  - record: record
-    expr: "up | 0"
-`), true, "bad MetricsQL expr")
+	f(&Group{
+		Name: "test prometheus expr",
+		Type: NewPrometheusType(),
+		Rules: []Rule{
+			{
+				Record: "record",
+				Expr:   "up | 0",
+			},
+		},
+	}, true, "bad MetricsQL expr")
 
-	f([]byte(`
-groups:
-- name: test graphite expr
-  type: graphite
-  rules:
-  - alert: alert
-    expr: up == 1
-    labels:
-      description: some-description
-`), true, "bad GraphiteQL expr")
+	f(&Group{
+		Name: "test graphite expr",
+		Type: NewGraphiteType(),
+		Rules: []Rule{
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"description": "some-description",
+			}},
+		},
+	}, true, "bad GraphiteQL expr")
 
-	f([]byte(`
-groups:
-- name: test vlogs expr
-  type: vlogs
-  rules:
-  - alert: alert
-    expr: "stats count(*) as requests"
-`), true, "bad LogsQL expr")
+	f(&Group{
+		Name: "test vlogs expr",
+		Type: NewVLogsType(),
+		Rules: []Rule{
+			{Alert: "alert", Expr: "stats count(*) as requests"},
+		},
+	}, true, "bad LogsQL expr")
 
-	f([]byte(`
-groups:
-- name: test vlogs expr multipart
-  type: vlogs
-  rules:
-  - alert: alert
-    expr: "_time: 1m | stats by (path, _time: 1m) count(*) as requests"
-`), true, "bad LogsQL expr")
+	f(&Group{
+		Name: "test vlogs expr",
+		Type: NewVLogsType(),
+		Rules: []Rule{
+			{Alert: "alert", Expr: "_time: 1m | stats by (path, _time: 1m) count(*) as requests"},
+		},
+	}, true, "bad LogsQL expr")
 
-	f([]byte(`
-groups:
-- name: test graphite with prometheus expr
-  type: graphite
-  rules:
-  - record: r1
-    expr: "sumSeries(time('foo.bar',10))"
-    for: 10ms
-  - record: r2
-    expr: "sum(up == 0 ) by (host)"
-`), true, "bad GraphiteQL expr")
+	f(&Group{
+		Name: "test graphite with prometheus expr",
+		Type: NewGraphiteType(),
+		Rules: []Rule{
+			{
+				Record: "r1",
+				ID:     1,
+				Expr:   "sumSeries(time('foo.bar',10))",
+				For:    promutil.NewDuration(10 * time.Millisecond),
+			},
+			{
+				Record: "r2",
+				ID:     2,
+				Expr:   "sum(up == 0 ) by (host)",
+			},
+		},
+	}, true, "bad GraphiteQL expr")
 
-	f([]byte(`
-groups:
-- name: test vlogs with prometheus expr
-  type: vlogs
-  rules:
-  - record: r1
-    expr: "sum(up == 0 ) by (host)"
-    for: 10ms
-`), true, "bad LogsQL expr")
+	f(&Group{
+		Name: "test vlogs with prometheus exp",
+		Type: NewVLogsType(),
+		Rules: []Rule{
+			{
+				Record: "r1",
+				Expr:   "sum(up == 0 ) by (host)",
+				For:    promutil.NewDuration(10 * time.Millisecond),
+			},
+		},
+	}, true, "bad LogsQL expr")
 
-	f([]byte(`
-groups:
-- name: test prometheus with vlogs expr
-  type: prometheus
-  rules:
-  - record: r1
-    expr: "* | stats by (path) count()"
-    for: 10ms
-`), true, "bad MetricsQL expr")
+	f(&Group{
+		Name: "test prometheus with vlogs exp",
+		Type: NewPrometheusType(),
+		Rules: []Rule{
+			{
+				Record: "r1",
+				Expr:   "* | stats by (path) count()",
+				For:    promutil.NewDuration(10 * time.Millisecond),
+			},
+		},
+	}, true, "bad MetricsQL expr")
 }
 
 func TestGroupValidate_Success(t *testing.T) {
-	f := func(data []byte, validateAnnotations, validateExpressions bool) {
+	f := func(group *Group, validateAnnotations, validateExpressions bool) {
 		t.Helper()
 
 		var validateTplFn ValidateTplFn
 		if validateAnnotations {
 			validateTplFn = notifier.ValidateTemplates
 		}
-		_, err := parse(map[string][]byte{"test.yaml": data}, validateTplFn, validateExpressions)
+		err := group.Validate(validateTplFn, validateExpressions)
 		if err != nil {
 			t.Fatalf("unexpected error: %s", err)
 		}
 	}
 
-	f([]byte(`
-groups:
-- name: test
-  rules:
-  - record: record
-    expr: "up | 0"
-`), false, false)
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{
+				Record: "record",
+				Expr:   "up | 0",
+			},
+		},
+	}, false, false)
 
-	f([]byte(`
-groups:
-- name: test
-  rules:
-  - alert: alert
-    expr: up == 1
-    labels:
-      summary: "{{ value|query }}"
-`), false, false)
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{
+				Alert: "alert",
+				Expr:  "up == 1",
+				Labels: map[string]string{
+					"summary": "{{ value|query }}",
+				},
+			},
+		},
+	}, false, false)
 
 	// validate annotations
-	f([]byte(`
-groups:
-- name: test
-  rules:
-  - alert: alert
-    expr: up == 1
-    labels:
-      summary: "\n{{ with printf \"node_memory_MemTotal{job='node',instance='%s'}\" \"localhost\" | query }}\n  {{ . | first | value | humanize1024 }}B\n{{ end }}"
-`), true, false)
+	f(&Group{
+		Name: "test",
+		Rules: []Rule{
+			{
+				Alert: "alert",
+				Expr:  "up == 1",
+				Labels: map[string]string{
+					"summary": `
+{{ with printf "node_memory_MemTotal{job='node',instance='%s'}" "localhost" | query }}
+  {{ . | first | value | humanize1024 }}B
+{{ end }}`,
+				},
+			},
+		},
+	}, true, false)
 
 	// validate expressions
-	f([]byte(`
-groups:
-- name: test prometheus
-  type: prometheus
-  rules:
-  - alert: alert
-    expr: up == 1
-    labels:
-      description: "{{ value|query }}"
-`), false, true)
-
-	f([]byte(`
-groups:
-- name: test victorialogs
-  type: vlogs
-  rules:
-  - alert: alert
-    expr: " _time: 1m | stats count(*) as requests"
-    labels:
-      description: "{{ value|query }}"
-`), false, true)
+	f(&Group{
+		Name: "test prometheus",
+		Type: NewPrometheusType(),
+		Rules: []Rule{
+			{Alert: "alert", Expr: "up == 1", Labels: map[string]string{
+				"description": "{{ value|query }}",
+			}},
+		},
+	}, false, true)
+	f(&Group{
+		Name: "test victorialogs",
+		Type: NewVLogsType(),
+		Rules: []Rule{
+			{Alert: "alert", Expr: " _time: 1m | stats count(*) as requests", Labels: map[string]string{
+				"description": "{{ value|query }}",
+			}},
+		},
+	}, false, true)
 }
 
 func TestHashRule_NotEqual(t *testing.T) {

app/vmalert/datasource/client.go

@@ -11,7 +11,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httpserver"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/netutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promauth"
@@ -268,11 +267,7 @@ func (c *Client) do(req *http.Request) (*http.Response, error) {
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(resp.Body)
 		_ = resp.Body.Close()
-		err = &httpserver.ErrorWithStatusCode{
-			StatusCode: resp.StatusCode,
-			Err:        fmt.Errorf("unexpected response code %d for %s. Response body %s", resp.StatusCode, ru, body),
-		}
-		return nil, err
+		return nil, fmt.Errorf("unexpected response code %d for %s. Response body %s", resp.StatusCode, ru, body)
 	}
 	return resp, nil
 }

app/vmalert/datasource/init.go

@@ -11,7 +11,6 @@ import (
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmalert/vmalertutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/flagutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httputil"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promauth"
 )
 
@@ -60,8 +59,7 @@ var (
 		`Only valid for VictoriaMetrics as the datasource.`)
 )
 
-// InitSecretFlags manages the secret flags for this pkg and must be called by app-level initSecretFlags.
-// It should run before logger initialization and package Init() (if exists).
+// InitSecretFlags must be called after flag.Parse and before any logging
 func InitSecretFlags() {
 	if !*showDatasourceURL {
 		flagutil.RegisterSecretFlag("datasource.url")
@@ -96,12 +94,6 @@ func Init(extraParams url.Values) (QuerierBuilder, error) {
 		tr.MaxIdleConns = tr.MaxIdleConnsPerHost
 	}
 	tr.IdleConnTimeout = *idleConnectionTimeout
-	hc := &http.Client{Transport: tr}
-	datasourceURL, err := url.Parse(*addr)
-	if err != nil {
-		logger.Fatalf("BUG: cannot parse already parsed -datasource.url=%q: %s", *addr, err)
-	}
-	hc.Transport, datasourceURL = httputil.NewLoadBalancerTransport(tr, datasourceURL)
 
 	if extraParams == nil {
 		extraParams = url.Values{}
@@ -128,9 +120,9 @@ func Init(extraParams url.Values) (QuerierBuilder, error) {
 	}
 
 	return &Client{
-		c:                hc,
+		c:                &http.Client{Transport: tr},
 		authCfg:          authCfg,
-		datasourceURL:    strings.TrimSuffix(datasourceURL.String(), "/"),
+		datasourceURL:    strings.TrimSuffix(*addr, "/"),
 		appendTypePrefix: *appendTypePrefix,
 		queryStep:        *queryStep,
 		extraParams:      extraParams,

app/vmalert/main.go

@@ -88,7 +88,10 @@ func main() {
 	flag.CommandLine.SetOutput(os.Stdout)
 	flag.Usage = usage
 	envflag.Parse()
-	initSecretFlags()
+	remoteread.InitSecretFlags()
+	remotewrite.InitSecretFlags()
+	datasource.InitSecretFlags()
+	notifier.InitSecretFlags()
 	buildinfo.Init()
 	logger.Init()
 
@@ -435,12 +438,3 @@ func getLastConfigError() error {
 	defer lastConfigErrMu.RUnlock()
 	return lastConfigErr
 }
-
-// initSecretFlags manages the secret flags for this app and must be called after flag parsing and before logger init.
-func initSecretFlags() {
-	remoteread.InitSecretFlags()
-	remotewrite.InitSecretFlags()
-	datasource.InitSecretFlags()
-	notifier.InitSecretFlags()
-	pushmetrics.InitSecretFlags()
-}

app/vmalert/notifier/alert.go

@@ -31,8 +31,6 @@ type Alert struct {
 	State AlertState
 	// Expr contains expression that was executed to generate the Alert
 	Expr string
-	// Interval contains the evaluation interval of the Alert's group
-	Interval time.Duration
 	// ActiveAt defines the moment of time when Alert has become active
 	ActiveAt time.Time
 	// Start defines the moment of time when Alert has become firing
@@ -86,7 +84,6 @@ type AlertTplData struct {
 	Labels    map[string]string
 	Value     float64
 	Expr      string
-	Interval  time.Duration
 	AlertID   uint64
 	GroupID   uint64
 	ActiveAt  time.Time
@@ -99,7 +96,6 @@ var tplHeaders = []string{
 	"{{ $type := .Type }}",
 	"{{ $labels := .Labels }}",
 	"{{ $expr := .Expr }}",
-	"{{ $interval := .Interval }}",
 	"{{ $externalLabels := .ExternalLabels }}",
 	"{{ $externalURL := .ExternalURL }}",
 	"{{ $alertID := .AlertID }}",
@@ -119,7 +115,6 @@ func (a *Alert) ExecTemplate(q templates.QueryFn, labels, annotations map[string
 		Type:     a.Type,
 		Labels:   labels,
 		Expr:     a.Expr,
-		Interval: a.Interval,
 		AlertID:  a.ID,
 		GroupID:  a.GroupID,
 		ActiveAt: a.ActiveAt,

app/vmalert/notifier/alert_test.go

@@ -129,17 +129,6 @@ func TestAlertExecTemplate(t *testing.T) {
 		"exprEscapedHTML":   "vm_rows{"label"="bar"}<0",
 	})
 
-	// interval-template
-	f(&Alert{
-		Interval: 10 * time.Second,
-	}, map[string]string{
-		"interval":         "{{ .Interval }}",
-		"intervalVariable": "{{ $interval }}",
-	}, map[string]string{
-		"interval":         "10s",
-		"intervalVariable": "10s",
-	})
-
 	// query
 	f(&Alert{
 		Expr: `vm_rows{"label"="bar"}>0`,

app/vmalert/notifier/init.go

@@ -189,8 +189,7 @@ func Init(extLabels map[string]string, extURL string) error {
 	return nil
 }
 
-// InitSecretFlags manages the secret flags for this pkg and must be called by app-level initSecretFlags.
-// It should run before logger initialization and package Init() (if exists).
+// InitSecretFlags must be called after flag.Parse and before any logging
 func InitSecretFlags() {
 	if !*showNotifierURL {
 		flagutil.RegisterSecretFlag("notifier.url")

app/vmalert/remoteread/init.go

@@ -4,14 +4,12 @@ import (
 	"flag"
 	"fmt"
 	"net/http"
-	"net/url"
 	"time"
 
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmalert/datasource"
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmalert/vmalertutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/flagutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httputil"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promauth"
 )
 
@@ -56,8 +54,7 @@ var (
 	oauth2Scopes   = flag.String("remoteRead.oauth2.scopes", "", "Optional OAuth2 scopes to use for -remoteRead.url. Scopes must be delimited by ';'.")
 )
 
-// InitSecretFlags manages the secret flags for this pkg and must be called by app-level initSecretFlags.
-// It should run before logger initialization and package Init() (if exists).
+// InitSecretFlags must be called after flag.Parse and before any logging
 func InitSecretFlags() {
 	if !*showRemoteReadURL {
 		flagutil.RegisterSecretFlag("remoteRead.url")
@@ -79,13 +76,7 @@ func Init() (datasource.QuerierBuilder, error) {
 		return nil, fmt.Errorf("failed to create transport for -remoteRead.url=%q: %w", *addr, err)
 	}
 	tr.IdleConnTimeout = *idleConnectionTimeout
-	c := &http.Client{Transport: tr}
-	rrURL, err := url.Parse(*addr)
-	if err != nil {
-		logger.Fatalf("BUG: cannot parse already parsed -remoteRead.url=%q: %s", *addr, err)
-	}
 
-	c.Transport, rrURL = httputil.NewLoadBalancerTransport(tr, rrURL)
 	endpointParams, err := flagutil.ParseJSONMap(*oauth2EndpointParams)
 	if err != nil {
 		return nil, fmt.Errorf("cannot parse JSON for -remoteRead.oauth2.endpointParams=%s: %w", *oauth2EndpointParams, err)
@@ -98,5 +89,6 @@ func Init() (datasource.QuerierBuilder, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to configure auth: %w", err)
 	}
-	return datasource.NewPrometheusClient(rrURL.String(), authCfg, false, c), nil
+	c := &http.Client{Transport: tr}
+	return datasource.NewPrometheusClient(*addr, authCfg, false, c), nil
 }

app/vmalert/remotewrite/client.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"path"
 	"strings"
 	"sync"
@@ -112,18 +111,12 @@ func NewClient(ctx context.Context, cfg Config) (*Client, error) {
 	if cfg.Concurrency > 0 {
 		cc = cfg.Concurrency
 	}
-	hc := &http.Client{
-		Timeout:   *sendTimeout,
-		Transport: cfg.Transport,
-	}
-	rwURL, err := url.Parse(cfg.Addr)
-	if err != nil {
-		logger.Fatalf("cannot parse already parsed -remoteWrite.url=%q: %s", cfg.Addr, err)
-	}
-	hc.Transport, rwURL = httputil.NewLoadBalancerTransport(hc.Transport, rwURL)
 	c := &Client{
-		c:             hc,
-		addr:          strings.TrimSuffix(rwURL.String(), "/"),
+		c: &http.Client{
+			Timeout:   *sendTimeout,
+			Transport: cfg.Transport,
+		},
+		addr:          strings.TrimSuffix(cfg.Addr, "/"),
 		authCfg:       cfg.AuthCfg,
 		flushInterval: cfg.FlushInterval,
 		maxBatchSize:  cfg.MaxBatchSize,
@@ -284,15 +277,7 @@ func (c *Client) flush(ctx context.Context, wr *prompb.WriteRequest) {
 	bb := writeRequestBufPool.Get()
 	bb.B = wr.MarshalProtobuf(bb.B[:0])
 	zb := compressBufPool.Get()
-	// A failed send may leave the http transport still reading zb.B in a separate goroutine
-	// even after send returns, so zb is returned to the pool only if no send attempt has failed.
-	// See https://pkg.go.dev/net/http#RoundTripper
-	sendFailed := false
-	defer func() {
-		if !sendFailed {
-			compressBufPool.Put(zb)
-		}
-	}()
+	defer compressBufPool.Put(zb)
 	if c.isVMRemoteWrite.Load() {
 		zb.B = zstd.CompressLevel(zb.B[:0], bb.B, 0)
 	} else {
@@ -311,13 +296,10 @@ func (c *Client) flush(ctx context.Context, wr *prompb.WriteRequest) {
 L:
 	for {
 		err := c.send(ctx, zb.B)
-		if err != nil {
-			sendFailed = true
-			if errors.Is(err, io.EOF) || netutil.IsTrivialNetworkError(err) {
-				// Something in the middle between client and destination might be closing
-				// the connection. So we do a one more attempt in hope request will succeed.
-				err = c.send(ctx, zb.B)
-			}
+		if err != nil && (errors.Is(err, io.EOF) || netutil.IsTrivialNetworkError(err)) {
+			// Something in the middle between client and destination might be closing
+			// the connection. So we do a one more attempt in hope request will succeed.
+			err = c.send(ctx, zb.B)
 		}
 		if err == nil {
 			sentRows.Add(len(wr.Timeseries))

app/vmalert/remotewrite/debug_client.go

@@ -36,13 +36,6 @@ func NewDebugClient() (*DebugClient, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to create transport for -remoteWrite.url=%q: %w", *addr, err)
 	}
-	tr.IdleConnTimeout = *idleConnectionTimeout
-	// DebugClient sends every series in a separate request, so it needs more idle
-	// connections than the two http.DefaultTransport keeps per host.
-	tr.MaxIdleConnsPerHost = *maxIdleConnections
-	if tr.MaxIdleConns != 0 && tr.MaxIdleConns < tr.MaxIdleConnsPerHost {
-		tr.MaxIdleConns = tr.MaxIdleConnsPerHost
-	}
 	c := &DebugClient{
 		c: &http.Client{
 			Timeout:   *sendTimeout,

app/vmalert/remotewrite/debug_client_conns_test.go

@@ -1,45 +0,0 @@
-package remotewrite
-
-import (
-	"net/http"
-	"testing"
-)
-
-// TestDebugClient_IdleConns makes sure DebugClient keeps enough idle connections
-// to -remoteWrite.url. Every series is pushed in a separate request, so with the
-// two idle connections per host of http.DefaultTransport most of the concurrent
-// requests would open a new connection and leave a socket in TIME_WAIT state.
-func TestDebugClient_IdleConns(t *testing.T) {
-	f := func(maxIdle int) {
-		t.Helper()
-
-		oldAddr, oldMaxIdle := *addr, *maxIdleConnections
-		*addr, *maxIdleConnections = "http://localhost:8428", maxIdle
-		defer func() {
-			*addr, *maxIdleConnections = oldAddr, oldMaxIdle
-		}()
-
-		client, err := NewDebugClient()
-		if err != nil {
-			t.Fatalf("failed to create debug client: %s", err)
-		}
-		tr, ok := client.c.Transport.(*http.Transport)
-		if !ok {
-			t.Fatalf("unexpected transport type %T", client.c.Transport)
-		}
-		if tr.MaxIdleConnsPerHost != maxIdle {
-			t.Fatalf("unexpected MaxIdleConnsPerHost; got %d; want %d", tr.MaxIdleConnsPerHost, maxIdle)
-		}
-		if tr.MaxIdleConns != 0 && tr.MaxIdleConns < maxIdle {
-			t.Fatalf("MaxIdleConns=%d is lower than MaxIdleConnsPerHost=%d", tr.MaxIdleConns, maxIdle)
-		}
-		if tr.IdleConnTimeout != *idleConnectionTimeout {
-			t.Fatalf("unexpected IdleConnTimeout; got %s; want %s", tr.IdleConnTimeout, *idleConnectionTimeout)
-		}
-	}
-
-	f(100)
-
-	// the number of idle connections must be raised together with the total limit
-	f(1000)
-}

app/vmalert/remotewrite/init.go

@@ -34,7 +34,6 @@ var (
 	bearerTokenFile = flag.String("remoteWrite.bearerTokenFile", "", "Optional path to bearer token file to use for -remoteWrite.url.")
 
 	idleConnectionTimeout = flag.Duration("remoteWrite.idleConnTimeout", 50*time.Second, `Defines a duration for idle (keep-alive connections) to exist. Consider settings this value less to the value of "-http.idleConnTimeout". It must prevent possible "write: broken pipe" and "read: connection reset by peer" errors.`)
-	maxIdleConnections    = flag.Int("remoteWrite.maxIdleConnections", 100, `Defines the number of idle (keep-alive connections) to -remoteWrite.url for the vmalert-tool debug writer, which sends every series in a separate request. Too low a value may result in a high number of sockets in TIME_WAIT state.`)
 
 	maxQueueSize  = flag.Int("remoteWrite.maxQueueSize", defaultMaxQueueSize, "Defines the max number of pending datapoints to remote write endpoint")
 	maxBatchSize  = flag.Int("remoteWrite.maxBatchSize", defaultMaxBatchSize, "Defines max number of timeseries to be flushed at once")
@@ -58,8 +57,7 @@ var (
 	oauth2Scopes   = flag.String("remoteWrite.oauth2.scopes", "", "Optional OAuth2 scopes to use for -notifier.url. Scopes must be delimited by ';'.")
 )
 
-// InitSecretFlags manages the secret flags for this pkg and must be called by app-level initSecretFlags.
-// It should run before logger initialization and package Init() (if exists).
+// InitSecretFlags must be called after flag.Parse and before any logging
 func InitSecretFlags() {
 	if !*showRemoteWriteURL {
 		flagutil.RegisterSecretFlag("remoteWrite.url")

app/vmalert/replay.go

@@ -25,13 +25,11 @@ var (
 	replayMaxDatapoints = flag.Int("replay.maxDatapointsPerQuery", 1e3,
 		"Max number of data points expected in one request. It affects the max time range for every '/query_range' request during the replay. The higher the value, the less requests will be made during replay.")
 	replayRuleRetryAttempts = flag.Int("replay.ruleRetryAttempts", 5,
-		"Defines how many retries to make before giving up on rule if request for it returns a retriable error.")
+		"Defines how many retries to make before giving up on rule if request for it returns an error.")
 	disableProgressBar = flag.Bool("replay.disableProgressBar", false, "Whether to disable rendering progress bars during the replay. "+
 		"Progress bar rendering might be verbose or break the logs parsing, so it is recommended to be disabled when not used in interactive mode.")
 	ruleEvaluationConcurrency = flag.Int("replay.ruleEvaluationConcurrency", 1, "The maximum number of concurrent '/query_range' requests when replay recording rule or alerting rule with for=0. "+
 		"Increasing this value when replaying for a long time, since each request is limited by -replay.maxDatapointsPerQuery.")
-	continueWithExecutionErr = flag.Bool("replay.continueWithExecutionErr", false, "Whether to continue replaying other rules if a rule execution fails with a 400 or 422 response code, "+
-		"which can happen due to an expression syntax error or a resource limit being hit.")
 )
 
 func replay(groupsCfg []config.Group, qb datasource.QuerierBuilder, rw remotewrite.RWClient) (totalRows, droppedRows int, err error) {
@@ -75,7 +73,7 @@ func replay(groupsCfg []config.Group, qb datasource.QuerierBuilder, rw remotewri
 
 	for _, cfg := range groupsCfg {
 		ng := rule.NewGroup(cfg, qb, *evaluationInterval, labels)
-		totalRows += ng.Replay(tFrom, tTo, rw, *replayMaxDatapoints, *replayRuleRetryAttempts, *replayRulesDelay, *disableProgressBar, *ruleEvaluationConcurrency, *continueWithExecutionErr)
+		totalRows += ng.Replay(tFrom, tTo, rw, *replayMaxDatapoints, *replayRuleRetryAttempts, *replayRulesDelay, *disableProgressBar, *ruleEvaluationConcurrency)
 	}
 	logger.Infof("replay evaluation finished, generated %d samples", totalRows)
 	if err := rw.Close(); err != nil {

app/vmalert/replay_test.go

@@ -8,10 +8,8 @@ import (
 
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmalert/config"
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmalert/datasource"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httpserver"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/prompb"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promutil"
-	"github.com/VictoriaMetrics/metricsql"
 )
 
 type fakeReplayQuerier struct {
@@ -34,14 +32,6 @@ func (fc *fakeRWClient) Close() error {
 }
 
 func (fr *fakeReplayQuerier) QueryRange(_ context.Context, q string, from, to time.Time) (res datasource.Result, err error) {
-	_, err = metricsql.Parse(q)
-	if err != nil {
-		return res, &httpserver.ErrorWithStatusCode{
-			StatusCode: 422,
-			Err:        err,
-		}
-	}
-
 	key := fmt.Sprintf("%s+%s", from.Format("15:04:05"), to.Format("15:04:05"))
 	dps, ok := fr.registry[q]
 	if !ok {
@@ -285,28 +275,4 @@ func TestReplay(t *testing.T) {
 			},
 		},
 	}, 10)
-
-	// rule with wrong expression won't break the other rule with continueWithExecutionErr
-	continueWithExecutionErrOld := *continueWithExecutionErr
-	defer func() {
-		*continueWithExecutionErr = continueWithExecutionErrOld
-	}()
-	*continueWithExecutionErr = true
-	f("2021-01-01T12:00:00.000Z", "2021-01-01T12:02:30.000Z", 1, 1, time.Millisecond, []config.Group{
-		{Rules: []config.Rule{{Record: "foo", Expr: "sum(up)"}}},
-		{Rules: []config.Rule{{Record: "bar", Expr: "up ++"}}},
-	}, &fakeReplayQuerier{
-		registry: map[string]map[string][]datasource.Metric{
-			"sum(up)": {
-				"12:00:00+12:01:00": {
-					{
-						Timestamps: []int64{1, 2},
-						Values:     []float64{1, 2},
-					},
-				},
-				"12:01:00+12:02:00": {},
-				"12:02:00+12:02:30": {},
-			},
-		},
-	}, 2)
 }

app/vmalert/rule/alerting.go

@@ -462,11 +462,7 @@ func (ar *AlertingRule) exec(ctx context.Context, ts time.Time, limit int) ([]pr
 	}
 
 	isPartial := isPartialResponse(res)
-	seriesFetched := 0
-	if res.SeriesFetched != nil {
-		seriesFetched = *res.SeriesFetched
-	}
-	ar.logDebugf(ts, nil, "query returned %d series (series_fetched: %d, elapsed: %s, isPartial: %t)", curState.Samples, seriesFetched, curState.Duration, isPartial)
+	ar.logDebugf(ts, nil, "query returned %d series (elapsed: %s, isPartial: %t)", curState.Samples, curState.Duration, isPartial)
 	qFn := func(query string) ([]datasource.Metric, error) {
 		res, _, err := ar.q.Query(ctx, query, ts)
 		return res.Data, err
@@ -534,7 +530,6 @@ func (ar *AlertingRule) exec(ctx context.Context, ts time.Time, limit int) ([]pr
 				ar.logDebugf(ts, a, "INACTIVE => PENDING")
 			}
 			a.Value = m.Values[0]
-			a.Interval = ar.EvalInterval
 			a.Annotations = annotations
 			a.KeepFiringSince = time.Time{}
 			continue
@@ -617,7 +612,6 @@ func (ar *AlertingRule) expandAnnotationTemplates(m datasource.Metric, qFn templ
 		Type:      ar.Type.String(),
 		Labels:    ls.origin,
 		Expr:      ar.Expr,
-		Interval:  ar.EvalInterval,
 		AlertID:   hash(ls.processed),
 		GroupID:   ar.GroupID,
 		ActiveAt:  activeAt,
@@ -679,7 +673,6 @@ func (ar *AlertingRule) newAlert(m datasource.Metric, start time.Time, labels, a
 		Name:        ar.Name,
 		Type:        ar.Type.String(),
 		Expr:        ar.Expr,
-		Interval:    ar.EvalInterval,
 		For:         ar.For,
 		ActiveAt:    start,
 		Value:       m.Values[0],

app/vmalert/rule/alerting_test.go

@@ -662,7 +662,6 @@ func TestAlertingRuleExecRange(t *testing.T) {
 			GroupID:     fakeGroup.GetID(),
 			Name:        "for-pending",
 			Type:        config.NewPrometheusType().String(),
-			Interval:    time.Second,
 			Labels:      map[string]string{"alertname": "for-pending"},
 			Annotations: map[string]string{},
 			State:       notifier.StatePending,
@@ -683,7 +682,6 @@ func TestAlertingRuleExecRange(t *testing.T) {
 			GroupID:     fakeGroup.GetID(),
 			Name:        "for-firing",
 			Type:        config.NewPrometheusType().String(),
-			Interval:    3 * time.Second,
 			Labels:      map[string]string{"alertname": "for-firing"},
 			Annotations: map[string]string{},
 			State:       notifier.StateFiring,
@@ -705,7 +703,6 @@ func TestAlertingRuleExecRange(t *testing.T) {
 			GroupID:     fakeGroup.GetID(),
 			Name:        "for-hold-pending",
 			Type:        config.NewPrometheusType().String(),
-			Interval:    time.Second,
 			Labels:      map[string]string{"alertname": "for-hold-pending"},
 			Annotations: map[string]string{},
 			State:       notifier.StatePending,
@@ -762,7 +759,6 @@ func TestAlertingRuleExecRange(t *testing.T) {
 			GroupID:     fakeGroup.GetID(),
 			Name:        "multi-series",
 			Type:        config.NewPrometheusType().String(),
-			Interval:    3 * time.Second,
 			Labels:      map[string]string{"alertname": "multi-series"},
 			Annotations: map[string]string{},
 			State:       notifier.StateFiring,
@@ -775,7 +771,6 @@ func TestAlertingRuleExecRange(t *testing.T) {
 			GroupID:     fakeGroup.GetID(),
 			Name:        "multi-series",
 			Type:        config.NewPrometheusType().String(),
-			Interval:    3 * time.Second,
 			Labels:      map[string]string{"alertname": "multi-series", "foo": "bar"},
 			Annotations: map[string]string{},
 			State:       notifier.StatePending,
@@ -1139,8 +1134,7 @@ func TestAlertingRule_Template(t *testing.T) {
 		fq.Add(metrics...)
 		fq.SetPartialResponse(isResponsePartial)
 
-		ts := time.Unix(3600, 0)
-		if _, err := rule.exec(context.TODO(), ts, 0); err != nil {
+		if _, err := rule.exec(context.TODO(), time.Now(), 0); err != nil {
 			t.Fatalf("unexpected error: %s", err)
 		}
 		for hash, expAlert := range alertsExpected {
@@ -1158,14 +1152,12 @@ func TestAlertingRule_Template(t *testing.T) {
 	}
 
 	f(&AlertingRule{
-		Name:         "common",
-		EvalInterval: time.Hour,
+		Name: "common",
 		Labels: map[string]string{
 			"region": "east",
 		},
 		Annotations: map[string]string{
-			"summary":   `{{ $labels.alertname }}: Too high connection number for "{{ $labels.instance }}"`,
-			"dashboard": `&from={{ ($activeAt.Add (parseDurationTime (printf "-%s" .Interval))).UnixMilli }}&to={{ $activeAt.UnixMilli }}`,
+			"summary": `{{ $labels.alertname }}: Too high connection number for "{{ $labels.instance }}"`,
 		},
 		alerts: make(map[uint64]*notifier.Alert),
 	}, []datasource.Metric{
@@ -1174,8 +1166,7 @@ func TestAlertingRule_Template(t *testing.T) {
 	}, false, map[uint64]*notifier.Alert{
 		hash(map[string]string{alertNameLabel: "common", "region": "east", "instance": "foo"}): {
 			Annotations: map[string]string{
-				"summary":   `common: Too high connection number for "foo"`,
-				"dashboard": "&from=0&to=3600000",
+				"summary": `common: Too high connection number for "foo"`,
 			},
 			Labels: map[string]string{
 				alertNameLabel: "common",
@@ -1185,8 +1176,7 @@ func TestAlertingRule_Template(t *testing.T) {
 		},
 		hash(map[string]string{alertNameLabel: "common", "region": "east", "instance": "bar"}): {
 			Annotations: map[string]string{
-				"summary":   `common: Too high connection number for "bar"`,
-				"dashboard": "&from=0&to=3600000",
+				"summary": `common: Too high connection number for "bar"`,
 			},
 			Labels: map[string]string{
 				alertNameLabel: "common",
@@ -1398,7 +1388,7 @@ func TestAlertingRule_ToLabels(t *testing.T) {
 		"alertname":     "ConfigurationReloadFailure",
 		"alertgroup":    "vmalert",
 		"pod":           "vmalert-0",
-		"invalid_label": `error evaluating template: template: :1:326: executing "" at <.Values.mustRuntimeFail>: can't evaluate field Values in type notifier.tplData`,
+		"invalid_label": `error evaluating template: template: :1:298: executing "" at <.Values.mustRuntimeFail>: can't evaluate field Values in type notifier.tplData`,
 	}
 
 	expectedProcessedLabels := map[string]string{
@@ -1408,7 +1398,7 @@ func TestAlertingRule_ToLabels(t *testing.T) {
 		"exported_alertname": "ConfigurationReloadFailure",
 		"group":              "vmalert",
 		"alertgroup":         "vmalert",
-		"invalid_label":      `error evaluating template: template: :1:326: executing "" at <.Values.mustRuntimeFail>: can't evaluate field Values in type notifier.tplData`,
+		"invalid_label":      `error evaluating template: template: :1:298: executing "" at <.Values.mustRuntimeFail>: can't evaluate field Values in type notifier.tplData`,
 	}
 
 	ls, err := ar.toLabels(metric, nil)

app/vmalert/rule/group.go

@@ -97,7 +97,6 @@ type groupMetrics struct {
 	iterationMissed   *metrics.Counter
 	iterationReset    *metrics.Counter
 	iterationInterval *metrics.Gauge
-	iterationLimit    *metrics.Gauge
 }
 
 // merges group rule labels into result map
@@ -290,8 +289,6 @@ func (g *Group) updateWith(newGroup *Group) error {
 	g.Headers = newGroup.Headers
 	g.NotifierHeaders = newGroup.NotifierHeaders
 	g.Labels = newGroup.Labels
-	g.EvalDelay = newGroup.EvalDelay
-	g.evalAlignment = newGroup.evalAlignment
 	g.Limit = newGroup.Limit
 	g.checksum = newGroup.checksum
 	g.Rules = newRules
@@ -339,12 +336,6 @@ func (g *Group) Init() {
 		i := g.Interval.Seconds()
 		return i
 	})
-	g.metrics.iterationLimit = g.metrics.set.NewGauge(fmt.Sprintf(`vmalert_group_rule_results_limit{%s}`, labels), func() float64 {
-		g.mu.RLock()
-		limit := g.Limit
-		g.mu.RUnlock()
-		return float64(limit)
-	})
 	for i := range g.Rules {
 		g.Rules[i].registerMetrics(g.metrics.set)
 	}
@@ -375,7 +366,7 @@ func (g *Group) Start(ctx context.Context, rw remotewrite.RWClient, rr datasourc
 				g.mu.Lock()
 				err := g.updateWith(ng)
 				if err != nil {
-					logger.Errorf("group %q (file=%q): failed to update: %s", g.Name, g.File, err)
+					logger.Errorf("group %q: failed to update: %s", g.Name, err)
 					g.mu.Unlock()
 					continue
 				}
@@ -414,7 +405,7 @@ func (g *Group) Start(ctx context.Context, rw remotewrite.RWClient, rr datasourc
 		errs := e.execConcurrently(ctx, g.Rules, ts, g.Concurrency, resolveDuration, g.Limit)
 		for err := range errs {
 			if err != nil {
-				logger.Errorf("group %q (file=%q): %s", g.Name, g.File, err)
+				logger.Errorf("group %q: %s", g.Name, err)
 			}
 		}
 		g.metrics.iterationDuration.UpdateDuration(start)
@@ -443,17 +434,17 @@ func (g *Group) Start(ctx context.Context, rw remotewrite.RWClient, rr datasourc
 	if rr != nil {
 		err := g.restore(ctx, rr, realEvalTS, *remoteReadLookBack)
 		if err != nil {
-			logger.Errorf("error while restoring ruleState for group %q (file=%q): %s", g.Name, g.File, err)
+			logger.Errorf("error while restoring ruleState for group %q: %s", g.Name, err)
 		}
 	}
 
 	for {
 		select {
 		case <-ctx.Done():
-			logger.Infof("group %q (file=%q): context cancelled", g.Name, g.File)
+			logger.Infof("group %q: context cancelled", g.Name)
 			return
 		case <-g.doneCh:
-			logger.Infof("group %q (file=%q): received stop signal", g.Name, g.File)
+			logger.Infof("group %q: received stop signal", g.Name)
 			return
 		case ng := <-g.updateCh:
 			g.mu.Lock()
@@ -467,7 +458,7 @@ func (g *Group) Start(ctx context.Context, rw remotewrite.RWClient, rr datasourc
 
 			err := g.updateWith(ng)
 			if err != nil {
-				logger.Errorf("group %q (file=%q): failed to update: %s", g.Name, g.File, err)
+				logger.Errorf("group %q: failed to update: %s", g.Name, err)
 				g.mu.Unlock()
 				continue
 			}
@@ -545,12 +536,12 @@ func (g *Group) delayBeforeStart(ts time.Time, maxDelay time.Duration) time.Dura
 
 func (g *Group) infof(format string, args ...any) {
 	msg := fmt.Sprintf(format, args...)
-	logger.Infof("group %q (file=%q; interval=%v; eval_offset=%v; concurrency=%d) %s",
-		g.Name, g.File, g.Interval, g.EvalOffset, g.Concurrency, msg)
+	logger.Infof("group %q %s; interval=%v; eval_offset=%v; concurrency=%d",
+		g.Name, msg, g.Interval, g.EvalOffset, g.Concurrency)
 }
 
 // Replay performs group replay
-func (g *Group) Replay(start, end time.Time, rw remotewrite.RWClient, maxDataPoint, replayRuleRetryAttempts int, replayDelay time.Duration, disableProgressBar bool, ruleEvaluationConcurrency int, continueWithExecutionErr bool) int {
+func (g *Group) Replay(start, end time.Time, rw remotewrite.RWClient, maxDataPoint, replayRuleRetryAttempts int, replayDelay time.Duration, disableProgressBar bool, ruleEvaluationConcurrency int) int {
 	var total int
 	step := g.Interval * time.Duration(maxDataPoint)
 	ri := rangeIterator{start: start, end: end, step: step}
@@ -578,7 +569,7 @@ func (g *Group) Replay(start, end time.Time, rw remotewrite.RWClient, maxDataPoi
 			if !disableProgressBar {
 				bar = pb.StartNew(iterations)
 			}
-			total += replayRuleRange(rule, ri, bar, rw, replayRuleRetryAttempts, ruleEvaluationConcurrency, continueWithExecutionErr)
+			total += replayRuleRange(rule, ri, bar, rw, replayRuleRetryAttempts, ruleEvaluationConcurrency)
 			if bar != nil {
 				bar.Finish()
 			}
@@ -600,7 +591,7 @@ func (g *Group) Replay(start, end time.Time, rw remotewrite.RWClient, maxDataPoi
 		rule := g.Rules[i]
 		sem <- struct{}{}
 		wg.Go(func() {
-			res <- replayRuleRange(rule, ri, bar, rw, replayRuleRetryAttempts, ruleEvaluationConcurrency, continueWithExecutionErr)
+			res <- replayRuleRange(rule, ri, bar, rw, replayRuleRetryAttempts, ruleEvaluationConcurrency)
 			<-sem
 		})
 	}
@@ -620,7 +611,7 @@ func (g *Group) Replay(start, end time.Time, rw remotewrite.RWClient, maxDataPoi
 	return total
 }
 
-func replayRuleRange(r Rule, ri rangeIterator, bar *pb.ProgressBar, rw remotewrite.RWClient, replayRuleRetryAttempts, ruleEvaluationConcurrency int, continueWithExecutionErr bool) int {
+func replayRuleRange(r Rule, ri rangeIterator, bar *pb.ProgressBar, rw remotewrite.RWClient, replayRuleRetryAttempts, ruleEvaluationConcurrency int) int {
 	fmt.Printf("> Rule %q (ID: %d)\n", r, r.ID())
 	// alerting rule with for>0 can't be replayed concurrently, since the status change might depend on the previous evaluation
 	// see https://github.com/VictoriaMetrics/VictoriaMetrics/commit/abcb21aa5ee918ba9a4e9cde495dba06e1e9564c
@@ -635,7 +626,7 @@ func replayRuleRange(r Rule, ri rangeIterator, bar *pb.ProgressBar, rw remotewri
 		start := ri.s
 		end := ri.e
 		wg.Go(func() {
-			n, err := replayRule(r, start, end, rw, replayRuleRetryAttempts, continueWithExecutionErr)
+			n, err := replayRule(r, start, end, rw, replayRuleRetryAttempts)
 			if err != nil {
 				logger.Fatalf("rule %q: %s", r, err)
 			}

app/vmalert/rule/group_test.go

@@ -78,12 +78,6 @@ func TestUpdateWith(t *testing.T) {
 		if g.Debug != expect.Debug {
 			t.Fatalf("expected to have debug %v; got %v", expect.Debug, g.Debug)
 		}
-		if !durationPtrEqual(g.EvalDelay, expect.EvalDelay) {
-			t.Fatalf("expected to have eval_delay %v; got %v", expect.EvalDelay, g.EvalDelay)
-		}
-		if !boolPtrEqual(g.evalAlignment, expect.evalAlignment) {
-			t.Fatalf("expected to have eval_alignment %v; got %v", expect.evalAlignment, g.evalAlignment)
-		}
 	}
 
 	// new rule
@@ -243,37 +237,6 @@ func TestUpdateWith(t *testing.T) {
 			{Alert: "foo1", Debug: &debug},
 		},
 	})
-
-	// update group evaluation settings
-	evalDelay := promutil.NewDuration(time.Minute)
-	evalAlignment := false
-	f(config.Group{
-		Rules: []config.Rule{{
-			Record: "foo",
-			Expr:   "max(up)",
-		}},
-	}, config.Group{
-		EvalDelay:     evalDelay,
-		EvalAlignment: &evalAlignment,
-		Rules: []config.Rule{{
-			Record: "foo",
-			Expr:   "min(up)",
-		}},
-	})
-}
-
-func durationPtrEqual(a, b *time.Duration) bool {
-	if a == nil || b == nil {
-		return a == b
-	}
-	return *a == *b
-}
-
-func boolPtrEqual(a, b *bool) bool {
-	if a == nil || b == nil {
-		return a == b
-	}
-	return *a == *b
 }
 
 func TestUpdateDuringRandSleep(t *testing.T) {

app/vmalert/rule/recording.go

@@ -208,11 +208,7 @@ func (rr *RecordingRule) exec(ctx context.Context, ts time.Time, limit int) ([]p
 		return nil, curState.Err
 	}
 
-	seriesFetched := 0
-	if res.SeriesFetched != nil {
-		seriesFetched = *res.SeriesFetched
-	}
-	rr.logDebugf(ts, "query returned %d samples (series_fetched: %d, elapsed: %s, isPartial: %t)", curState.Samples, seriesFetched, curState.Duration, isPartialResponse(res))
+	rr.logDebugf(ts, "query returned %d samples (elapsed: %s, isPartial: %t)", curState.Samples, curState.Duration, isPartialResponse(res))
 
 	qMetrics := res.Data
 	numSeries := len(qMetrics)

app/vmalert/rule/recording_test.go

@@ -457,10 +457,12 @@ func TestSetIntervalAsTimeFilter(t *testing.T) {
 	f(`* | count()`, "vlogs", true)
 	f(`error OR _time:5m  | count()`, "vlogs", true)
 	f(`(_time: 5m AND error) OR (_time: 5m AND warn) | count()`, "vlogs", true)
+	f(`* | error OR _time:5m | count()`, "vlogs", true)
 
 	f(`_time:5m | count()`, "vlogs", false)
 	f(`_time:2023-04-25T22:45:59Z | count()`, "vlogs", false)
 	f(`error AND _time:5m | count()`, "vlogs", false)
+	f(`* | error AND _time:5m | count()`, "vlogs", false)
 }
 
 func TestRecordingRuleExec_Partial(t *testing.T) {

app/vmalert/rule/rule.go

@@ -4,14 +4,12 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net/http"
 	"sync"
 	"time"
 
 	"github.com/VictoriaMetrics/metrics"
 
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmalert/remotewrite"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httpserver"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/prompb"
 )
@@ -120,7 +118,7 @@ func (s *ruleState) add(e StateEntry) {
 	s.entries[s.cur] = e
 }
 
-func replayRule(r Rule, start, end time.Time, rw remotewrite.RWClient, replayRuleRetryAttempts int, continueWithExecutionErr bool) (int, error) {
+func replayRule(r Rule, start, end time.Time, rw remotewrite.RWClient, replayRuleRetryAttempts int) (int, error) {
 	var err error
 	var tss []prompb.TimeSeries
 	for i := range replayRuleRetryAttempts {
@@ -128,22 +126,6 @@ func replayRule(r Rule, start, end time.Time, rw remotewrite.RWClient, replayRul
 		if err == nil {
 			break
 		}
-		// retry request if possible to tolerate temporary network or datasource unavailability issues
-		var esc *httpserver.ErrorWithStatusCode
-		if errors.As(err, &esc) {
-			statusCode := esc.StatusCode
-			// if the status code is 400 or 422, the query failed due to reasons such as an expression syntax error or a resource limit being hit,
-			// rather than datasource unavailability.
-			// Continue replaying but skip the problematic execution if continueWithExecutionErr is true, otherwise, return the error without retry.
-			if statusCode == http.StatusUnprocessableEntity || statusCode == http.StatusBadRequest {
-				if continueWithExecutionErr {
-					logger.Errorf("rule %q: %s", r, err)
-					return 0, nil
-				} else {
-					return 0, err
-				}
-			}
-		}
 		logger.Errorf("attempt %d to execute rule %q failed: %s", i+1, r, err)
 		time.Sleep(time.Second)
 	}

app/vmalert/rule/web.go

@@ -75,13 +75,10 @@ type GroupAlerts struct {
 // ApiRule represents a Rule for web view
 // see https://github.com/prometheus/compliance/blob/main/alert_generator/specification.md#get-apiv1rules
 type ApiRule struct {
-	// Rule state must be one of these under following scenarios:
-	//  "pending": at least 1 alert in the rule in pending state and no other alert in firing state. (only for alerting rules)
-	//  "firing": at least 1 alert in the rule in firing state. (only for alerting rules)
-	//  "inactive": rule's last evaluation was successful but no alert in the rule in firing or pending state. (only for alerting rules)
-	//  "unhealthy": rule's last evaluation was failed with error. (for both alerting and recording rules)
-	// 	"nomatch": rule's last evaluation was successful but no time series matched the rule's expression. (for both alerting and recording rules)
-	//  "ok": the recording rule's last evaluation was successful. (only for recording rules)
+	// State must be one of these under following scenarios
+	//  "pending": at least 1 alert in the rule in pending state and no other alert in firing ruleState.
+	//  "firing": at least 1 alert in the rule in firing state.
+	//  "inactive": no alert in the rule in firing or pending state.
 	State string `json:"state"`
 	Name  string `json:"name"`
 	// Query represents Rule's `expression` field
@@ -240,7 +237,6 @@ func NewAlertAPI(ar *AlertingRule, a *notifier.Alert) *ApiAlert {
 }
 
 func (r *ApiRule) ExtendState() {
-	// if alerting rule already has alerts, then state is already set to either "pending" or "firing" and we don't need to change it
 	if len(r.Alerts) > 0 {
 		return
 	}

app/vmalert/web.go

@@ -115,7 +115,7 @@ func (rh *requestHandler) handler(w http.ResponseWriter, r *http.Request) bool {
 		}
 		WriteRule(w, r, rule)
 		return true
-	// used by old vmalert UI
+	// current used by old vmalert UI and Grafana Alerts
 	case "/vmalert/groups", "/rules":
 		rf, err := newRulesFilter(r)
 		if err != nil {
@@ -128,8 +128,6 @@ func (rh *requestHandler) handler(w http.ResponseWriter, r *http.Request) bool {
 			state = rf.states[0]
 			rf.states = rf.states[:1]
 		}
-		// enable extendedStates by default for vmalert UI
-		rf.extendedStates = true
 		lr := rh.groups(rf)
 		WriteListGroups(w, r, lr.Data.Groups, state)
 		return true
@@ -545,8 +543,6 @@ func (rh *requestHandler) groups(rf *rulesFilter) *listGroupsResponse {
 			if !groupFound && !strings.Contains(strings.ToLower(rule.Name), rf.search) {
 				continue
 			}
-			// extendedStates is used by the vmalert UI to extend the rule state with values such as "nomatch" and "unhealthy".
-			// those states are not supported by Grafana and not part of the Prometheus API spec yet
 			if rf.extendedStates {
 				rule.ExtendState()
 			}

app/vmalert/web.qtpl

@@ -130,12 +130,9 @@
                             data-bs-target="#item-{%s g.ID %}"
                         >
                             <span class="d-flex gap-2">
-                                {% if g.States["inactive"] > 0 %}<span class="badge bg-light text-success border border-success" title="None of the alert instances is in a pending or firing state">{%d g.States["inactive"] %} inactive</span> {% endif %}
-                                {% if g.States["pending"] > 0 %}<span class="badge bg-warning text-dark" title="At least one alert instance is pending">{%d g.States["pending"] %} pending</span> {% endif %}
-                                {% if g.States["firing"] > 0 %}<span class="badge bg-danger" title="At least one alert instance is firing">{%d g.States["firing"] %} firing</span> {% endif %}
-                                {% if g.States["ok"] > 0 %}<span class="badge bg-success" title="Recording rule last evaluation succeeded">{%d g.States["ok"] %} ok</span>{% endif %}
-                                {% if g.States["unhealthy"] > 0 %}<span class="badge bg-danger" title="Last evaluation failed with an error">{%d g.States["unhealthy"] %} unhealthy</span> {% endif %}
-                                {% if g.States["nomatch"] > 0 %}<span class="badge bg-warning" title="Rule expression matched no time series">{%d g.States["nomatch"] %} nomatch</span> {% endif %}
+                                {% if g.States["unhealthy"] > 0 %}<span class="badge bg-danger" title="Number of rules with status Error">{%d g.States["unhealthy"] %}</span> {% endif %}
+                                {% if g.States["nomatch"] > 0 %}<span class="badge bg-warning" title="Number of rules with status NoMatch">{%d g.States["nomatch"] %}</span> {% endif %}
+                                <span class="badge bg-success" title="Number of rules with status Ok">{%d g.States["ok"] %}</span>
                             </span>
                         </span>
                     </span>
@@ -172,7 +169,7 @@
                             <thead>
                                 <tr>
                                     <th scope="col" class="w-60">Rule</th>
-                                    <th scope="col" class="w-20" class="text-center" title="How many series were produced by the rule">Series Returned</th>
+                                    <th scope="col" class="w-20" class="text-center" title="How many series were produced by the rule">Series</th>
                                     <th scope="col" class="w-20" class="text-center" title="How many seconds ago rule was executed">Updated</th>
                                 </tr>
                             </thead>
@@ -191,21 +188,8 @@
                                                     {% else %}
                                                         <b>record:</b> {%s r.Name %}
                                                     {% endif %}
-                                                    {% if r.State == "inactive" %}
-                                                        <span><a class="badge bg-success">{%s r.State %}</a></span>
-                                                    {% elseif  r.State == "pending" %}
-                                                        <span><a class="badge bg-warning">{%s r.State %}</a></span>
-                                                    {% elseif  r.State == "firing" %}
-                                                        <span><a class="badge bg-danger">{%s r.State %}</a></span>
-                                                    {% elseif  r.State == "ok" %}
-                                                        <span><a class="badge bg-success">{%s r.State %}</a></span>
-                                                    {% elseif  r.State == "unhealthy" %}
-                                                        <span><a class="badge bg-danger">{%s r.State %}</a></span>
-                                                    {% elseif  r.State == "nomatch" %}
-                                                        <span><a class="badge bg-warning">{%s r.State %}</a></span>
-                                                    {% endif %}
-                                                    {%= seriesFetchedWarn(prefix, &r) %}
                                                     |
+                                                    {%= seriesFetchedWarn(prefix, &r) %}
                                                     <span><a target="_blank" href="{%s prefix+r.WebLink() %}">Details</a></span>
                                                 </div>
                                                 <div class="col-12">

app/vmauth/auth_config.go

@@ -58,9 +58,12 @@ var (
 type AuthConfig struct {
 	Users            []UserInfo `yaml:"users,omitempty"`
 	UnauthorizedUser *UserInfo  `yaml:"unauthorized_user,omitempty"`
+	SSO              SSOConfig  `yaml:"sso,omitempty"`
 
 	// ms holds all the metrics for the given AuthConfig
 	ms *metrics.Set
+
+	oidcDP *oidcDiscovererPool
 }
 
 // UserInfo is user information read from authConfigPath
@@ -118,10 +121,9 @@ type AccessLogFilters struct {
 }
 
 func (ui *UserInfo) logRequest(r *http.Request, userName string, statusCode int, duration time.Duration) {
-	if ui == nil || ui.AccessLog == nil {
+	if ui.AccessLog == nil {
 		return
 	}
-
 	filters := ui.AccessLog.Filters
 	if filters != nil && len(filters.SkipStatusCodes) > 0 {
 		if slices.Contains(filters.SkipStatusCodes, statusCode) {
@@ -135,17 +137,6 @@ func (ui *UserInfo) logRequest(r *http.Request, userName string, statusCode int,
 		r.Host, requestURI, statusCode, remoteAddr, r.UserAgent(), r.Referer(), duration.Milliseconds(), userName)
 }
 
-// hasAnyURLs reports whether ui has at least one backend URL route configured.
-// It is used only for unauthorized_user config section, since other users
-// must always have either URLPrefix or URLMaps set.
-func (ui *UserInfo) hasAnyURLs() bool {
-	if ui == nil {
-		return false
-	}
-
-	return ui.URLPrefix != nil || len(ui.URLMaps) > 0 || ui.DefaultURL != nil
-}
-
 // HeadersConf represents config for request and response headers.
 type HeadersConf struct {
 	RequestHeaders     []*Header `yaml:"headers,omitempty"`
@@ -923,12 +914,25 @@ func reloadAuthConfigData(data []byte) (bool, error) {
 		return false, fmt.Errorf("failed to parse auth config: %w", err)
 	}
 
-	oidcDP := &oidcDiscovererPool{}
-	jui, err := parseJWTUsers(ac, oidcDP)
+	if err := validateSSOConfigs(ac.SSO); err != nil {
+		return false, fmt.Errorf("invalid SSO config: %w", err)
+	}
+
+	jui, oidcDP, err := parseJWTUsers(ac)
 	if err != nil {
 		return false, fmt.Errorf("failed to parse JWT users from auth config: %w", err)
 	}
+
+	ac.oidcDP = oidcDP
+
+	// Register SSO issuers with the OIDC discoverer pool so their discovery
+	// runs together with JWT users during startDiscovery below.
+	for _, cfg := range ac.SSO {
+		oidcDP.createOrAdd(cfg.OpenIDConnect.Issuer, nil)
+	}
+
 	oidcDP.startDiscovery()
+
 	jwtc := &jwtCache{
 		users:  jui,
 		oidcDP: oidcDP,
@@ -995,11 +999,8 @@ func parseAuthConfig(data []byte) (*AuthConfig, error) {
 		if err := parseJWTPlaceholdersForUserInfo(ui, false); err != nil {
 			return nil, err
 		}
-
-		if ui.hasAnyURLs() {
-			if err := ui.initURLs(); err != nil {
-				return nil, err
-			}
+		if err := ui.initURLs(); err != nil {
+			return nil, err
 		}
 
 		metricLabels, err := ui.getMetricLabels()

app/vmauth/example_config.yml

@@ -140,18 +140,6 @@ users:
   - "ProjectID: {{.MetricsProjectID}}"
   url_prefix: "http://vminsert:8480/insert/prometheus"
 
-# JWT-based routing that relies solely on custom claims.
-# The `vm_access` claim is missing, default value will be used.
-# e.g. {"role": "admin"}.
-- name: jwt-custom-claims
-  jwt:
-    skip_verify: true
-    vm_default_access_claim:
-        metrics_account_id: 1
-    match_claims:
-      role: admin
-  url_prefix: "http://vmselect-admin:8481/select/0/prometheus"
-
 # Requests without Authorization header are proxied according to `unauthorized_user` section.
 # Requests are proxied in round-robin fashion between `url_prefix` backends.
 # The deny_partial_response query arg is added to all the proxied requests.

app/vmauth/jwt.go

@@ -65,8 +65,6 @@ type JWTConfig struct {
 	MatchClaims       map[string]string `yaml:"match_claims,omitempty"`
 	parsedMatchClaims []*jwt.Claim
 
-	DefaultVMAccessClaim *jwt.VMAccessClaim `yaml:"default_vm_access_claim,omitempty"`
-
 	// verifierPool is used to verify JWT tokens.
 	// It is initialized from PublicKeys and/or PublicKeyFiles.
 	// In this case, it is initialized once at config reload and never updated until next reload
@@ -74,8 +72,9 @@ type JWTConfig struct {
 	verifierPool atomic.Pointer[jwt.VerifierPool]
 }
 
-func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, error) {
+func parseJWTUsers(ac *AuthConfig) ([]*UserInfo, *oidcDiscovererPool, error) {
 	jui := make([]*UserInfo, 0, len(ac.Users))
+	oidcDP := &oidcDiscovererPool{}
 
 	uniqClaims := make(map[string]*UserInfo)
 	var sortedClaims []string
@@ -86,10 +85,10 @@ func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, err
 		}
 
 		if ui.AuthToken != "" || ui.BearerToken != "" || ui.Username != "" || ui.Password != "" {
-			return nil, fmt.Errorf("auth_token, bearer_token, username and password cannot be specified if jwt is set")
+			return nil, nil, fmt.Errorf("auth_token, bearer_token, username and password cannot be specified if jwt is set")
 		}
 		if len(jwtToken.PublicKeys) == 0 && len(jwtToken.PublicKeyFiles) == 0 && !jwtToken.SkipVerify && jwtToken.OIDC == nil {
-			return nil, fmt.Errorf("jwt must contain at least a single public key, public_key_files, oidc or have skip_verify=true")
+			return nil, nil, fmt.Errorf("jwt must contain at least a single public key, public_key_files, oidc or have skip_verify=true")
 		}
 		var claimsString string
 		sortedClaims = sortedClaims[:0]
@@ -98,7 +97,7 @@ func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, err
 			sortedClaims = append(sortedClaims, fmt.Sprintf("%s=%s", ck, cv))
 			pc, err := jwt.NewClaim(ck, cv)
 			if err != nil {
-				return nil, fmt.Errorf("incorrect match claim, key=%q, value regex=%q: %w", ck, cv, err)
+				return nil, nil, fmt.Errorf("incorrect match claim, key=%q, value regex=%q: %w", ck, cv, err)
 			}
 			parsedClaims = append(parsedClaims, pc)
 		}
@@ -107,7 +106,7 @@ func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, err
 		claimsString = strings.Join(sortedClaims, ",")
 
 		if oldUI, ok := uniqClaims[claimsString]; ok {
-			return nil, fmt.Errorf("duplicate match claims=%q found for name=%q at idx=%d; the previous one is set for name=%q", claimsString, ui.Name, idx, oldUI.Name)
+			return nil, nil, fmt.Errorf("duplicate match claims=%q found for name=%q at idx=%d; the previous one is set for name=%q", claimsString, ui.Name, idx, oldUI.Name)
 		}
 		uniqClaims[claimsString] = &ui
 		if len(jwtToken.PublicKeys) > 0 || len(jwtToken.PublicKeyFiles) > 0 {
@@ -116,7 +115,7 @@ func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, err
 			for i := range jwtToken.PublicKeys {
 				k, err := jwt.ParseKey([]byte(jwtToken.PublicKeys[i]))
 				if err != nil {
-					return nil, err
+					return nil, nil, err
 				}
 				keys = append(keys, k)
 			}
@@ -124,52 +123,52 @@ func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, err
 			for _, filePath := range jwtToken.PublicKeyFiles {
 				keyData, err := os.ReadFile(filePath)
 				if err != nil {
-					return nil, fmt.Errorf("cannot read public key from file %q: %w", filePath, err)
+					return nil, nil, fmt.Errorf("cannot read public key from file %q: %w", filePath, err)
 				}
 				k, err := jwt.ParseKey(keyData)
 				if err != nil {
-					return nil, fmt.Errorf("cannot parse public key from file %q: %w", filePath, err)
+					return nil, nil, fmt.Errorf("cannot parse public key from file %q: %w", filePath, err)
 				}
 				keys = append(keys, k)
 			}
 
 			vp, err := jwt.NewVerifierPool(keys)
 			if err != nil {
-				return nil, err
+				return nil, nil, err
 			}
 
 			jwtToken.verifierPool.Store(vp)
 		}
 		if jwtToken.OIDC != nil {
 			if len(jwtToken.PublicKeys) > 0 || len(jwtToken.PublicKeyFiles) > 0 || jwtToken.SkipVerify {
-				return nil, fmt.Errorf("jwt with oidc cannot contain public keys or have skip_verify=true")
+				return nil, nil, fmt.Errorf("jwt with oidc cannot contain public keys or have skip_verify=true")
 			}
 
 			if jwtToken.OIDC.Issuer == "" {
-				return nil, fmt.Errorf("oidc issuer cannot be empty")
+				return nil, nil, fmt.Errorf("oidc issuer cannot be empty")
 			}
 			isserURL, err := url.Parse(jwtToken.OIDC.Issuer)
 			if err != nil {
-				return nil, fmt.Errorf("oidc issuer %q must be a valid URL", jwtToken.OIDC.Issuer)
+				return nil, nil, fmt.Errorf("oidc issuer %q must be a valid URL", jwtToken.OIDC.Issuer)
 			}
 			if isserURL.Scheme != "https" && isserURL.Scheme != "http" {
-				return nil, fmt.Errorf("oidc issuer %q must have http or https scheme", jwtToken.OIDC.Issuer)
+				return nil, nil, fmt.Errorf("oidc issuer %q must have http or https scheme", jwtToken.OIDC.Issuer)
 			}
 
 			oidcDP.createOrAdd(ui.JWT.OIDC.Issuer, &ui.JWT.verifierPool)
 		}
 
 		if err := parseJWTPlaceholdersForUserInfo(&ui, true); err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		if err := ui.initURLs(); err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		metricLabels, err := ui.getMetricLabels()
 		if err != nil {
-			return nil, fmt.Errorf("cannot parse metric_labels: %w", err)
+			return nil, nil, fmt.Errorf("cannot parse metric_labels: %w", err)
 		}
 		ui.requests = ac.ms.GetOrCreateCounter(`vmauth_user_requests_total` + metricLabels)
 		ui.requestErrors = ac.ms.GetOrCreateCounter(`vmauth_user_request_errors_total` + metricLabels)
@@ -188,7 +187,7 @@ func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, err
 
 		rt, err := newRoundTripper(ui.TLSCAFile, ui.TLSCertFile, ui.TLSKeyFile, ui.TLSServerName, ui.TLSInsecureSkipVerify)
 		if err != nil {
-			return nil, fmt.Errorf("cannot initialize HTTP RoundTripper: %w", err)
+			return nil, nil, fmt.Errorf("cannot initialize HTTP RoundTripper: %w", err)
 		}
 		ui.rt = rt
 
@@ -201,7 +200,7 @@ func parseJWTUsers(ac *AuthConfig, oidcDP *oidcDiscovererPool) ([]*UserInfo, err
 		return len(jui[i].JWT.MatchClaims) > len(jui[j].JWT.MatchClaims)
 	})
 
-	return jui, nil
+	return jui, oidcDP, nil
 }
 
 var tokenPool sync.Pool
@@ -434,6 +433,7 @@ func validateJWTPlaceholdersForURL(up *URLPrefix, isAllowed bool) error {
 			}
 			if strings.Contains(p, placeholderPrefix) {
 				return fmt.Errorf("invalid placeholder found in URL request path: %q, supported values are: %s", bu.Path, strings.Join(allPlaceholders, ", "))
+
 			}
 		}
 		for param, values := range bu.Query() {
@@ -488,6 +488,7 @@ func hasAnyPlaceholders(u *url.URL) bool {
 				return true
 			}
 		}
+
 	}
 	return false
 }

app/vmauth/jwt_test.go

@@ -39,14 +39,16 @@ XOtclIk1uhc03oL9nOQ=
 			}
 			return
 		}
-		oidcDP := &oidcDiscovererPool{}
-		users, err := parseJWTUsers(ac, oidcDP)
+		users, oidcDP, err := parseJWTUsers(ac)
 		if err == nil {
 			t.Fatalf("expecting non-nil error; got %v", users)
 		}
 		if expErr != err.Error() {
 			t.Fatalf("unexpected error; got\n%q\nwant \n%q", err.Error(), expErr)
 		}
+		if oidcDP != nil {
+			t.Fatalf("expecting nil oidcDP; got %v", oidcDP)
+		}
 	}
 
 	// unauthorized_user cannot be used with jwt
@@ -324,8 +326,7 @@ XOtclIk1uhc03oL9nOQ=
 			t.Fatalf("unexpected error: %s", err)
 		}
 
-		oidcDP := &oidcDiscovererPool{}
-		jui, err := parseJWTUsers(ac, oidcDP)
+		jui, oidcDP, err := parseJWTUsers(ac)
 		if err != nil {
 			t.Fatalf("unexpected error: %s", err)
 		}

app/vmauth/main.go

@@ -6,7 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"math/rand/v2"
+	"log"
 	"net"
 	"net/http"
 	"net/textproto"
@@ -32,7 +32,6 @@ import (
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/procutil"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promauth"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/pushmetrics"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/timerpool"
 )
 
 var (
@@ -96,7 +95,6 @@ func main() {
 	flag.CommandLine.SetOutput(os.Stdout)
 	flag.Usage = usage
 	envflag.Parse()
-	initSecretFlags()
 	buildinfo.Init()
 	logger.Init()
 
@@ -172,16 +170,36 @@ func requestHandlerWithInternalRoutes(w http.ResponseWriter, r *http.Request) bo
 }
 
 func requestHandler(w http.ResponseWriter, r *http.Request) bool {
+	// Handle SSO callback before any auth checks.
+	if r.URL.Path == "/_vmauth/sso/callback" {
+		handleSSOCallback(w, r)
+		return true
+	}
+
 	ats := getAuthTokensFromRequest(r)
+
+	log.Println(51)
+	// Inject the SSO session cookie as a Bearer token so that the existing
+	// JWT pipeline can validate it and match it to a configured user.
+	if tok := ssoAuthTokenFromRequest(r); tok != "" {
+		log.Println(52, tok)
+		ats = append(ats, tok)
+	}
+
 	if len(ats) == 0 {
 		// Process requests for unauthorized users
 		ui := authConfig.Load().UnauthorizedUser
-		if ui.hasAnyURLs() {
+		if ui != nil {
 			processUserRequest(w, r, ui, nil)
 			return true
 		}
-
-		ui.logRequest(r, `unauthorized`, http.StatusUnauthorized, 0)
+		log.Println(1)
+		if cfg := ssoConfigForHost(r.Host); cfg != nil {
+			log.Println(2)
+			showSSOLoginPage(w, r, cfg)
+			return true
+		}
+		log.Println(3)
 		handleMissingAuthorizationError(w)
 		return true
 	}
@@ -195,23 +213,22 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool {
 			logger.Panicf("BUG: unexpected nil jwt token for user %q", ui.name())
 		}
 		defer putToken(tkn)
-		// Call processUserRequest only if the token contains the vm_access claim
-		// or a default claim is configured; otherwise fall through to unauthorized_user.
-		if tkn.HasVMAccessClaim() || ui.JWT.DefaultVMAccessClaim != nil {
-			processUserRequest(w, r, ui, tkn)
-			return true
-		}
+		processUserRequest(w, r, ui, tkn)
+		return true
 	}
 
 	uu := authConfig.Load().UnauthorizedUser
-	if uu.hasAnyURLs() {
+	if uu != nil {
 		processUserRequest(w, r, uu, nil)
 		return true
 	}
 
+	if cfg := ssoConfigForHost(r.Host); cfg != nil {
+		showSSOLoginPage(w, r, cfg)
+		return true
+	}
+
 	invalidAuthTokenRequests.Inc()
-	slowdownUnauthorizedResponse(r)
-	uu.logRequest(r, `unauthorized`, http.StatusUnauthorized, 0)
 	if *logInvalidAuthTokens {
 		err := fmt.Errorf("cannot authorize request with auth tokens %q", ats)
 		err = &httpserver.ErrorWithStatusCode{
@@ -387,7 +404,7 @@ func bufferRequestBody(ctx context.Context, r io.ReadCloser, userName string) (i
 			return nil, &httpserver.ErrorWithStatusCode{
 				Err: fmt.Errorf("reject request from the user %s because the request body couldn't be read in -maxQueueDuration=%s; read %d bytes in %s",
 					userName, *maxQueueDuration, len(buf), d.Truncate(time.Second)),
-				StatusCode: http.StatusRequestTimeout,
+				StatusCode: http.StatusBadRequest,
 			}
 		}
 
@@ -434,12 +451,8 @@ func processRequest(w http.ResponseWriter, r *http.Request, ui *UserInfo, tkn *j
 		}
 		targetURL := bu.url
 		if tkn != nil {
-			vmac := tkn.VMAccess()
-			if !tkn.HasVMAccessClaim() {
-				vmac = ui.JWT.DefaultVMAccessClaim
-			}
 			// for security reasons allow templating only for configured url values and headers
-			targetURL, hc = replaceJWTPlaceholders(bu, hc, vmac)
+			targetURL, hc = replaceJWTPlaceholders(bu, hc, tkn.VMAccess())
 		}
 		if isDefault {
 			// Don't change path and add request_path query param for default route.
@@ -895,25 +908,3 @@ func debugInfo(u *url.URL, r *http.Request) string {
 	fmt.Fprint(s, ")")
 	return s.String()
 }
-
-// slowdownUnauthorizedResponse adds a random delay in the [2..3] seconds range before returning an unauthorized response.
-// This reduces the effectiveness of brute-force.
-//
-// Recommended by OWASP Top10:
-// https://owasp.org/Top10/2025/A07_2025-Authentication_Failures
-func slowdownUnauthorizedResponse(r *http.Request) {
-
-	d := 2*time.Second + time.Duration(rand.IntN(1000))*time.Millisecond
-	t := timerpool.Get(d)
-
-	select {
-	case <-t.C:
-	case <-r.Context().Done():
-	}
-	timerpool.Put(t)
-}
-
-// initSecretFlags manages the secret flags for this app and must be called after flag parsing and before logger init.
-func initSecretFlags() {
-	pushmetrics.InitSecretFlags()
-}

app/vmauth/main_synctest_test.go

@@ -1,54 +0,0 @@
-//go:build synctest
-
-package main
-
-import (
-	"context"
-	"net/http"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httpserver"
-)
-
-func TestBufferRequestBody_Timeout(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-
-		defaultMaxQueueDuration := *maxQueueDuration
-		defer func() {
-			*maxQueueDuration = defaultMaxQueueDuration
-		}()
-
-		*maxQueueDuration = 100 * time.Millisecond
-
-		ctx, cancel := context.WithTimeout(context.Background(), *maxQueueDuration)
-		defer cancel()
-
-		_, err := bufferRequestBody(ctx, &timeoutBody{delay: *maxQueueDuration + 100*time.Millisecond}, "foo")
-		if err == nil {
-			t.Fatalf("expecting non-nil error")
-		}
-
-		esc, ok := err.(*httpserver.ErrorWithStatusCode)
-		if !ok {
-			t.Fatalf("unexpected error type: %s", err)
-		}
-		if esc.StatusCode != http.StatusRequestTimeout {
-			t.Fatalf("read request body timeout meet unexpected status code; got %d; want %d", esc.StatusCode, http.StatusRequestTimeout)
-		}
-	})
-}
-
-type timeoutBody struct {
-	delay time.Duration
-}
-
-func (r *timeoutBody) Read(_ []byte) (int, error) {
-	time.Sleep(r.delay)
-	return 0, context.DeadlineExceeded
-}
-
-func (r *timeoutBody) Close() error {
-	return nil
-}

app/vmauth/main_test.go

@@ -739,12 +739,6 @@ users:
 		"vm_access": map[string]any{},
 	}, false)
 
-	// token without vm_access claim, but with a custom claim usable for routing
-	roleToken := genToken(t, map[string]any{
-		"exp":  time.Now().Add(10 * time.Minute).Unix(),
-		"role": "admin",
-	}, true)
-
 	fullToken := genToken(t, map[string]any{
 		"exp": time.Now().Add(10 * time.Minute).Unix(),
 		"vm_access": map[string]any{
@@ -785,45 +779,6 @@ statusCode=401
 Unauthorized`
 	f(simpleCfgStr, request, responseExpected)
 
-	// token without vm_access claim should fall through to unauthorized_user
-	request = httptest.NewRequest(`GET`, "http://some-host.com/abc", nil)
-	request.Header.Set(`Authorization`, `Bearer `+noVMAccessClaimToken)
-	responseExpected = `
-statusCode=200
-path: /bar/abc
-query:
-headers:`
-	f(fmt.Sprintf(`
-unauthorized_user:
-  url_prefix: {BACKEND}/bar
-users:
-- jwt:
-    public_keys:
-    - %q
-    match_claims:
-      role: admin
-  url_prefix: {BACKEND}/foo`, string(publicKeyPEM)), request, responseExpected)
-
-	// token without vm_access claim is accepted when default_vm_access_claim configured
-	request = httptest.NewRequest(`GET`, "http://some-host.com/abc", nil)
-	request.Header.Set(`Authorization`, `Bearer `+roleToken)
-	responseExpected = `
-statusCode=200
-path: /foo/abc
-query:
-headers:`
-	f(fmt.Sprintf(`
-users:
-- jwt:
-    public_keys:
-    - %q
-    default_vm_access_claim:
-      metrics_account_id: 10
-      metrics_project_id: 10
-    match_claims:
-      role: admin
-  url_prefix: {BACKEND}/foo`, string(publicKeyPEM)), request, responseExpected)
-
 	// expired token
 	request = httptest.NewRequest(`GET`, "http://some-host.com/abc", nil)
 	request.Header.Set(`Authorization`, `Bearer `+expiredToken)

app/vmauth/oidc.go

@@ -44,7 +44,19 @@ func (dp *oidcDiscovererPool) createOrAdd(issuer string, vp *atomic.Pointer[jwt.
 		dp.ds[issuer] = ds
 	}
 
-	ds.vps = append(ds.vps, vp)
+	if vp != nil {
+		ds.vps = append(ds.vps, vp)
+	}
+}
+
+// openIDConfig returns the most recently discovered openidConfig for the given issuer,
+// or nil if the issuer is not registered or discovery has not completed yet.
+func (dp *oidcDiscovererPool) openIDConfig(issuer string) *openidConfig {
+	d := dp.ds[issuer]
+	if d == nil {
+		return nil
+	}
+	return d.cfg.Load()
 }
 
 func (dp *oidcDiscovererPool) startDiscovery() {
@@ -80,6 +92,7 @@ func (dp *oidcDiscovererPool) stopDiscovery() {
 type oidcDiscoverer struct {
 	issuer string
 	vps    []*atomic.Pointer[jwt.VerifierPool]
+	cfg    atomic.Pointer[openidConfig]
 }
 
 func (d *oidcDiscoverer) run(ctx context.Context) {
@@ -117,21 +130,26 @@ func (d *oidcDiscoverer) refreshVerifierPools(ctx context.Context) error {
 		return fmt.Errorf("openid configuration issuer %q does not match expected issuer %q", cfg.Issuer, d.issuer)
 	}
 
-	verifierPool, err := fetchAndParseJWKs(ctx, cfg.JWKsURI)
-	if err != nil {
-		return err
-	}
+	d.cfg.Store(&cfg)
 
-	for _, vp := range d.vps {
-		vp.Store(verifierPool)
+	if len(d.vps) > 0 {
+		verifierPool, err := fetchAndParseJWKs(ctx, cfg.JWKsURI)
+		if err != nil {
+			return err
+		}
+		for _, vp := range d.vps {
+			vp.Store(verifierPool)
+		}
 	}
 	return nil
 }
 
 // See https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata for details.
 type openidConfig struct {
-	Issuer  string `json:"issuer"`
-	JWKsURI string `json:"jwks_uri"`
+	Issuer                string `json:"issuer"`
+	JWKsURI               string `json:"jwks_uri"`
+	AuthorizationEndpoint string `json:"authorization_endpoint"`
+	TokenEndpoint         string `json:"token_endpoint"`
 }
 
 var oidcHTTPClient = &http.Client{

app/vmauth/sso.go

@@ -0,0 +1,320 @@
+package main
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"html/template"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
+)
+
+// SSOConfig maps hostname to its SSO configuration.
+type SSOConfig map[string]*SSOHostConfig
+
+// SSOHostConfig holds the SSO configuration for a single host.
+type SSOHostConfig struct {
+	OpenIDConnect *OIDCConnectConfig `yaml:"openid_connect"`
+}
+
+// OIDCConnectConfig is the OpenID Connect configuration for SSO.
+type OIDCConnectConfig struct {
+	Issuer       string `yaml:"issuer"`
+	ClientID     string `yaml:"client_id"`
+	ClientSecret string `yaml:"client_secret"`
+	// RedirectURL is optional. Defaults to https://{host}/_vmauth/sso/callback.
+	RedirectURL string `yaml:"redirect_url,omitempty"`
+	// Scopes defaults to ["openid"] when not set.
+	Scopes []string `yaml:"scopes,omitempty"`
+
+	// filled from OIDC discovery at init time
+	authEndpoint  string
+	tokenEndpoint string
+}
+
+// validateSSOConfigs checks that all required fields are present in SSO configs.
+func validateSSOConfigs(sso SSOConfig) error {
+	for host, cfg := range sso {
+		if cfg.OpenIDConnect == nil {
+			return fmt.Errorf("missing openid_connect config for sso host %q", host)
+		}
+		oidc := cfg.OpenIDConnect
+		if oidc.Issuer == "" {
+			return fmt.Errorf("missing issuer in openid_connect config for sso host %q", host)
+		}
+		if oidc.ClientID == "" {
+			return fmt.Errorf("missing client_id in openid_connect config for sso host %q", host)
+		}
+		if oidc.ClientSecret == "" {
+			return fmt.Errorf("missing client_secret in openid_connect config for sso host %q", host)
+		}
+	}
+	return nil
+}
+
+// ssoConfigForHost returns the SSO host config for the given request host, or nil.
+func ssoConfigForHost(host string) *SSOHostConfig {
+	// Strip port, e.g. "foo.com:8427" -> "foo.com"
+	if i := strings.LastIndexByte(host, ':'); i >= 0 {
+		host = host[:i]
+	}
+	ac := authConfig.Load()
+	if ac == nil || ac.SSO == nil {
+		log.Println(21)
+		return nil
+	}
+	ssoh := ac.SSO[host]
+	if ssoh == nil || ssoh.OpenIDConnect == nil {
+		log.Println(22)
+		return nil
+	}
+
+	oidcCfg := ac.oidcDP.openIDConfig(ssoh.OpenIDConnect.Issuer)
+	if oidcCfg == nil {
+		log.Println(24)
+		return nil
+	}
+	ssoh.OpenIDConnect.authEndpoint = oidcCfg.AuthorizationEndpoint
+	ssoh.OpenIDConnect.tokenEndpoint = oidcCfg.TokenEndpoint
+
+	log.Println(25)
+	return ssoh
+}
+
+// ssoStatePayload is the CSRF state payload embedded in the OIDC state parameter.
+type ssoStatePayload struct {
+	Nonce       string `json:"n"`
+	OriginalURL string `json:"u"`
+	IssuedAt    int64  `json:"t"`
+}
+
+const (
+	ssoStateTTL   = 10 * time.Minute
+	ssoCookieName = "_vmauth_sso"
+)
+
+// buildSSOState builds a signed, self-contained state value safe to use across
+// multiple vmauth instances behind a load balancer.
+//
+// Format: base64url(JSON(payload)) "." base64url(HMAC-SHA256(clientSecret, payload))
+func buildSSOState(originalURL, clientSecret string) (string, error) {
+	nonce := make([]byte, 16)
+	if _, err := rand.Read(nonce); err != nil {
+		return "", fmt.Errorf("cannot generate nonce: %w", err)
+	}
+	p := ssoStatePayload{
+		Nonce:       base64.RawURLEncoding.EncodeToString(nonce),
+		OriginalURL: originalURL,
+		IssuedAt:    time.Now().Unix(),
+	}
+	payloadJSON, err := json.Marshal(p)
+	if err != nil {
+		return "", err
+	}
+	payloadEnc := base64.RawURLEncoding.EncodeToString(payloadJSON)
+	mac := hmac.New(sha256.New, []byte(clientSecret))
+	mac.Write([]byte(payloadEnc))
+	sig := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+	return payloadEnc + "." + sig, nil
+}
+
+// verifySSOState verifies the state signature and expiry, returning the original URL.
+func verifySSOState(state, clientSecret string) (string, error) {
+	dot := strings.LastIndexByte(state, '.')
+	if dot < 0 {
+		return "", fmt.Errorf("invalid state: missing separator")
+	}
+	payloadEnc := state[:dot]
+	sig := state[dot+1:]
+
+	mac := hmac.New(sha256.New, []byte(clientSecret))
+	mac.Write([]byte(payloadEnc))
+	expectedSig := base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+	if !hmac.Equal([]byte(sig), []byte(expectedSig)) {
+		return "", fmt.Errorf("invalid state signature")
+	}
+
+	payloadJSON, err := base64.RawURLEncoding.DecodeString(payloadEnc)
+	if err != nil {
+		return "", fmt.Errorf("cannot decode state payload: %w", err)
+	}
+	var p ssoStatePayload
+	if err := json.Unmarshal(payloadJSON, &p); err != nil {
+		return "", fmt.Errorf("cannot unmarshal state payload: %w", err)
+	}
+	if time.Since(time.Unix(p.IssuedAt, 0)) > ssoStateTTL {
+		return "", fmt.Errorf("state expired")
+	}
+	return p.OriginalURL, nil
+}
+
+var ssoLoginPageTmpl = template.Must(template.New("sso_login").Parse(`<!DOCTYPE html>
+<html>
+<head><meta charset="utf-8"><title>Login</title></head>
+<body>
+<p><a href="{{.}}">Login with SSO</a></p>
+</body>
+</html>`))
+
+// showSSOLoginPage renders a minimal HTML page with a single "Login with SSO"
+// button pointing directly to the OIDC provider's authorization endpoint.
+func showSSOLoginPage(w http.ResponseWriter, r *http.Request, cfg *SSOHostConfig) {
+	oidc := cfg.OpenIDConnect
+	if oidc == nil || oidc.authEndpoint == "" {
+		http.Error(w, "SSO not properly configured for this host", http.StatusInternalServerError)
+		return
+	}
+
+	state, err := buildSSOState(r.RequestURI, oidc.ClientSecret)
+	if err != nil {
+		logger.Errorf("SSO: cannot build state: %s", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	redirectURL := ssoRedirectURL(r, oidc)
+	scopes := oidc.Scopes
+	if len(scopes) == 0 {
+		scopes = []string{"openid"}
+	}
+
+	params := url.Values{}
+	params.Set("response_type", "code")
+	params.Set("client_id", oidc.ClientID)
+	params.Set("redirect_uri", redirectURL)
+	params.Set("scope", strings.Join(scopes, " "))
+	params.Set("state", state)
+	authURL := oidc.authEndpoint + "?" + params.Encode()
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	if err := ssoLoginPageTmpl.Execute(w, authURL); err != nil {
+		logger.Errorf("SSO: cannot render login page: %s", err)
+	}
+}
+
+// handleSSOCallback handles the OIDC authorization code callback at /_vmauth/sso/callback.
+func handleSSOCallback(w http.ResponseWriter, r *http.Request) {
+	cfg := ssoConfigForHost(r.Host)
+	if cfg == nil || cfg.OpenIDConnect == nil {
+		http.Error(w, "SSO not configured for this host", http.StatusBadRequest)
+		return
+	}
+	oidc := cfg.OpenIDConnect
+
+	q := r.URL.Query()
+
+	state := q.Get("state")
+	if state == "" {
+		http.Error(w, "missing state parameter", http.StatusBadRequest)
+		return
+	}
+	originalURL, err := verifySSOState(state, oidc.ClientSecret)
+	if err != nil {
+		logger.Warnf("SSO callback: invalid state from %s: %s", r.RemoteAddr, err)
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
+
+	code := q.Get("code")
+	if code == "" {
+		http.Error(w, "missing code parameter", http.StatusBadRequest)
+		return
+	}
+
+	idToken, err := exchangeCodeForIDToken(r.Context(), oidc, code, ssoRedirectURL(r, oidc))
+	if err != nil {
+		logger.Warnf("SSO callback: token exchange failed: %s", err)
+		http.Error(w, "token exchange failed", http.StatusBadRequest)
+		return
+	}
+
+	http.SetCookie(w, &http.Cookie{
+		Name:     ssoCookieName,
+		Value:    idToken,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   r.TLS != nil,
+		SameSite: http.SameSiteLaxMode,
+	})
+
+	if originalURL == "" {
+		originalURL = "/"
+	}
+	http.Redirect(w, r, originalURL, http.StatusFound)
+}
+
+type tokenResponse struct {
+	IDToken string `json:"id_token"`
+}
+
+// exchangeCodeForIDToken exchanges the OIDC authorization code for an id_token.
+func exchangeCodeForIDToken(ctx context.Context, oidc *OIDCConnectConfig, code, redirectURL string) (string, error) {
+	params := url.Values{}
+	params.Set("grant_type", "authorization_code")
+	params.Set("code", code)
+	params.Set("redirect_uri", redirectURL)
+	params.Set("client_id", oidc.ClientID)
+	params.Set("client_secret", oidc.ClientSecret)
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, oidc.tokenEndpoint, strings.NewReader(params.Encode()))
+	if err != nil {
+		return "", fmt.Errorf("cannot create token request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := oidcHTTPClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("token request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("cannot read token response: %w", err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("token endpoint returned status %d: %s", resp.StatusCode, body)
+	}
+
+	var tr tokenResponse
+	if err := json.Unmarshal(body, &tr); err != nil {
+		return "", fmt.Errorf("cannot unmarshal token response: %w", err)
+	}
+	if tr.IDToken == "" {
+		return "", fmt.Errorf("token response missing id_token")
+	}
+	return tr.IDToken, nil
+}
+
+// ssoAuthTokenFromRequest extracts the SSO session cookie and returns it as
+// a Bearer auth token string compatible with the existing JWT pipeline.
+func ssoAuthTokenFromRequest(r *http.Request) string {
+	c, err := r.Cookie(ssoCookieName)
+	if err != nil || c.Value == "" {
+		return ""
+	}
+	return "http_auth:Bearer " + c.Value
+}
+
+// ssoRedirectURL returns the OIDC redirect URL for the current request.
+func ssoRedirectURL(r *http.Request, oidc *OIDCConnectConfig) string {
+	if oidc.RedirectURL != "" {
+		return oidc.RedirectURL
+	}
+	scheme := "https"
+	if r.TLS == nil {
+		scheme = "http"
+	}
+	return scheme + "://" + r.Host + "/_vmauth/sso/callback"
+}

app/vmbackup/main.go

@@ -47,8 +47,9 @@ func main() {
 	// Write flags and help message to stdout, since it is easier to grep or pipe.
 	flag.CommandLine.SetOutput(os.Stdout)
 	flag.Usage = usage
+	flagutil.RegisterSecretFlag("snapshot.createURL")
+	flagutil.RegisterSecretFlag("snapshot.deleteURL")
 	envflag.Parse()
-	initSecretFlags()
 	buildinfo.Init()
 	logger.Init()
 
@@ -272,10 +273,3 @@ func newRemoteOriginFS(ctx context.Context) (common.RemoteFS, error) {
 	}
 	return fs, nil
 }
-
-// initSecretFlags manages the secret flags for this app and must be called after flag parsing and before logger init.
-func initSecretFlags() {
-	flagutil.RegisterSecretFlag("snapshot.createURL")
-	flagutil.RegisterSecretFlag("snapshot.deleteURL")
-	pushmetrics.InitSecretFlags()
-}

app/vmctl/README.md

@@ -1,3 +1,3 @@
 See vmctl docs [here](https://docs.victoriametrics.com/victoriametrics/vmctl/).
 
-vmctl docs can be edited at [docs/vmctl.md](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/docs/victoriametrics/vmctl/vmctl.md).
+vmctl docs can be edited at [docs/vmctl.md](https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/docs/victoriametrics/vmctl.md).

app/vmctl/influx/influx.go

@@ -259,7 +259,7 @@ func (cr *ChunkedResponse) Next() ([]int64, []float64, error) {
 
 	fieldValues, ok := r.values[cr.field]
 	if !ok {
-		return nil, nil, fmt.Errorf("response doesn't contain field %q", cr.field)
+		return nil, nil, fmt.Errorf("response doesn't contain filed %q", cr.field)
 	}
 	values := make([]float64, len(fieldValues))
 	for i, fv := range fieldValues {

app/vmctl/main.go

@@ -47,7 +47,6 @@ func main() {
 	start := time.Now()
 	beforeFn := func(c *cli.Context) error {
 		flag.Parse()
-		initSecretFlags()
 		logger.Init()
 		isSilent = c.Bool(globalSilent)
 		if c.Bool(globalDisableProgressBar) {
@@ -564,11 +563,11 @@ func main() {
 	}()
 
 	err = app.Run(os.Args)
-	pushmetrics.StopAndPush()
 	if err != nil {
 		log.Fatalln(err)
 	}
 	log.Printf("Total time: %v", time.Since(start))
+	pushmetrics.StopAndPush()
 }
 
 func initConfigVM(c *cli.Context) (vm.Config, error) {
@@ -620,8 +619,3 @@ func initConfigVM(c *cli.Context) (vm.Config, error) {
 		Backoff:            bf,
 	}, nil
 }
-
-// initSecretFlags manages the secret flags for this app and must be called after flag parsing and before logger init.
-func initSecretFlags() {
-	pushmetrics.InitSecretFlags()
-}

app/vmctl/remoteread/remoteread.go

@@ -8,14 +8,12 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"strconv"
 	"strings"
 	"time"
 
 	"github.com/gogo/protobuf/proto"
 	"github.com/golang/snappy"
 	"github.com/prometheus/prometheus/config"
-	"github.com/prometheus/prometheus/model/histogram"
 	"github.com/prometheus/prometheus/prompb"
 	"github.com/prometheus/prometheus/storage/remote"
 	"github.com/prometheus/prometheus/tsdb/chunkenc"
@@ -236,29 +234,9 @@ func processResponse(body io.ReadCloser, callback StreamCallback) error {
 	// shouldn't be accounted as an error.
 	for _, res := range readResp.Results {
 		for _, ts := range res.Timeseries {
-			// A series contains either float samples or native histogram samples.
-			// Both fields are processed independently, since a series may switch
-			// from float to native histogram representation at some point in time,
-			// so the requested time range may contain samples of both types.
-			if len(ts.Samples) > 0 {
-				vmTs := convertSamples(ts.Samples, ts.Labels)
-				if err := callback(vmTs); err != nil {
-					return err
-				}
-			}
-			if len(ts.Histograms) > 0 {
-				hSamples := make([]histogramSample, 0, len(ts.Histograms))
-				for _, h := range ts.Histograms {
-					hSamples = append(hSamples, histogramSample{
-						timestamp: h.Timestamp,
-						fh:        h.ToFloatHistogram(),
-					})
-				}
-				for _, vmTs := range convertHistograms(hSamples, ts.Labels) {
-					if err := callback(vmTs); err != nil {
-						return err
-					}
-				}
+			vmTs := convertSamples(ts.Samples, ts.Labels)
+			if err := callback(vmTs); err != nil {
+				return err
 			}
 		}
 	}
@@ -285,45 +263,17 @@ func processStreamResponse(body io.ReadCloser, callback StreamCallback) error {
 
 		for _, series := range res.ChunkedSeries {
 			samples := make([]prompb.Sample, 0)
-			var hSamples []histogramSample
 			for _, chunk := range series.Chunks {
-				switch chunk.Type {
-				case prompb.Chunk_XOR, prompb.Chunk_UNKNOWN:
-					// In proto3 the `type` field may be left unset (UNKNOWN) for XOR chunks.
-					// Prometheus remote.proto: "REQUIREMENT: when using proto3, this field
-					// MUST be set when using anything else than XOR". Senders before native
-					// histograms support (Prometheus < 2.40) do not set this field at all,
-					// so UNKNOWN chunks must be parsed as XOR ones.
-					s, err := parseSamples(chunk.Data)
-					if err != nil {
-						return err
-					}
-					samples = append(samples, s...)
-				case prompb.Chunk_HISTOGRAM, prompb.Chunk_FLOAT_HISTOGRAM:
-					hs, err := parseHistograms(chunk.Type, chunk.Data)
-					if err != nil {
-						return err
-					}
-					hSamples = append(hSamples, hs...)
-				default:
-					return fmt.Errorf("unsupported chunk encoding %q", chunk.Type)
+				s, err := parseSamples(chunk.Data)
+				if err != nil {
+					return err
 				}
+				samples = append(samples, s...)
 			}
 
-			// A series contains either XOR chunks or native histogram chunks.
-			// Both are processed independently, since a series may switch
-			// from float to native histogram representation at some point in time,
-			// so the requested time range may contain chunks of both types.
-			if len(samples) > 0 {
-				ts := convertSamples(samples, series.Labels)
-				if err := callback(ts); err != nil {
-					return err
-				}
-			}
-			for _, ts := range convertHistograms(hSamples, series.Labels) {
-				if err := callback(ts); err != nil {
-					return err
-				}
+			ts := convertSamples(samples, series.Labels)
+			if err := callback(ts); err != nil {
+				return err
 			}
 		}
 	}
@@ -362,151 +312,6 @@ func parseSamples(chunk []byte) ([]prompb.Sample, error) {
 	return samples, it.Err()
 }
 
-// histogramSample represents a single native histogram sample.
-type histogramSample struct {
-	timestamp int64
-	fh        *histogram.FloatHistogram
-}
-
-func parseHistograms(encoding prompb.Chunk_Encoding, chunk []byte) ([]histogramSample, error) {
-	var enc chunkenc.Encoding
-	switch encoding {
-	case prompb.Chunk_HISTOGRAM:
-		enc = chunkenc.EncHistogram
-	case prompb.Chunk_FLOAT_HISTOGRAM:
-		enc = chunkenc.EncFloatHistogram
-	default:
-		return nil, fmt.Errorf("unsupported histogram chunk encoding %q", encoding)
-	}
-	c, err := chunkenc.FromData(enc, chunk)
-	if err != nil {
-		return nil, fmt.Errorf("error read chunk: %w", err)
-	}
-
-	var hSamples []histogramSample
-	it := c.Iterator(nil)
-	for {
-		typ := it.Next()
-		if typ == chunkenc.ValNone {
-			break
-		}
-		switch typ {
-		case chunkenc.ValHistogram:
-			ts, h := it.AtHistogram(nil)
-			hSamples = append(hSamples, histogramSample{
-				timestamp: ts,
-				fh:        h.ToFloat(nil),
-			})
-		case chunkenc.ValFloatHistogram:
-			ts, fh := it.AtFloatHistogram(nil)
-			hSamples = append(hSamples, histogramSample{
-				timestamp: ts,
-				fh:        fh,
-			})
-		default:
-			// Skip unsupported values
-			continue
-		}
-	}
-	if err := it.Err(); err != nil {
-		return nil, fmt.Errorf("error iterate over chunks: %w", err)
-	}
-
-	return hSamples, nil
-}
-
-// convertHistograms converts native histogram samples into VictoriaMetrics histogram
-// time series in the same way as VictoriaMetrics converts native histograms
-// received via Prometheus remote write protocol: every native histogram sample
-// is converted into `<name>_count` and `<name>_sum` series plus a set of
-// `<name>_bucket` series with `vmrange` labels containing non-cumulative bucket counts.
-// The only difference is that for native histograms with custom buckets (NHCB)
-// bucket bounds are taken from the custom values, while the remote write protocol
-// parser ignores custom values and estimates the bounds with the exponential formula.
-// See https://prometheus.io/docs/specs/native_histograms/#data-model
-func convertHistograms(hSamples []histogramSample, labels []prompb.Label) []*vm.TimeSeries {
-	if len(hSamples) == 0 {
-		return nil
-	}
-
-	labelPairs := make([]vm.LabelPair, 0, len(labels))
-	nameValue := ""
-	for _, label := range labels {
-		if label.Name == "__name__" {
-			nameValue = label.Value
-			continue
-		}
-		labelPairs = append(labelPairs, vm.LabelPair{Name: label.Name, Value: label.Value})
-	}
-	// the metric has no name, skip it in the same way as VictoriaMetrics does
-	// when it receives a native histogram without the metric name via remote write protocol.
-	if nameValue == "" {
-		return nil
-	}
-
-	countSeries := &vm.TimeSeries{
-		Name:       nameValue + "_count",
-		LabelPairs: labelPairs,
-	}
-	sumSeries := &vm.TimeSeries{
-		Name:       nameValue + "_sum",
-		LabelPairs: labelPairs,
-	}
-	bucketSeries := make(map[string]*vm.TimeSeries)
-	// vmranges preserves the order of bucketSeries creation
-	// in order to get deterministic results.
-	var vmranges []string
-
-	for _, hs := range hSamples {
-		fh := hs.fh
-		countSeries.Timestamps = append(countSeries.Timestamps, hs.timestamp)
-		countSeries.Values = append(countSeries.Values, fh.Count)
-		sumSeries.Timestamps = append(sumSeries.Timestamps, hs.timestamp)
-		sumSeries.Values = append(sumSeries.Values, fh.Sum)
-
-		it := fh.AllBucketIterator()
-		for it.Next() {
-			b := it.At()
-			if b.Count <= 0 {
-				continue
-			}
-			vmrange := formatVmrange(b.Lower, b.Upper)
-			s := bucketSeries[vmrange]
-			if s == nil {
-				bucketLabelPairs := make([]vm.LabelPair, len(labelPairs), len(labelPairs)+1)
-				copy(bucketLabelPairs, labelPairs)
-				bucketLabelPairs = append(bucketLabelPairs, vm.LabelPair{Name: "vmrange", Value: vmrange})
-				s = &vm.TimeSeries{
-					Name:       nameValue + "_bucket",
-					LabelPairs: bucketLabelPairs,
-				}
-				bucketSeries[vmrange] = s
-				vmranges = append(vmranges, vmrange)
-			}
-			s.Timestamps = append(s.Timestamps, hs.timestamp)
-			s.Values = append(s.Values, b.Count)
-		}
-	}
-
-	tss := make([]*vm.TimeSeries, 0, 2+len(vmranges))
-	tss = append(tss, countSeries, sumSeries)
-	for _, vmrange := range vmranges {
-		tss = append(tss, bucketSeries[vmrange])
-	}
-	return tss
-}
-
-// formatVmrange formats the given bucket bounds into `vmrange` label value
-// in the same way as VictoriaMetrics does for native histograms
-// received via Prometheus remote write protocol.
-func formatVmrange(lower, upper float64) string {
-	b := make([]byte, 0, 24)
-	b = strconv.AppendFloat(b, lower, 'e', 3, 64)
-	b = append(b, "..."...)
-	b = strconv.AppendFloat(b, upper, 'e', 3, 64)
-	return string(b)
-}
-
 type keyValue struct {
 	key   string
 	value string

app/vmctl/remoteread/remoteread_test.go

@@ -1,334 +0,0 @@
-package remoteread
-
-import (
-	"bytes"
-	"io"
-	"reflect"
-	"testing"
-
-	"github.com/gogo/protobuf/proto"
-	"github.com/golang/snappy"
-	"github.com/prometheus/prometheus/model/histogram"
-	"github.com/prometheus/prometheus/prompb"
-	"github.com/prometheus/prometheus/storage/remote"
-	"github.com/prometheus/prometheus/tsdb/chunkenc"
-
-	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmctl/vm"
-)
-
-func testHistogram(mul int64) *histogram.Histogram {
-	return &histogram.Histogram{
-		Schema:          0,
-		Count:           uint64(10 * mul),
-		Sum:             25.5 * float64(mul),
-		ZeroThreshold:   0.001,
-		ZeroCount:       uint64(2 * mul),
-		PositiveSpans:   []histogram.Span{{Offset: 0, Length: 2}},
-		PositiveBuckets: []int64{1 * mul, 2 * mul},
-		NegativeSpans:   []histogram.Span{{Offset: 0, Length: 1}},
-		NegativeBuckets: []int64{4 * mul},
-	}
-}
-
-func TestConvertHistograms(t *testing.T) {
-	f := func(hSamples []histogramSample, labels []prompb.Label, expected []*vm.TimeSeries) {
-		t.Helper()
-
-		tss := convertHistograms(hSamples, labels)
-		if !reflect.DeepEqual(tss, expected) {
-			t.Fatalf("unexpected result\ngot:\n%v\nwant:\n%v", tss, expected)
-		}
-	}
-
-	// series without samples
-	f(nil, []prompb.Label{{Name: "__name__", Value: "foo"}}, nil)
-
-	// series without the metric name must be skipped
-	f([]histogramSample{
-		{timestamp: 1000, fh: testHistogram(1).ToFloat(nil)},
-	}, []prompb.Label{{Name: "job", Value: "bar"}}, nil)
-
-	// native histogram must be converted to _count, _sum and _bucket series
-	// in the same way as VictoriaMetrics does for Prometheus remote write protocol
-	labels := []prompb.Label{
-		{Name: "__name__", Value: "request_duration_seconds"},
-		{Name: "job", Value: "bar"},
-	}
-	jobLabel := []vm.LabelPair{{Name: "job", Value: "bar"}}
-	bucketLabels := func(vmrange string) []vm.LabelPair {
-		return []vm.LabelPair{
-			{Name: "job", Value: "bar"},
-			{Name: "vmrange", Value: vmrange},
-		}
-	}
-	f([]histogramSample{
-		{timestamp: 1000, fh: testHistogram(1).ToFloat(nil)},
-		{timestamp: 2000, fh: testHistogram(2).ToFloat(nil)},
-	}, labels, []*vm.TimeSeries{
-		{
-			Name:       "request_duration_seconds_count",
-			LabelPairs: jobLabel,
-			Timestamps: []int64{1000, 2000},
-			Values:     []float64{10, 20},
-		},
-		{
-			Name:       "request_duration_seconds_sum",
-			LabelPairs: jobLabel,
-			Timestamps: []int64{1000, 2000},
-			Values:     []float64{25.5, 51},
-		},
-		{
-			Name:       "request_duration_seconds_bucket",
-			LabelPairs: bucketLabels("-1.000e+00...-5.000e-01"),
-			Timestamps: []int64{1000, 2000},
-			Values:     []float64{4, 8},
-		},
-		{
-			Name:       "request_duration_seconds_bucket",
-			LabelPairs: bucketLabels("-1.000e-03...1.000e-03"),
-			Timestamps: []int64{1000, 2000},
-			Values:     []float64{2, 4},
-		},
-		{
-			Name:       "request_duration_seconds_bucket",
-			LabelPairs: bucketLabels("5.000e-01...1.000e+00"),
-			Timestamps: []int64{1000, 2000},
-			Values:     []float64{1, 2},
-		},
-		{
-			Name:       "request_duration_seconds_bucket",
-			LabelPairs: bucketLabels("1.000e+00...2.000e+00"),
-			Timestamps: []int64{1000, 2000},
-			Values:     []float64{3, 6},
-		},
-	})
-}
-
-func TestParseHistograms(t *testing.T) {
-	c := chunkenc.NewHistogramChunk()
-	app, err := c.Appender()
-	if err != nil {
-		t.Fatalf("cannot create chunk appender: %s", err)
-	}
-	if _, _, _, err := app.AppendHistogram(nil, 0, 1000, testHistogram(1), true); err != nil {
-		t.Fatalf("cannot append histogram: %s", err)
-	}
-	if _, _, _, err := app.AppendHistogram(nil, 0, 2000, testHistogram(2), true); err != nil {
-		t.Fatalf("cannot append histogram: %s", err)
-	}
-
-	hSamples, err := parseHistograms(prompb.Chunk_HISTOGRAM, c.Bytes())
-	if err != nil {
-		t.Fatalf("cannot parse histogram chunk: %s", err)
-	}
-	if len(hSamples) != 2 {
-		t.Fatalf("unexpected number of histogram samples; got %d; want 2", len(hSamples))
-	}
-	for i, expected := range []struct {
-		timestamp int64
-		count     float64
-		sum       float64
-	}{
-		{timestamp: 1000, count: 10, sum: 25.5},
-		{timestamp: 2000, count: 20, sum: 51},
-	} {
-		if hSamples[i].timestamp != expected.timestamp {
-			t.Fatalf("unexpected timestamp; got %d; want %d", hSamples[i].timestamp, expected.timestamp)
-		}
-		if hSamples[i].fh.Count != expected.count {
-			t.Fatalf("unexpected count; got %f; want %f", hSamples[i].fh.Count, expected.count)
-		}
-		if hSamples[i].fh.Sum != expected.sum {
-			t.Fatalf("unexpected sum; got %f; want %f", hSamples[i].fh.Sum, expected.sum)
-		}
-	}
-
-	// unsupported chunk encoding must return error
-	if _, err := parseHistograms(prompb.Chunk_XOR, c.Bytes()); err == nil {
-		t.Fatalf("expecting non-nil error for unsupported chunk encoding")
-	}
-}
-
-func TestProcessResponse(t *testing.T) {
-	readResp := &prompb.ReadResponse{
-		Results: []*prompb.QueryResult{
-			{
-				Timeseries: []*prompb.TimeSeries{
-					{
-						Labels: []prompb.Label{
-							{Name: "__name__", Value: "cpu_usage"},
-							{Name: "job", Value: "bar"},
-						},
-						Samples: []prompb.Sample{
-							{Timestamp: 1000, Value: 1.5},
-						},
-					},
-					{
-						Labels: []prompb.Label{
-							{Name: "__name__", Value: "request_duration_seconds"},
-							{Name: "job", Value: "bar"},
-						},
-						Histograms: []prompb.Histogram{
-							prompb.FromIntHistogram(1000, testHistogram(1)),
-						},
-					},
-				},
-			},
-		},
-	}
-	data, err := proto.Marshal(readResp)
-	if err != nil {
-		t.Fatalf("cannot marshal ReadResponse: %s", err)
-	}
-	compressed := snappy.Encode(nil, data)
-
-	var tss []*vm.TimeSeries
-	err = processResponse(io.NopCloser(bytes.NewReader(compressed)), func(ts *vm.TimeSeries) error {
-		tss = append(tss, ts)
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("cannot process response: %s", err)
-	}
-
-	// 1 float series + _count + _sum + 4 buckets
-	if len(tss) != 7 {
-		t.Fatalf("unexpected number of time series; got %d; want 7", len(tss))
-	}
-	if tss[0].Name != "cpu_usage" || !reflect.DeepEqual(tss[0].Values, []float64{1.5}) {
-		t.Fatalf("unexpected float series: %v", tss[0])
-	}
-	if tss[1].Name != "request_duration_seconds_count" || !reflect.DeepEqual(tss[1].Values, []float64{10}) {
-		t.Fatalf("unexpected _count series: %v", tss[1])
-	}
-	if tss[2].Name != "request_duration_seconds_sum" || !reflect.DeepEqual(tss[2].Values, []float64{25.5}) {
-		t.Fatalf("unexpected _sum series: %v", tss[2])
-	}
-	for _, ts := range tss[3:] {
-		if ts.Name != "request_duration_seconds_bucket" {
-			t.Fatalf("unexpected bucket series name %q", ts.Name)
-		}
-	}
-}
-
-type nopFlusher struct{}
-
-func (nopFlusher) Flush() {}
-
-func TestProcessStreamResponse(t *testing.T) {
-	// build a histogram chunk
-	hc := chunkenc.NewHistogramChunk()
-	hApp, err := hc.Appender()
-	if err != nil {
-		t.Fatalf("cannot create histogram chunk appender: %s", err)
-	}
-	if _, _, _, err := hApp.AppendHistogram(nil, 0, 1000, testHistogram(1), true); err != nil {
-		t.Fatalf("cannot append histogram: %s", err)
-	}
-
-	// build a float chunk
-	xc := chunkenc.NewXORChunk()
-	xApp, err := xc.Appender()
-	if err != nil {
-		t.Fatalf("cannot create xor chunk appender: %s", err)
-	}
-	xApp.Append(0, 1000, 1.5)
-
-	res := &prompb.ChunkedReadResponse{
-		ChunkedSeries: []*prompb.ChunkedSeries{
-			{
-				Labels: []prompb.Label{
-					{Name: "__name__", Value: "request_duration_seconds"},
-					{Name: "job", Value: "bar"},
-				},
-				Chunks: []prompb.Chunk{
-					{Type: prompb.Chunk_HISTOGRAM, Data: hc.Bytes()},
-				},
-			},
-			{
-				Labels: []prompb.Label{
-					{Name: "__name__", Value: "cpu_usage"},
-				},
-				Chunks: []prompb.Chunk{
-					{Type: prompb.Chunk_XOR, Data: xc.Bytes()},
-				},
-			},
-			{
-				Labels: []prompb.Label{
-					{Name: "__name__", Value: "memory_usage"},
-				},
-				Chunks: []prompb.Chunk{
-					// the `type` field may be unset for XOR chunks,
-					// such chunks must be parsed as XOR ones
-					{Type: prompb.Chunk_UNKNOWN, Data: xc.Bytes()},
-				},
-			},
-		},
-	}
-	data, err := proto.Marshal(res)
-	if err != nil {
-		t.Fatalf("cannot marshal ChunkedReadResponse: %s", err)
-	}
-	var buf bytes.Buffer
-	cw := remote.NewChunkedWriter(&buf, nopFlusher{})
-	if _, err := cw.Write(data); err != nil {
-		t.Fatalf("cannot write chunked response: %s", err)
-	}
-
-	var tss []*vm.TimeSeries
-	err = processStreamResponse(io.NopCloser(&buf), func(ts *vm.TimeSeries) error {
-		tss = append(tss, ts)
-		return nil
-	})
-	if err != nil {
-		t.Fatalf("cannot process stream response: %s", err)
-	}
-
-	// _count + _sum + 4 buckets + 1 float series + 1 float series from UNKNOWN chunk
-	if len(tss) != 8 {
-		t.Fatalf("unexpected number of time series; got %d; want 8", len(tss))
-	}
-	if tss[0].Name != "request_duration_seconds_count" || !reflect.DeepEqual(tss[0].Values, []float64{10}) {
-		t.Fatalf("unexpected _count series: %v", tss[0])
-	}
-	if tss[1].Name != "request_duration_seconds_sum" || !reflect.DeepEqual(tss[1].Values, []float64{25.5}) {
-		t.Fatalf("unexpected _sum series: %v", tss[1])
-	}
-	for _, ts := range tss[2:6] {
-		if ts.Name != "request_duration_seconds_bucket" {
-			t.Fatalf("unexpected bucket series name %q", ts.Name)
-		}
-	}
-	if tss[6].Name != "cpu_usage" || !reflect.DeepEqual(tss[6].Values, []float64{1.5}) {
-		t.Fatalf("unexpected float series: %v", tss[6])
-	}
-	if tss[7].Name != "memory_usage" || !reflect.DeepEqual(tss[7].Values, []float64{1.5}) {
-		t.Fatalf("unexpected float series from UNKNOWN chunk: %v", tss[7])
-	}
-}
-
-func TestParseFloatHistograms(t *testing.T) {
-	c := chunkenc.NewFloatHistogramChunk()
-	app, err := c.Appender()
-	if err != nil {
-		t.Fatalf("cannot create chunk appender: %s", err)
-	}
-	fh := testHistogram(1).ToFloat(nil)
-	if _, _, _, err := app.AppendFloatHistogram(nil, 0, 1000, fh, true); err != nil {
-		t.Fatalf("cannot append float histogram: %s", err)
-	}
-
-	hSamples, err := parseHistograms(prompb.Chunk_FLOAT_HISTOGRAM, c.Bytes())
-	if err != nil {
-		t.Fatalf("cannot parse float histogram chunk: %s", err)
-	}
-	if len(hSamples) != 1 {
-		t.Fatalf("unexpected number of histogram samples; got %d; want 1", len(hSamples))
-	}
-	if hSamples[0].timestamp != 1000 {
-		t.Fatalf("unexpected timestamp; got %d; want 1000", hSamples[0].timestamp)
-	}
-	if hSamples[0].fh.Count != 10 {
-		t.Fatalf("unexpected count; got %f; want 10", hSamples[0].fh.Count)
-	}
-}

app/vmctl/vm/vm.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -112,7 +111,7 @@ func AddExtraLabelsToImportPath(path string, extraLabels []string) (string, erro
 		if strings.Contains(dst, "?") {
 			separator = "&"
 		}
-		dst += fmt.Sprintf("%sextra_label=%s", separator, url.QueryEscape(extraLabel))
+		dst += fmt.Sprintf("%sextra_label=%s", separator, extraLabel)
 	}
 	return dst, nil
 }

app/vmctl/vm/vm_test.go

@@ -33,14 +33,11 @@ func TestAddExtraLabelsToImportPath_Success(t *testing.T) {
 	f("/api/v1/import", nil, "/api/v1/import")
 
 	// ok one extra label
-	f("/api/v1/import", []string{"instance=host-1"}, "/api/v1/import?extra_label=instance%3Dhost-1")
+	f("/api/v1/import", []string{"instance=host-1"}, "/api/v1/import?extra_label=instance=host-1")
 
 	// ok two extra labels
-	f("/api/v1/import", []string{"instance=host-2", "job=vmagent"}, "/api/v1/import?extra_label=instance%3Dhost-2&extra_label=job%3Dvmagent")
+	f("/api/v1/import", []string{"instance=host-2", "job=vmagent"}, "/api/v1/import?extra_label=instance=host-2&extra_label=job=vmagent")
 
 	// ok two extra with exist param
-	f("/api/v1/import?timeout=50", []string{"instance=host-2", "job=vmagent"}, "/api/v1/import?timeout=50&extra_label=instance%3Dhost-2&extra_label=job%3Dvmagent")
-
-	// ok special chars in label value
-	f("/api/v1/import", []string{"team=a&b"}, "/api/v1/import?extra_label=team%3Da%26b")
+	f("/api/v1/import?timeout=50", []string{"instance=host-2", "job=vmagent"}, "/api/v1/import?timeout=50&extra_label=instance=host-2&extra_label=job=vmagent")
 }

app/vmctl/vm_native.go

@@ -405,16 +405,7 @@ func buildMatchWithFilter(filter string, metricName string) (string, error) {
 			if len(tf.Key) == 0 {
 				continue
 			}
-			switch {
-			case tf.IsNegative && tf.IsRegexp:
-				a = append(a, fmt.Sprintf("%s!~%q", tf.Key, tf.Value))
-			case tf.IsNegative:
-				a = append(a, fmt.Sprintf("%s!=%q", tf.Key, tf.Value))
-			case tf.IsRegexp:
-				a = append(a, fmt.Sprintf("%s=~%q", tf.Key, tf.Value))
-			default:
-				a = append(a, fmt.Sprintf("%s=%q", tf.Key, tf.Value))
-			}
+			a = append(a, tf.String())
 		}
 		a = append(a, nameFilter)
 		filters = append(filters, strings.Join(a, ","))

app/vminsert/common/insert_ctx.go

@@ -175,19 +175,13 @@ func (ctx *InsertCtx) WriteMetadata(mmpbs []prompb.MetricMetadata) error {
 	}
 	mms := ctx.mms
 	mms = slicesutil.SetLength(mms, len(mmpbs))
-	var cnt int
-	for _, mmpb := range mmpbs {
-		if timeserieslimits.IsMetricMetadataExceeding(&mmpb) {
-			continue
-		}
-		mm := &mms[cnt]
+	for idx, mmpb := range mmpbs {
+		mm := &mms[idx]
 		mm.MetricFamilyName = bytesutil.ToUnsafeBytes(mmpb.MetricFamilyName)
 		mm.Help = bytesutil.ToUnsafeBytes(mmpb.Help)
 		mm.Type = mmpb.Type
 		mm.Unit = bytesutil.ToUnsafeBytes(mmpb.Unit)
-		cnt++
 	}
-	mms = mms[:cnt]
 	ctx.mms = mms
 
 	err := vmstorage.VMInsertAPI.WriteMetadata(mms)
@@ -207,19 +201,14 @@ func (ctx *InsertCtx) WritePromMetadata(mmps []prometheus.Metadata) error {
 	}
 	mms := ctx.mms
 	mms = slicesutil.SetLength(mms, len(mmps))
-	var cnt int
-	for _, mmpb := range mmps {
-		mm := &mms[cnt]
-		if timeserieslimits.IsPrometheusMetadataExceeding(&mmpb) {
-			continue
-		}
+	for idx, mmpb := range mmps {
+		mm := &mms[idx]
 		mm.MetricFamilyName = bytesutil.ToUnsafeBytes(mmpb.Metric)
 		mm.Help = bytesutil.ToUnsafeBytes(mmpb.Help)
 		mm.Type = mmpb.Type
-		cnt++
 	}
-	mms = mms[:cnt]
 	ctx.mms = mms
+
 	err := vmstorage.VMInsertAPI.WriteMetadata(mms)
 	if err != nil {
 		return &httpserver.ErrorWithStatusCode{

app/vminsert/influx/request_handler.go

@@ -49,7 +49,7 @@ func InsertHandlerForHTTP(req *http.Request) error {
 	}
 	q := req.URL.Query()
 	precision := q.Get("precision")
-	// Read db tag from https://docs.influxdata.com/influxdb/v1/api/write/#operation/PostWrite
+	// Read db tag from https://docs.influxdata.com/influxdb/v1.7/tools/api/#write-http-endpoint
 	db := q.Get("db")
 	encoding := req.Header.Get("Content-Encoding")
 	isStreamMode := req.Header.Get("Stream-Mode") == "1"

app/vminsert/main.go

@@ -68,11 +68,9 @@ var (
 		"at -opentsdbHTTPListenAddr . See https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt")
 	configAuthKey          = flagutil.NewPassword("configAuthKey", "Authorization key for accessing /config page. It must be passed via authKey query arg. It overrides -httpAuth.*")
 	reloadAuthKey          = flagutil.NewPassword("reloadAuthKey", "Auth key for /-/reload http endpoint. It must be passed via authKey query arg. It overrides httpAuth.* settings.")
-	maxLabelsPerTimeseries = flag.Int("maxLabelsPerTimeseries", 40, "The maximum number of labels per time series to be accepted. Series with superfluous labels are ignored. In this case the vm_rows_ignored_total{reason=\"too_many_labels\"} metric at /metrics page is incremented.")
-	maxLabelNameLen        = flag.Int("maxLabelNameLen", 256, "The maximum length of label name in the accepted time series. Series with longer label name are ignored. In this case the vm_rows_ignored_total{reason=\"too_long_label_name\"} metric at /metrics page is incremented. "+
-		"Value must be in range 1..65535.")
-	maxLabelValueLen = flag.Int("maxLabelValueLen", 4*1024, "The maximum length of label values in the accepted time series. Series with longer label value are ignored. In this case the vm_rows_ignored_total{reason=\"too_long_label_value\"} metric at /metrics page is incremented. "+
-		"Value must be in range 1..65535.")
+	maxLabelsPerTimeseries = flag.Int("maxLabelsPerTimeseries", 40, "The maximum number of labels per time series to be accepted. Series with superfluous labels are ignored. In this case the vm_rows_ignored_total{reason=\"too_many_labels\"} metric at /metrics page is incremented")
+	maxLabelNameLen        = flag.Int("maxLabelNameLen", 256, "The maximum length of label name in the accepted time series. Series with longer label name are ignored. In this case the vm_rows_ignored_total{reason=\"too_long_label_name\"} metric at /metrics page is incremented")
+	maxLabelValueLen       = flag.Int("maxLabelValueLen", 4*1024, "The maximum length of label values in the accepted time series. Series with longer label value are ignored. In this case the vm_rows_ignored_total{reason=\"too_long_label_value\"} metric at /metrics page is incremented")
 )
 
 var (
@@ -108,7 +106,7 @@ func Init() {
 	promscrape.Init(func(_ *auth.Token, wr *prompb.WriteRequest) {
 		prompush.Push(wr)
 	})
-	timeserieslimits.MustInit(*maxLabelsPerTimeseries, *maxLabelNameLen, *maxLabelValueLen)
+	timeserieslimits.Init(*maxLabelsPerTimeseries, *maxLabelNameLen, *maxLabelValueLen)
 }
 
 // Stop stops vminsert.

app/vmrestore/main.go

@@ -38,7 +38,6 @@ func main() {
 	flag.CommandLine.SetOutput(os.Stdout)
 	flag.Usage = usage
 	envflag.Parse()
-	initSecretFlags()
 	buildinfo.Init()
 	logger.Init()
 
@@ -113,8 +112,3 @@ func newSrcFS(ctx context.Context) (common.RemoteFS, error) {
 	}
 	return fs, nil
 }
-
-// initSecretFlags manages the secret flags for this app and must be called after flag parsing and before logger init.
-func initSecretFlags() {
-	pushmetrics.InitSecretFlags()
-}

app/vmselect/main.go

@@ -26,7 +26,6 @@ import (
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/promscrape"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/querytracer"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/querytracer/push"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/timerpool"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/vmalertproxy"
 )
@@ -60,12 +59,6 @@ func Init(vmselectMaxConcurrentRequests int, vmselectMaxQueueDuration time.Durat
 	initVMUIConfig()
 
 	vmalertproxy.Init(*vmalertProxyURL)
-
-}
-
-// InitSecretFlags manages the secret flags for this pkg and must be called by app-level initSecretFlags.
-// It should run before logger initialization and package Init() (if exists).
-func InitSecretFlags() {
 	flagutil.RegisterSecretFlag("vmalert.proxyURL")
 }
 
@@ -118,15 +111,8 @@ func RequestHandler(w http.ResponseWriter, r *http.Request) bool {
 	// Handle non-trivial dynamic requests, which may take big amounts of time and resources.
 	startTime := time.Now()
 	defer requestDuration.UpdateDuration(startTime)
-	tracerEnabled := httputil.GetBool(r, "trace") || push.IsEnabled()
+	tracerEnabled := httputil.GetBool(r, "trace")
 	qt := querytracer.New(tracerEnabled, "%s", r.URL.Path)
-	if push.IsEnabled() {
-		defer func() {
-			if time.Since(startTime) >= push.MinTraceDuration() {
-				push.Push(qt)
-			}
-		}()
-	}
 
 	// Limit the number of concurrent queries.
 	select {
@@ -383,10 +369,6 @@ func RequestHandler(w http.ResponseWriter, r *http.Request) bool {
 		}
 		return true
 	case "/tags/delSeries":
-		if r.Method != "POST" {
-			http.Error(w, fmt.Sprintf("Only POST method is allowed. Got %s.", r.Method), http.StatusMethodNotAllowed)
-			return true
-		}
 		if !httpserver.CheckAuthFlag(w, r, deleteAuthKey) {
 			return true
 		}
@@ -406,10 +388,6 @@ func RequestHandler(w http.ResponseWriter, r *http.Request) bool {
 		}
 		return true
 	case "/api/v1/admin/tsdb/delete_series":
-		if r.Method != "POST" {
-			http.Error(w, fmt.Sprintf("Only POST method is allowed. Got %s.", r.Method), http.StatusMethodNotAllowed)
-			return true
-		}
 		if !httpserver.CheckAuthFlag(w, r, deleteAuthKey) {
 			return true
 		}
@@ -563,7 +541,7 @@ func handleStaticAndSimpleRequests(w http.ResponseWriter, r *http.Request, path
 		return true
 	case "/metric-relabel-debug":
 		promscrapeMetricRelabelDebugRequests.Inc()
-		promscrape.WriteMetricRelabelDebug(w, r, "", nil)
+		promscrape.WriteMetricRelabelDebug(w, r)
 		return true
 	case "/target-relabel-debug":
 		promscrapeTargetRelabelDebugRequests.Inc()

app/vmselect/prometheus/metadata_response.qtpl

@@ -15,7 +15,7 @@ See https://prometheus.io/docs/prometheus/latest/querying/api/#querying-metric-m
 			currentItem := 0
 		 %}
 		{% for _, row := range result %}
-			{%q= string(row.MetricFamilyName) %}: [
+			"{%s string(row.MetricFamilyName) %}": [
 					{
 						"type": {%q= row.Type.String() %},
             {% if len(row.Unit) > 0 -%}

app/vmselect/prometheus/metadata_response.qtpl.go

@@ -35,10 +35,12 @@ func StreamMetadataResponse(qw422016 *qt422016.Writer, result []*metricsmetadata
 
 //line app/vmselect/prometheus/metadata_response.qtpl:17
 	for _, row := range result {
+//line app/vmselect/prometheus/metadata_response.qtpl:17
+		qw422016.N().S(`"`)
 //line app/vmselect/prometheus/metadata_response.qtpl:18
-		qw422016.N().Q(string(row.MetricFamilyName))
+		qw422016.E().S(string(row.MetricFamilyName))
 //line app/vmselect/prometheus/metadata_response.qtpl:18
-		qw422016.N().S(`: [{"type":`)
+		qw422016.N().S(`": [{"type":`)
 //line app/vmselect/prometheus/metadata_response.qtpl:20
 		qw422016.N().Q(row.Type.String())
 //line app/vmselect/prometheus/metadata_response.qtpl:20

app/vmselect/prometheus/prometheus.go

@@ -516,7 +516,7 @@ func DeleteHandler(startTime time.Time, r *http.Request) error {
 	cp.deadline = searchutil.GetDeadlineForDelete(r, startTime)
 
 	if !cp.IsDefaultTimeRange() {
-		return fmt.Errorf("delete API does not support specific time ranges using start and end args, the series can only be deleted completely")
+		return fmt.Errorf("start=%d and end=%d args aren't supported. Remove these args from the query in order to delete all the matching metrics", cp.start, cp.end)
 	}
 	sq := storage.NewSearchQuery(cp.start, cp.end, cp.filterss, *maxDeleteSeries)
 	deletedCount, err := netstorage.DeleteSeries(nil, sq, cp.deadline)
@@ -540,11 +540,11 @@ func LabelValuesHandler(qt *querytracer.Tracer, startTime time.Time, labelName s
 
 	cp, err := getCommonParamsForLabelsAPI(r, startTime, false)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	limit, err := httputil.GetInt(r, "limit")
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	sq := storage.NewSearchQuery(cp.start, cp.end, cp.filterss, *maxLabelsAPISeries)
 
@@ -584,7 +584,7 @@ func TSDBStatusHandler(qt *querytracer.Tracer, startTime time.Time, w http.Respo
 
 	cp, err := getCommonParams(r, startTime, false)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	cp.deadline = searchutil.GetDeadlineForStatusRequest(r, startTime)
 
@@ -596,7 +596,7 @@ func TSDBStatusHandler(qt *querytracer.Tracer, startTime time.Time, w http.Respo
 		} else {
 			t, err := time.Parse("2006-01-02", dateStr)
 			if err != nil {
-				return httpserver.InvalidParamError(fmt.Errorf("cannot parse `date` arg %q: %w", dateStr, err))
+				return fmt.Errorf("cannot parse `date` arg %q: %w", dateStr, err)
 			}
 			date = uint64(t.Unix()) / secsPerDay
 		}
@@ -607,7 +607,7 @@ func TSDBStatusHandler(qt *querytracer.Tracer, startTime time.Time, w http.Respo
 	if len(topNStr) > 0 {
 		n, err := strconv.Atoi(topNStr)
 		if err != nil {
-			return httpserver.InvalidParamError(fmt.Errorf("cannot parse `topN` arg %q: %w", topNStr, err))
+			return fmt.Errorf("cannot parse `topN` arg %q: %w", topNStr, err)
 		}
 		if n <= 0 {
 			n = 1
@@ -645,11 +645,11 @@ func LabelsHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseW
 
 	cp, err := getCommonParamsForLabelsAPI(r, startTime, false)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	limit, err := httputil.GetInt(r, "limit")
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	sq := storage.NewSearchQuery(cp.start, cp.end, cp.filterss, *maxLabelsAPISeries)
 	labels, err := netstorage.LabelNames(qt, sq, limit, cp.deadline)
@@ -671,9 +671,10 @@ func LabelsHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseW
 //
 // See https://prometheus.io/docs/prometheus/latest/querying/api/#querying-metric-metadata
 func MetadataHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseWriter, r *http.Request) error {
+
 	limit, err := httputil.GetInt(r, "limit")
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	if limit < 0 {
 		limit = 0
@@ -733,11 +734,11 @@ func SeriesHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseW
 	// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/91
 	cp, err := getCommonParamsForLabelsAPI(r, startTime, true)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	limit, err := httputil.GetInt(r, "limit")
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 
 	sq := storage.NewSearchQuery(cp.start, cp.end, cp.filterss, *maxSeriesLimit)
@@ -771,19 +772,19 @@ func QueryHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseWr
 	mayCache := !httputil.GetBool(r, "nocache")
 	query := r.FormValue("query")
 	if len(query) == 0 {
-		return httpserver.InvalidParamError(fmt.Errorf("missing `query` arg"))
+		return fmt.Errorf("missing `query` arg")
 	}
 	start, err := httputil.GetTime(r, "time", ct)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	lookbackDelta, err := getMaxLookback(r)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	step, err := httputil.GetDuration(r, "step", lookbackDelta)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	if step <= 0 {
 		step = defaultStep
@@ -791,16 +792,16 @@ func QueryHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseWr
 
 	maxLen := searchutil.GetMaxQueryLen()
 	if len(query) > maxLen {
-		return httpserver.InvalidParamError(fmt.Errorf("too long query; got %d bytes; mustn't exceed `-search.maxQueryLen=%d` bytes", len(query), maxLen))
+		return fmt.Errorf("too long query; got %d bytes; mustn't exceed `-search.maxQueryLen=%d` bytes", len(query), maxLen)
 	}
 	etfs, err := searchutil.GetExtraTagFilters(r)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	if childQuery, windowExpr, offsetExpr := promql.IsMetricSelectorWithRollup(query); childQuery != "" {
 		window, err := windowExpr.NonNegativeDuration(step)
 		if err != nil {
-			return httpserver.InvalidParamError(fmt.Errorf("cannot parse lookbehind window in square brackets at %s: %w", query, err))
+			return fmt.Errorf("cannot parse lookbehind window in square brackets at %s: %w", query, err)
 		}
 		offset := offsetExpr.Duration(step)
 		start -= offset
@@ -814,7 +815,7 @@ func QueryHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseWr
 
 		tagFilterss, err := getTagFilterssFromMatches([]string{childQuery})
 		if err != nil {
-			return httpserver.InvalidParamError(err)
+			return err
 		}
 		filterss := searchutil.JoinTagFilterss(tagFilterss, etfs)
 
@@ -830,25 +831,22 @@ func QueryHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseWr
 		return nil
 	}
 	if childQuery, windowExpr, stepExpr, offsetExpr := promql.IsRollup(query); childQuery != "" {
-		if len(childQuery) > maxLen {
-			return httpserver.InvalidParamError(fmt.Errorf("too long query; got %d bytes; mustn't exceed `-search.maxQueryLen=%d` bytes", len(childQuery), maxLen))
-		}
 		newStep, err := stepExpr.NonNegativeDuration(step)
 		if err != nil {
-			return httpserver.InvalidParamError(fmt.Errorf("cannot parse step in square brackets at %s: %w", query, err))
+			return fmt.Errorf("cannot parse step in square brackets at %s: %w", query, err)
 		}
 		if newStep > 0 {
 			step = newStep
 		}
 		window, err := windowExpr.NonNegativeDuration(step)
 		if err != nil {
-			return httpserver.InvalidParamError(fmt.Errorf("cannot parse lookbehind window in square brackets at %s: %w", query, err))
+			return fmt.Errorf("cannot parse lookbehind window in square brackets at %s: %w", query, err)
 		}
 		offset := offsetExpr.Duration(step)
 		start -= offset
 		end := start
 		start = end - window
-		if err := queryRangeHandler(qt, startTime, w, childQuery, start, end, step, lookbackDelta, r, ct, etfs); err != nil {
+		if err := queryRangeHandler(qt, startTime, w, childQuery, start, end, step, r, ct, etfs); err != nil {
 			return fmt.Errorf("error when executing query=%q on the time range (start=%d, end=%d, step=%d): %w", childQuery, start, end, step, err)
 		}
 		return nil
@@ -856,7 +854,7 @@ func QueryHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseWr
 
 	queryOffset, err := getLatencyOffsetMilliseconds(r)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	if !httputil.GetBool(r, "nocache") && ct-start < queryOffset && start-ct < queryOffset {
 		// Adjust start time only if `nocache` arg isn't set.
@@ -930,43 +928,44 @@ func QueryRangeHandler(qt *querytracer.Tracer, startTime time.Time, w http.Respo
 	ct := startTime.UnixNano() / 1e6
 	query := r.FormValue("query")
 	if len(query) == 0 {
-		return httpserver.InvalidParamError(fmt.Errorf("missing `query` arg"))
-	}
-	maxLen := searchutil.GetMaxQueryLen()
-	if len(query) > maxLen {
-		return httpserver.InvalidParamError(fmt.Errorf("too long query; got %d bytes; mustn't exceed `-search.maxQueryLen=%d` bytes", len(query), maxLen))
+		return fmt.Errorf("missing `query` arg")
 	}
 	start, err := httputil.GetTime(r, "start", ct-defaultStep)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	end, err := httputil.GetTime(r, "end", ct)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	step, err := httputil.GetDuration(r, "step", defaultStep)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
 	etfs, err := searchutil.GetExtraTagFilters(r)
 	if err != nil {
-		return httpserver.InvalidParamError(err)
+		return err
 	}
-	lookbackDelta, err := getMaxLookback(r)
-	if err != nil {
-		return httpserver.InvalidParamError(err)
-	}
-	if err := queryRangeHandler(qt, startTime, w, query, start, end, step, lookbackDelta, r, ct, etfs); err != nil {
+	if err := queryRangeHandler(qt, startTime, w, query, start, end, step, r, ct, etfs); err != nil {
 		return fmt.Errorf("error when executing query=%q on the time range (start=%d, end=%d, step=%d): %w", query, start, end, step, err)
 	}
 	return nil
 }
 
 func queryRangeHandler(qt *querytracer.Tracer, startTime time.Time, w http.ResponseWriter, query string,
-	start, end, step, lookbackDelta int64, r *http.Request, ct int64, etfs [][]storage.TagFilter) error {
+	start, end, step int64, r *http.Request, ct int64, etfs [][]storage.TagFilter) error {
 	deadline := searchutil.GetDeadlineForQuery(r, startTime)
 	mayCache := !httputil.GetBool(r, "nocache")
-	optimizeRepeatedBinaryOpSubexprs := httputil.GetBool(r, "optimize_repeated_binary_op_subexprs")
+	lookbackDelta, err := getMaxLookback(r)
+	if err != nil {
+		return err
+	}
+
+	// Validate input args.
+	maxLen := searchutil.GetMaxQueryLen()
+	if len(query) > maxLen {
+		return fmt.Errorf("too long query; got %d bytes; mustn't exceed `-search.maxQueryLen=%d` bytes", len(query), maxLen)
+	}
 	if start > end {
 		end = start + defaultStep
 	}
@@ -978,19 +977,18 @@ func queryRangeHandler(qt *querytracer.Tracer, startTime time.Time, w http.Respo
 	}
 
 	ec := &promql.EvalConfig{
-		Start:                            start,
-		End:                              end,
-		Step:                             step,
-		MaxPointsPerSeries:               *maxPointsPerTimeseries,
-		MaxSeries:                        0, // let vmstorage use maxUniqueTimeseries by default
-		QuotedRemoteAddr:                 httpserver.GetQuotedRemoteAddr(r),
-		Deadline:                         deadline,
-		MayCache:                         mayCache,
-		OptimizeRepeatedBinaryOpSubexprs: optimizeRepeatedBinaryOpSubexprs,
-		LookbackDelta:                    lookbackDelta,
-		RoundDigits:                      getRoundDigits(r),
-		EnforcedTagFilterss:              etfs,
-		CacheTagFilters:                  etfs,
+		Start:               start,
+		End:                 end,
+		Step:                step,
+		MaxPointsPerSeries:  *maxPointsPerTimeseries,
+		MaxSeries:           0, // let vmstorage use maxUniqueTimeseries by default
+		QuotedRemoteAddr:    httpserver.GetQuotedRemoteAddr(r),
+		Deadline:            deadline,
+		MayCache:            mayCache,
+		LookbackDelta:       lookbackDelta,
+		RoundDigits:         getRoundDigits(r),
+		EnforcedTagFilterss: etfs,
+		CacheTagFilters:     etfs,
 		GetRequestURI: func() string {
 			return httpserver.GetRequestURI(r)
 		},
@@ -1005,7 +1003,7 @@ func queryRangeHandler(qt *querytracer.Tracer, startTime time.Time, w http.Respo
 	if step < maxStepForPointsAdjustment.Milliseconds() {
 		queryOffset, err := getLatencyOffsetMilliseconds(r)
 		if err != nil {
-			return httpserver.InvalidParamError(err)
+			return err
 		}
 		if ct-queryOffset < end {
 			result = adjustLastPoints(result, ct-queryOffset, ct+step)
@@ -1156,13 +1154,13 @@ func QueryStatsHandler(w http.ResponseWriter, r *http.Request) error {
 	if len(topNStr) > 0 {
 		n, err := strconv.Atoi(topNStr)
 		if err != nil {
-			return httpserver.InvalidParamError(fmt.Errorf("cannot parse `topN` arg %q: %w", topNStr, err))
+			return fmt.Errorf("cannot parse `topN` arg %q: %w", topNStr, err)
 		}
 		topN = n
 	}
 	maxLifetimeMsecs, err := httputil.GetDuration(r, "maxLifetime", 10*60*1000)
 	if err != nil {
-		return httpserver.InvalidParamError(fmt.Errorf("cannot parse `maxLifetime` arg: %w", err))
+		return fmt.Errorf("cannot parse `maxLifetime` arg: %w", err)
 	}
 	maxLifetime := time.Duration(maxLifetimeMsecs) * time.Millisecond
 	w.Header().Set("Content-Type", "application/json")

app/vmselect/promql/binary_op.go

@@ -164,21 +164,15 @@ func newBinaryOpFunc(bf func(left, right float64, isBool bool) float64) binaryOp
 		left := bfa.left
 		right := bfa.right
 		op := bfa.be.Op
-		isCmpOp := metricsql.IsBinaryOpCmp(op)
-		if !isCmpOp {
-			// Do not remove empty series for comparison operations, since NaN can be an
-			// explicitly present sample value. In particular, `value != NaN` is true.
-			// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/150.
+		switch true {
+		case metricsql.IsBinaryOpCmp(op):
+			// Do not remove empty series for comparison operations,
+			// since this may lead to missing result.
+		default:
 			left = removeEmptySeries(left)
 			right = removeEmptySeries(right)
 		}
-		if len(left) == 0 && len(right) == 0 {
-			return nil, nil
-		}
-		if len(left) == 0 && bfa.be.FillLeft == nil {
-			return nil, nil
-		}
-		if len(right) == 0 && bfa.be.FillRight == nil {
+		if len(left) == 0 || len(right) == 0 {
 			return nil, nil
 		}
 		left, right, dst, err := adjustBinaryOpTags(bfa.be, left, right)
@@ -189,16 +183,6 @@ func newBinaryOpFunc(bf func(left, right float64, isBool bool) float64) binaryOp
 			logger.Panicf("BUG: len(left) must match len(right) and len(dst); got %d vs %d vs %d", len(left), len(right), len(dst))
 		}
 		isBool := bfa.be.Bool
-		fillLeft := bfa.be.FillLeft
-		fillRight := bfa.be.FillRight
-		// A NaN produced by a vector comparison denotes a filtered-out sample rather
-		// than an explicitly present NaN value. Drop it when this result is used as
-		// the right-hand side of another comparison.
-		// Note that filtered-out samples surviving as NaN inside other wrappers such as
-		// transform functions or arithmetic operations aren't detected, since such NaN
-		// is indistinguishable from an explicitly present NaN value there.
-		// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10018.
-		dropNaNRight := isCmpOp && isVectorComparisonExpr(bfa.be.Right)
 		for i, tsLeft := range left {
 			leftValues := tsLeft.Values
 			rightValues := right[i].Values
@@ -209,24 +193,6 @@ func newBinaryOpFunc(bf func(left, right float64, isBool bool) float64) binaryOp
 			}
 			for j, a := range leftValues {
 				b := rightValues[j]
-				leftIsNaN := math.IsNaN(a)
-				rightIsNaN := math.IsNaN(b)
-				// Both sides are NaN.
-				if leftIsNaN && rightIsNaN {
-					dstValues[j] = bf(a, b, isBool)
-					continue
-				}
-				if dropNaNRight && rightIsNaN && fillRight == nil {
-					dstValues[j] = nan
-					continue
-				}
-				// Apply the fill value when either the left or right side is NaN, but not both.
-				if leftIsNaN && fillLeft != nil {
-					a = fillLeft.N
-				}
-				if rightIsNaN && fillRight != nil {
-					b = fillRight.N
-				}
 				dstValues[j] = bf(a, b, isBool)
 			}
 		}
@@ -236,38 +202,6 @@ func newBinaryOpFunc(bf func(left, right float64, isBool bool) float64) binaryOp
 	}
 }
 
-// isVectorComparisonExpr returns whether e is a comparison operation
-// with at least one non-scalar operand.
-func isVectorComparisonExpr(e metricsql.Expr) bool {
-	if re, ok := e.(*metricsql.RollupExpr); ok && re.Window == nil {
-		// Unwrap `(...) offset <d>` and `(...) @ <t>`, which do not change
-		// the shape of the result. Subqueries are left as is, since rollup
-		// functions skip NaN values on their own.
-		e = re.Expr
-	}
-	be, ok := e.(*metricsql.BinaryOpExpr)
-	if !ok || !metricsql.IsBinaryOpCmp(be.Op) {
-		return false
-	}
-	return !isScalarLikeExpr(be.Left) || !isScalarLikeExpr(be.Right)
-}
-
-// isScalarLikeExpr returns whether e always evaluates to a scalar value.
-func isScalarLikeExpr(e metricsql.Expr) bool {
-	switch e := e.(type) {
-	case *metricsql.NumberExpr, *metricsql.DurationExpr:
-		return true
-	case *metricsql.BinaryOpExpr:
-		return isScalarLikeExpr(e.Left) && isScalarLikeExpr(e.Right)
-	case *metricsql.FuncExpr:
-		switch strings.ToLower(e.Name) {
-		case "now", "pi", "scalar", "start", "end", "step", "time", "timezone_offset":
-			return true
-		}
-	}
-	return false
-}
-
 func adjustBinaryOpTags(be *metricsql.BinaryOpExpr, left, right []*timeseries) ([]*timeseries, []*timeseries, []*timeseries, error) {
 	if len(be.GroupModifier.Op) == 0 && len(be.JoinModifier.Op) == 0 {
 		if isScalar(left) {
@@ -292,7 +226,7 @@ func adjustBinaryOpTags(be *metricsql.BinaryOpExpr, left, right []*timeseries) (
 		}
 	}
 
-	// Slow path: `vector op vector` or `a op {on|ignoring} {group_left|group_right} {fill|fill_left|fill_right} b`
+	// Slow path: `vector op vector` or `a op {on|ignoring} {group_left|group_right} b`
 	var rvsLeft, rvsRight []*timeseries
 	mLeft, mRight := createTimeseriesMapByTagSet(be, left, right)
 	joinOp := strings.ToLower(be.JoinModifier.Op)
@@ -305,27 +239,10 @@ func adjustBinaryOpTags(be *metricsql.BinaryOpExpr, left, right []*timeseries) (
 		// Add __name__ to groupTags if metric name must be preserved.
 		groupTags = append(groupTags[:len(groupTags):len(groupTags)], "__name__")
 	}
-	// Add missing keys from mRight to mLeft when fill_left()/fill() modifier is used
-	if be.FillLeft != nil {
-		for k := range mRight {
-			if _, ok := mLeft[k]; !ok {
-				mLeft[k] = nil
-			}
-		}
-	}
 	for k, tssLeft := range mLeft {
 		tssRight := mRight[k]
-		if len(tssLeft) == 0 {
-			if be.FillLeft == nil {
-				logger.Panicf("BUG: unexpected empty tssLeft for key %q when FillLeft is nil", k)
-			}
-			tssLeft = []*timeseries{newFillTimeseries(be, tssRight[0])}
-		}
 		if len(tssRight) == 0 {
-			if be.FillRight == nil {
-				continue
-			}
-			tssRight = []*timeseries{newFillTimeseries(be, tssLeft[0])}
+			continue
 		}
 		switch joinOp {
 		case "group_left":
@@ -370,28 +287,6 @@ func adjustBinaryOpTags(be *metricsql.BinaryOpExpr, left, right []*timeseries) (
 	return rvsLeft, rvsRight, dst, nil
 }
 
-// newFillTimeseries returns a time series filled with NaN values for the fill_left()/fill_right()/fill() modifiers.
-// These NaN values will be replaced later with the fill value if needed.
-func newFillTimeseries(be *metricsql.BinaryOpExpr, src *timeseries) *timeseries {
-	var ts timeseries
-	ts.CopyFromShallowTimestamps(src)
-	if !be.KeepMetricNames {
-		ts.MetricName.ResetMetricGroup()
-	}
-	groupTags := be.GroupModifier.Args
-	switch strings.ToLower(be.GroupModifier.Op) {
-	case "on":
-		ts.MetricName.RemoveTagsOn(groupTags)
-	default:
-		ts.MetricName.RemoveTagsIgnoring(groupTags)
-	}
-	values := ts.Values
-	for i := range values {
-		values[i] = math.NaN()
-	}
-	return &ts
-}
-
 func ensureSingleTimeseries(side string, be *metricsql.BinaryOpExpr, tss []*timeseries) error {
 	if len(tss) == 0 {
 		logger.Panicf("BUG: tss must contain at least one value")

app/vmselect/promql/eval.go

@@ -132,9 +132,6 @@ type EvalConfig struct {
 	// Whether the response can be cached.
 	MayCache bool
 
-	// Whether repeated cacheable binary op subexpressions can be optimized.
-	OptimizeRepeatedBinaryOpSubexprs bool
-
 	// LookbackDelta is analog to `-query.lookback-delta` from Prometheus.
 	LookbackDelta int64
 
@@ -174,7 +171,6 @@ func copyEvalConfig(src *EvalConfig) *EvalConfig {
 	ec.MaxPointsPerSeries = src.MaxPointsPerSeries
 	ec.Deadline = src.Deadline
 	ec.MayCache = src.MayCache
-	ec.OptimizeRepeatedBinaryOpSubexprs = src.OptimizeRepeatedBinaryOpSubexprs
 	ec.LookbackDelta = src.LookbackDelta
 	ec.RoundDigits = src.RoundDigits
 	ec.EnforcedTagFilterss = src.EnforcedTagFilterss
@@ -424,7 +420,18 @@ func evalBinaryOp(qt *querytracer.Tracer, ec *EvalConfig, be *metricsql.BinaryOp
 	if bf == nil {
 		return nil, fmt.Errorf(`unknown binary op %q`, be.Op)
 	}
-	tssLeft, tssRight, err := execBinaryOpArgs(qt, ec, be)
+	var err error
+	var tssLeft, tssRight []*timeseries
+	switch strings.ToLower(be.Op) {
+	case "and", "if":
+		// Fetch right-side series at first, since it usually contains
+		// lower number of time series for `and` and `if` operator.
+		// This should produce more specific label filters for the left side of the query.
+		// This, in turn, should reduce the time to select series for the left side of the query.
+		tssRight, tssLeft, err = execBinaryOpArgs(qt, ec, be.Right, be.Left, be)
+	default:
+		tssLeft, tssRight, err = execBinaryOpArgs(qt, ec, be.Left, be.Right, be)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("cannot execute %q: %w", be.AppendString(nil), err)
 	}
@@ -440,29 +447,6 @@ func evalBinaryOp(qt *querytracer.Tracer, ec *EvalConfig, be *metricsql.BinaryOp
 	return rv, nil
 }
 
-// binaryOpEvalOrder might change the order of evaluation of the left and right sides of a binary operation,
-// when there is chance to push down common label filters from exprFirst to exprSecond in the following executions.
-func binaryOpEvalOrder(be *metricsql.BinaryOpExpr) (exprFirst, exprSecond metricsql.Expr) {
-	exprFirst, exprSecond = be.Left, be.Right
-	switch strings.ToLower(be.Op) {
-	case "and", "if":
-		// For `and` and `if`, fetch the right-side series first, since it usually contains
-		// fewer time series and yields more specific filters for the left side.
-		exprFirst, exprSecond = be.Right, be.Left
-	}
-	if be.FillLeft != nil && be.FillRight == nil {
-		// For `fill_left(<value>)`, the unmatched series can only come from the right side, so evaluate it first.
-		exprFirst, exprSecond = be.Right, be.Left
-	}
-	return exprFirst, exprSecond
-}
-
-// canPushdownCommonFilters decides if common label filters can be pushed down from one side of a binary operation to the other.
-//
-// Common filters cannot be pushed down when:
-// - the operator is `or` or `default`;
-// - either side is an aggregation function without explicit grouping;
-// - fill(<value>) modifier is used.
 func canPushdownCommonFilters(be *metricsql.BinaryOpExpr) bool {
 	switch strings.ToLower(be.Op) {
 	case "or", "default":
@@ -471,10 +455,6 @@ func canPushdownCommonFilters(be *metricsql.BinaryOpExpr) bool {
 	if isAggrFuncWithoutGrouping(be.Left) || isAggrFuncWithoutGrouping(be.Right) {
 		return false
 	}
-	// Filters cannot be propagated when fill(<value>) modifier is used.
-	if be.FillLeft != nil && be.FillRight != nil {
-		return false
-	}
 	return true
 }
 
@@ -486,185 +466,82 @@ func isAggrFuncWithoutGrouping(e metricsql.Expr) bool {
 	return len(afe.Modifier.Args) == 0
 }
 
-func execBinaryOpArgs(qt *querytracer.Tracer, ec *EvalConfig, be *metricsql.BinaryOpExpr) ([]*timeseries, []*timeseries, error) {
-	exprFirst, exprSecond := binaryOpEvalOrder(be)
-	firstIsLeft := exprFirst == be.Left
-	sortResult := func(tssFirst, tssSecond []*timeseries) ([]*timeseries, []*timeseries, error) {
-		if firstIsLeft {
-			return tssFirst, tssSecond, nil
-		}
-		return tssSecond, tssFirst, nil
-	}
-	if canPushdownCommonFilters(be) {
-		// Execute binary operation in the following way:
-		//
-		// 1) execute the exprFirst
-		// 2) get common label filters for series returned at step 1
-		// 3) push down the found common label filters to exprSecond. This filters out unneeded series
-		//    during exprSecond execution instead of spending compute resources on extracting and processing these series
-		//    before they are dropped later when matching time series according to https://prometheus.io/docs/prometheus/latest/querying/operators/#vector-matching
-		// 4) execute the exprSecond with possible additional filters found at step 3
-		//
-		// Typical use cases:
-		// - Kubernetes-related: show pod creation time with the node name:
-		//
-		//     kube_pod_created{namespace="prod"} * on (uid) group_left(node) kube_pod_info
-		//
-		//   Without the optimization `kube_pod_info` would select and spend compute resources
-		//   for more time series than needed. The selected time series would be dropped later
-		//   when matching time series on the right and left sides of binary operand.
-		//
-		// - Generic alerting queries, which rely on `info` metrics.
-		//   See https://grafana.com/blog/2021/08/04/how-to-use-promql-joins-for-more-effective-queries-of-prometheus-metrics-at-scale/
-		//
-		// - Queries, which get additional labels from `info` metrics.
-		//   See https://www.robustperception.io/exposing-the-software-version-to-prometheus
-		tssFirst, err := evalExpr(qt, ec, exprFirst)
-		if err != nil {
-			return nil, nil, err
-		}
-		if len(tssFirst) == 0 && !strings.EqualFold(be.Op, "or") {
-			// Fast path: there is no sense in executing the exprSecond when exprFirst returns an empty result,
-			// since the "exprFirst op exprSecond" would return an empty result in any case.
-			// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3349
-			return nil, nil, nil
-		}
-		lfs := getCommonLabelFilters(tssFirst)
-		lfs = metricsql.TrimFiltersByGroupModifier(lfs, be)
-		exprSecond = metricsql.PushdownBinaryOpFilters(exprSecond, lfs)
-		tssSecond, err := evalExpr(qt, ec, exprSecond)
-		if err != nil {
-			return nil, nil, err
-		}
-		return sortResult(tssFirst, tssSecond)
-	}
-
-	// Execute exprFirst and exprSecond sequentially if there are cacheable repeated subexpressions
-	// in exprFirst and exprSecond.
-	// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10575
-	if shouldOptimizeRepeatedBinaryOpSubexprs(ec, exprFirst, exprSecond) {
-		qt = qt.NewChild("execute left and right sides of %q sequentially because repeated cacheable subexpression was found", be.Op)
+func execBinaryOpArgs(qt *querytracer.Tracer, ec *EvalConfig, exprFirst, exprSecond metricsql.Expr, be *metricsql.BinaryOpExpr) ([]*timeseries, []*timeseries, error) {
+	if !canPushdownCommonFilters(be) {
+		// Execute exprFirst and exprSecond in parallel, since it is impossible to pushdown common filters
+		// from exprFirst to exprSecond.
+		// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2886
+		qt = qt.NewChild("execute left and right sides of %q in parallel", be.Op)
 		defer qt.Done()
+		var wg sync.WaitGroup
 
+		var tssFirst []*timeseries
+		var errFirst error
 		qtFirst := qt.NewChild("expr1")
-		tssFirst, err := evalExpr(qtFirst, ec, exprFirst)
-		qtFirst.Done()
-		if err != nil {
-			return nil, nil, err
-		}
+		wg.Go(func() {
+			tssFirst, errFirst = evalExpr(qtFirst, ec, exprFirst)
+			qtFirst.Done()
+		})
 
+		var tssSecond []*timeseries
+		var errSecond error
 		qtSecond := qt.NewChild("expr2")
-		tssSecond, err := evalExpr(qtSecond, ec, exprSecond)
-		qtSecond.Done()
-		if err != nil {
-			return nil, nil, err
+		wg.Go(func() {
+			tssSecond, errSecond = evalExpr(qtSecond, ec, exprSecond)
+			qtSecond.Done()
+		})
+
+		wg.Wait()
+		if errFirst != nil {
+			return nil, nil, errFirst
+		}
+		if errSecond != nil {
+			return nil, nil, errSecond
 		}
 		return tssFirst, tssSecond, nil
 	}
 
-	// Execute exprFirst and exprSecond in parallel, since it is impossible to pushdown common filters
-	// from exprFirst to exprSecond.
-	// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2886
-	qt = qt.NewChild("execute left and right sides of %q in parallel", be.Op)
-	defer qt.Done()
-	var wg sync.WaitGroup
-
-	var tssFirst []*timeseries
-	var errFirst error
-	qtFirst := qt.NewChild("expr1")
-	wg.Go(func() {
-		tssFirst, errFirst = evalExpr(qtFirst, ec, exprFirst)
-		qtFirst.Done()
-	})
-
-	var tssSecond []*timeseries
-	var errSecond error
-	qtSecond := qt.NewChild("expr2")
-	wg.Go(func() {
-		tssSecond, errSecond = evalExpr(qtSecond, ec, exprSecond)
-		qtSecond.Done()
-	})
-
-	wg.Wait()
-	if errFirst != nil {
-		return nil, nil, errFirst
+	// Execute binary operation in the following way:
+	//
+	// 1) execute the exprFirst
+	// 2) get common label filters for series returned at step 1
+	// 3) push down the found common label filters to exprSecond. This filters out unneeded series
+	//    during exprSecond execution instead of spending compute resources on extracting and processing these series
+	//    before they are dropped later when matching time series according to https://prometheus.io/docs/prometheus/latest/querying/operators/#vector-matching
+	// 4) execute the exprSecond with possible additional filters found at step 3
+	//
+	// Typical use cases:
+	// - Kubernetes-related: show pod creation time with the node name:
+	//
+	//     kube_pod_created{namespace="prod"} * on (uid) group_left(node) kube_pod_info
+	//
+	//   Without the optimization `kube_pod_info` would select and spend compute resources
+	//   for more time series than needed. The selected time series would be dropped later
+	//   when matching time series on the right and left sides of binary operand.
+	//
+	// - Generic alerting queries, which rely on `info` metrics.
+	//   See https://grafana.com/blog/2021/08/04/how-to-use-promql-joins-for-more-effective-queries-of-prometheus-metrics-at-scale/
+	//
+	// - Queries, which get additional labels from `info` metrics.
+	//   See https://www.robustperception.io/exposing-the-software-version-to-prometheus
+	tssFirst, err := evalExpr(qt, ec, exprFirst)
+	if err != nil {
+		return nil, nil, err
 	}
-	if errSecond != nil {
-		return nil, nil, errSecond
+	if len(tssFirst) == 0 && !strings.EqualFold(be.Op, "or") {
+		// Fast path: there is no sense in executing the exprSecond when exprFirst returns an empty result,
+		// since the "exprFirst op exprSecond" would return an empty result in any case.
+		// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/3349
+		return nil, nil, nil
 	}
-	return sortResult(tssFirst, tssSecond)
-}
-
-func shouldOptimizeRepeatedBinaryOpSubexprs(ec *EvalConfig, exprFirst, exprSecond metricsql.Expr) bool {
-	if !ec.OptimizeRepeatedBinaryOpSubexprs {
-		return false
+	lfs := getCommonLabelFilters(tssFirst)
+	lfs = metricsql.TrimFiltersByGroupModifier(lfs, be)
+	exprSecond = metricsql.PushdownBinaryOpFilters(exprSecond, lfs)
+	tssSecond, err := evalExpr(qt, ec, exprSecond)
+	if err != nil {
+		return nil, nil, err
 	}
-	if ec.Start == ec.End {
-		return false
-	}
-	if !ec.mayCache() {
-		return false
-	}
-
-	candidatesFirst := make(map[string]struct{}, 1)
-	var b []byte
-	visitOptimizedAggrs(exprFirst, func(ae *metricsql.AggrFuncExpr) {
-		if hasUnseededVolatileFunc(ae) {
-			return
-		}
-		b = ae.AppendString(b[:0])
-		candidatesFirst[string(b)] = struct{}{}
-	})
-	if len(candidatesFirst) == 0 {
-		return false
-	}
-
-	repeated := false
-	visitOptimizedAggrs(exprSecond, func(ae *metricsql.AggrFuncExpr) {
-		if repeated {
-			return
-		}
-		b = ae.AppendString(b[:0])
-		_, repeated = candidatesFirst[string(b)]
-	})
-	return repeated
-}
-
-func visitOptimizedAggrs(e metricsql.Expr, f func(ae *metricsql.AggrFuncExpr)) {
-	metricsql.VisitAll(e, func(expr metricsql.Expr) {
-		ae, ok := expr.(*metricsql.AggrFuncExpr)
-		if !ok {
-			return
-		}
-		if getIncrementalAggrFuncCallbacks(ae.Name) == nil {
-			return
-		}
-		fe, _ := tryGetArgRollupFuncWithMetricExpr(ae)
-		if fe == nil {
-			return
-		}
-		f(ae)
-	})
-}
-
-func hasUnseededVolatileFunc(e metricsql.Expr) bool {
-	found := false
-	metricsql.VisitAll(e, func(expr metricsql.Expr) {
-		if found {
-			return
-		}
-		fe, ok := expr.(*metricsql.FuncExpr)
-		if !ok {
-			return
-		}
-		switch strings.ToLower(fe.Name) {
-		case "now":
-			found = true
-		case "rand", "rand_normal", "rand_exponential":
-			found = len(fe.Args) == 0
-		}
-	})
-	return found
+	return tssFirst, tssSecond, nil
 }
 
 func getCommonLabelFilters(tss []*timeseries) []metricsql.LabelFilter {

app/vmselect/promql/eval_test.go

@@ -170,87 +170,3 @@ func TestGetSumInstantValues(t *testing.T) {
 		[]*timeseries{ts("foo", 100, 1)},
 	)
 }
-
-func TestShouldOptimizeRepeatedBinaryOpSubexprsGate(t *testing.T) {
-	e, err := metricsql.Parse(`count(count(vm_requests_total) by (action,addr,cluster,endpoint)) by (action,addr,cluster) / count(count(vm_requests_total) by (action,addr,cluster,endpoint))`)
-	if err != nil {
-		t.Fatalf("unexpected error in metricsql.Parse(): %s", err)
-	}
-	be, ok := e.(*metricsql.BinaryOpExpr)
-	if !ok {
-		t.Fatalf("unexpected expr type; got %T; want *metricsql.BinaryOpExpr", e)
-	}
-
-	f := func(name string, ec *EvalConfig, resultExpected bool) {
-		t.Helper()
-		result := shouldOptimizeRepeatedBinaryOpSubexprs(ec, be.Left, be.Right)
-		if result != resultExpected {
-			t.Fatalf("unexpected result for %q; got %v; want %v", name, result, resultExpected)
-		}
-	}
-
-	f("disabled optimization", &EvalConfig{
-		Start: 1000,
-		End:   2000,
-		Step:  1000,
-	}, false)
-	f("disabled cache", &EvalConfig{
-		Start:                            1000,
-		End:                              2000,
-		Step:                             1000,
-		OptimizeRepeatedBinaryOpSubexprs: true,
-	}, false)
-	f("instant query", &EvalConfig{
-		Start:                            1000,
-		End:                              1000,
-		Step:                             1000,
-		MayCache:                         true,
-		OptimizeRepeatedBinaryOpSubexprs: true,
-	}, false)
-	f("repeated cacheable aggregate subexpression", &EvalConfig{
-		Start:                            1000,
-		End:                              2000,
-		Step:                             1000,
-		MayCache:                         true,
-		OptimizeRepeatedBinaryOpSubexprs: true,
-	}, true)
-	f("unaligned range query", &EvalConfig{
-		Start:                            1001,
-		End:                              2000,
-		Step:                             1000,
-		MayCache:                         true,
-		OptimizeRepeatedBinaryOpSubexprs: true,
-	}, false)
-}
-
-func TestShouldOptimizeRepeatedBinaryOpSubexprsExpressions(t *testing.T) {
-	f := func(name, q string, resultExpected bool) {
-		t.Helper()
-		e, err := metricsql.Parse(q)
-		if err != nil {
-			t.Fatalf("unexpected error in metricsql.Parse(%q) for %q: %s", q, name, err)
-		}
-		be, ok := e.(*metricsql.BinaryOpExpr)
-		if !ok {
-			t.Fatalf("unexpected expr type for %q; got %T; want *metricsql.BinaryOpExpr", name, e)
-		}
-		ec := &EvalConfig{Start: 1000, End: 2000, Step: 1000, MayCache: true, OptimizeRepeatedBinaryOpSubexprs: true}
-		result := shouldOptimizeRepeatedBinaryOpSubexprs(ec, be.Left, be.Right)
-		if result != resultExpected {
-			t.Fatalf("unexpected result for %q; got %v; want %v; query: %q", name, result, resultExpected, q)
-		}
-	}
-
-	f("original issue query", `count(count(vm_requests_total) by (action,addr,cluster,endpoint)) by (action,addr,cluster) / count(count(vm_requests_total) by (action,addr,cluster,endpoint))`, true)
-	f("right side contains repeated count aggregate", `count(foo) by (job) / (count(foo) by (job) + 1)`, true)
-	f("same sum aggregate", `sum(rate(foo[5m])) by (job) / sum(rate(foo[5m])) by (job)`, true)
-	f("same inner rollup but different aggregates", `sum(rate(foo[5m])) by (job) / count(rate(foo[5m])) by (job)`, false)
-	f("different count aggregates", `count(foo) by (job) / count(bar) by (job)`, false)
-	f("bare metric selector", `foo / foo`, false)
-	f("bare rollup function", `rate(a[5m]) / rate(a[5m])`, false)
-	f("now at modifier", `sum(rate(foo[5m] @ now())) by (job) / sum(rate(foo[5m] @ now())) by (job)`, false)
-	f("unseeded rand at modifier", `sum(rate(foo[5m] @ rand())) by (job) / sum(rate(foo[5m] @ rand())) by (job)`, false)
-	f("unseeded rand_normal at modifier", `sum(rate(foo[5m] @ rand_normal())) by (job) / sum(rate(foo[5m] @ rand_normal())) by (job)`, false)
-	f("unseeded rand_exponential at modifier", `sum(rate(foo[5m] @ rand_exponential())) by (job) / sum(rate(foo[5m] @ rand_exponential())) by (job)`, false)
-	f("seeded rand at modifier", `sum(rate(foo[5m] @ rand(1))) by (job) / sum(rate(foo[5m] @ rand(1))) by (job)`, true)
-}

app/vmselect/promql/exec.go

@@ -11,7 +11,6 @@ import (
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmselect/netstorage"
 	"github.com/VictoriaMetrics/VictoriaMetrics/app/vmselect/querystats"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/decimal"
-	"github.com/VictoriaMetrics/VictoriaMetrics/lib/httpserver"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/logger"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/querytracer"
 	"github.com/VictoriaMetrics/VictoriaMetrics/lib/storage"
@@ -47,15 +46,15 @@ func Exec(qt *querytracer.Tracer, ec *EvalConfig, q string, isFirstPointOnly boo
 
 	e, err := parsePromQLWithCache(q)
 	if err != nil {
-		return nil, httpserver.InvalidParamError(err)
+		return nil, err
 	}
 
 	if *disableImplicitConversion || *logImplicitConversion {
 		isInvalid := metricsql.IsLikelyInvalid(e)
 		if isInvalid && *disableImplicitConversion {
 			// we don't add query=%q to err message as it will be added by the caller
-			return nil, httpserver.InvalidParamError(fmt.Errorf("query requires implicit conversion and is rejected according to -search.disableImplicitConversion command-line flag. " +
-				"See https://docs.victoriametrics.com/victoriametrics/metricsql/#implicit-query-conversions for details"))
+			return nil, fmt.Errorf("query requires implicit conversion and is rejected according to -search.disableImplicitConversion command-line flag. " +
+				"See https://docs.victoriametrics.com/victoriametrics/metricsql/#implicit-query-conversions for details")
 		}
 		if isInvalid && *logImplicitConversion {
 			logger.Warnf("query=%q requires implicit conversion, see https://docs.victoriametrics.com/victoriametrics/metricsql/#implicit-query-conversions for details", e.AppendString(nil))

app/vmselect/promql/exec_test.go

@@ -2994,136 +2994,6 @@ func TestExecSuccess(t *testing.T) {
 		resultExpected := []netstorage.Result{}
 		f(q, resultExpected)
 	})
-	t.Run(`compare_to_nan_left_vector_right_scalar`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != NaN`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{1000, 1200, 1400, 1600, 1800, 2000},
-			Timestamps: timestampsExpected,
-		}
-		r.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("bar"),
-		}}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_non_nan_scalar_right`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != 1200`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{1000, nan, 1400, 1600, 1800, 2000},
-			Timestamps: timestampsExpected,
-		}
-		r.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("bar"),
-		}}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_nan_vector_right`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != label_set(NaN, "foo", "bar")`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{1000, 1200, 1400, 1600, 1800, 2000},
-			Timestamps: timestampsExpected,
-		}
-		r.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("bar"),
-		}}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_nan_scalar_comparison_right`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != (1 > 2)`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{1000, 1200, 1400, 1600, 1800, 2000},
-			Timestamps: timestampsExpected,
-		}
-		r.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("bar"),
-		}}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_empty_vector_right`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != (label_set(time(), "foo", "bar") > 100000)`
-		resultExpected := []netstorage.Result{}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_empty_vector_right_offset`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != ((label_set(time(), "foo", "bar") > 100000) offset 0s)`
-		resultExpected := []netstorage.Result{}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_empty_vector_left`, func(t *testing.T) {
-		// A missing sample on the left side results in NaN for every comparison
-		// operation, so no special handling is needed there.
-		t.Parallel()
-		q := `(label_set(time(), "foo", "bar") > 100000) != label_set(time(), "foo", "bar")`
-		resultExpected := []netstorage.Result{}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_empty_series_right_bool`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") == bool (label_set(time(), "foo", "bar") > 100000)`
-		resultExpected := []netstorage.Result{}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_partially_empty_series_right`, func(t *testing.T) {
-		// Prometheus drops the timestamps filtered out by the comparison on the right.
-		// See https://github.com/VictoriaMetrics/VictoriaMetrics/pull/11100#issuecomment-4933952390.
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != (label_set(time(), "foo", "bar") * 2 > 2800)`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{nan, nan, nan, 1600, 1800, 2000},
-			Timestamps: timestampsExpected,
-		}
-		r.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("bar"),
-		}}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_empty_unlabeled_vector_right`, func(t *testing.T) {
-		t.Parallel()
-		q := `sum(label_set(time(), "foo", "bar")) != (sum(label_set(time(), "foo", "bar")) > 100000)`
-		resultExpected := []netstorage.Result{}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_empty_series_right_with_fill_left`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != fill_left(0) (label_set(time(), "foo", "bar") > 100000)`
-		resultExpected := []netstorage.Result{}
-		f(q, resultExpected)
-	})
-	t.Run(`compare_to_empty_series_right_with_fill_right`, func(t *testing.T) {
-		t.Parallel()
-		q := `label_set(time(), "foo", "bar") != fill_right(0) (label_set(time(), "foo", "bar") > 100000)`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{1000, 1200, 1400, 1600, 1800, 2000},
-			Timestamps: timestampsExpected,
-		}
-		r.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("bar"),
-		}}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
 	t.Run(`-1 < 2`, func(t *testing.T) {
 		t.Parallel()
 		q := `-1 < 2`
@@ -4136,275 +4006,6 @@ func TestExecSuccess(t *testing.T) {
 		resultExpected := []netstorage.Result{r1, r2}
 		f(q, resultExpected)
 	})
-	t.Run(`vector + vector fill()`, func(t *testing.T) {
-		t.Parallel()
-		q := `sort_by_label((
-			label_set(1, "foo", "common")
-			or label_set(2, "foo", "left_only")
-		) + fill(0) (
-			label_set(3, "foo", "common")
-			or label_set(4, "foo", "right_only")
-		), "foo")`
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{4, 4, 4, 4, 4, 4},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("common"),
-		}}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{2, 2, 2, 2, 2, 2},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("left_only"),
-		}}
-		r3 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{4, 4, 4, 4, 4, 4},
-			Timestamps: timestampsExpected,
-		}
-		r3.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("right_only"),
-		}}
-		resultExpected := []netstorage.Result{r1, r2, r3}
-		f(q, resultExpected)
-	})
-	t.Run(`vector + vector fill() both sides NaN case`, func(t *testing.T) {
-		t.Parallel()
-		q := `(
-			label_set(time() <= 1200, "foo", "common")
-		) + fill(10) (
-			label_set(time() >= 1600, "foo", "common")
-		)`
-		r := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{1010, 1210, nan, 1610, 1810, 2010},
-			Timestamps: timestampsExpected,
-		}
-		r.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("common"),
-		}}
-		resultExpected := []netstorage.Result{r}
-		f(q, resultExpected)
-	})
-	t.Run(`vector + vector fill_left() fill_right()`, func(t *testing.T) {
-		t.Parallel()
-		q := `sort_by_label((
-			label_set(1, "foo", "common")
-			or label_set(2, "foo", "left_only")
-		) + fill_left(10) fill_right(20) (
-			label_set(3, "foo", "common")
-			or label_set(4, "foo", "right_only")
-		), "foo")`
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{4, 4, 4, 4, 4, 4},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("common"),
-		}}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{22, 22, 22, 22, 22, 22},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("left_only"),
-		}}
-		r3 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{14, 14, 14, 14, 14, 14},
-			Timestamps: timestampsExpected,
-		}
-		r3.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("right_only"),
-		}}
-		resultExpected := []netstorage.Result{r1, r2, r3}
-		f(q, resultExpected)
-	})
-	t.Run(`vector + vector fill_right() only`, func(t *testing.T) {
-		t.Parallel()
-		q := `sort_by_label((
-			label_set(1, "foo", "common")
-			or label_set(2, "foo", "left_only")
-		) + fill_right(20) (
-			label_set(3, "foo", "common")
-			or label_set(4, "foo", "right_only")
-		), "foo")`
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{4, 4, 4, 4, 4, 4},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("common"),
-		}}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{22, 22, 22, 22, 22, 22},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("left_only"),
-		}}
-		resultExpected := []netstorage.Result{r1, r2}
-		f(q, resultExpected)
-	})
-	t.Run(`vector + vector on() fill()`, func(t *testing.T) {
-		t.Parallel()
-		q := `sort_by_label((
-			label_set(1, "foo", "common", "extra", "l")
-			or label_set(2, "foo", "left_only", "extra", "l")
-		) + on(foo) fill(0) (
-			label_set(3, "foo", "common", "extra", "r")
-			or label_set(4, "foo", "right_only", "extra", "r")
-		), "foo")`
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{4, 4, 4, 4, 4, 4},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("common"),
-		}}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{2, 2, 2, 2, 2, 2},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("left_only"),
-		}}
-		r3 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{4, 4, 4, 4, 4, 4},
-			Timestamps: timestampsExpected,
-		}
-		r3.MetricName.Tags = []storage.Tag{{
-			Key:   []byte("foo"),
-			Value: []byte("right_only"),
-		}}
-		resultExpected := []netstorage.Result{r1, r2, r3}
-		f(q, resultExpected)
-	})
-	t.Run(`vector + vector on() group_left() fill_right()`, func(t *testing.T) {
-		t.Parallel()
-		q := `sort_by_label((
-			label_set(1, "method", "get", "code", "500")
-			or label_set(2, "method", "get", "code", "404")
-			or label_set(3, "method", "put", "code", "501")
-		) + on(method) group_left() fill_right(0) (
-			label_set(10, "method", "get")
-		), "method", "code")`
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{12, 12, 12, 12, 12, 12},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("code"),
-				Value: []byte("404"),
-			},
-			{
-				Key:   []byte("method"),
-				Value: []byte("get"),
-			},
-		}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{11, 11, 11, 11, 11, 11},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("code"),
-				Value: []byte("500"),
-			},
-			{
-				Key:   []byte("method"),
-				Value: []byte("get"),
-			},
-		}
-		r3 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{3, 3, 3, 3, 3, 3},
-			Timestamps: timestampsExpected,
-		}
-		r3.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("code"),
-				Value: []byte("501"),
-			},
-			{
-				Key:   []byte("method"),
-				Value: []byte("put"),
-			},
-		}
-		resultExpected := []netstorage.Result{r1, r2, r3}
-		f(q, resultExpected)
-	})
-	t.Run(`vector / vector ignoring() fill()`, func(t *testing.T) {
-		t.Parallel()
-		q := `sort_by_label((
-			label_set(6, "method", "get", "code", "500")
-			or label_set(1, "method", "put", "code", "500")
-		) / ignoring(code) fill(0) (
-			label_set(12, "method", "get")
-			or label_set(5, "method", "post")
-			or label_set(10, "method", "put")
-		), "method")`
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{0.5, 0.5, 0.5, 0.5, 0.5, 0.5},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("method"),
-				Value: []byte("get"),
-			},
-		}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{0, 0, 0, 0, 0, 0},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("method"),
-				Value: []byte("post"),
-			},
-		}
-		r3 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{0.1, 0.1, 0.1, 0.1, 0.1, 0.1},
-			Timestamps: timestampsExpected,
-		}
-		r3.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("method"),
-				Value: []byte("put"),
-			},
-		}
-		resultExpected := []netstorage.Result{r1, r2, r3}
-		f(q, resultExpected)
-	})
 	t.Run(`histogram_quantile(scalar)`, func(t *testing.T) {
 		t.Parallel()
 		q := `histogram_quantile(0.6, time())`
@@ -5232,137 +4833,13 @@ func TestExecSuccess(t *testing.T) {
 		resultExpected := []netstorage.Result{}
 		f(q, resultExpected)
 	})
-	// buckets that are consecutively empty at left and right ends will not be preserved.
-	t.Run(`buckets_limit(trim_zero_preserve_empty_when_limit_not_reached)`, func(t *testing.T) {
+	t.Run(`buckets_limit(zero)`, func(t *testing.T) {
 		t.Parallel()
-		q := `sort(buckets_limit(3, (
-			alias(label_set(36, "le", "+Inf"), "metric"),
-			alias(label_set(36, "le", "25"), "metric"),
-			alias(label_set(36, "le", "21"), "metric"),
-			alias(label_set(36, "le", "19"), "metric"),
-			alias(label_set(36, "le", "18"), "metric"),
-			alias(label_set(36, "le", "17"), "metric"),
-			alias(label_set(36, "le", "16"), "metric"),
-			alias(label_set(27, "le", "12"), "metric"),
-			alias(label_set(14, "le", "9"), "metric"),
-			alias(label_set(0, "le", "6"), "metric"),
-			alias(label_set(0, "le", "1"), "metric"),
-			)))`
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{14, 14, 14, 14, 14, 14},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.MetricGroup = []byte("metric")
-		r1.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("9"),
-			},
-		}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{27, 27, 27, 27, 27, 27},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.MetricGroup = []byte("metric")
-		r2.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("12"),
-			},
-		}
-		r3 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{36, 36, 36, 36, 36, 36},
-			Timestamps: timestampsExpected,
-		}
-		r3.MetricName.MetricGroup = []byte("metric")
-		r3.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("16"),
-			},
-		}
-		resultExpected := []netstorage.Result{r1, r2, r3}
-		f(q, resultExpected)
-	})
-
-	// the number of non-empty bucket doesn't reach the given "limit", so some empty buckets will be preserved, and left buckets are preferred to be kept.
-	t.Run(`buckets_limit(trim_zero)`, func(t *testing.T) {
-		t.Parallel()
-		q := `sort(buckets_limit(5, (
-			alias(label_set(36, "le", "18"), "metric"),
-			alias(label_set(36, "le", "17"), "metric"),
-			alias(label_set(36, "le", "16"), "metric"),
-			alias(label_set(27, "le", "12"), "metric"),
-			alias(label_set(14, "le", "9"), "metric"),
-			alias(label_set(0, "le", "6"), "metric"),
-			alias(label_set(0, "le", "1"), "metric"),
-			)))`
-
-		r1 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{0, 0, 0, 0, 0, 0},
-			Timestamps: timestampsExpected,
-		}
-		r1.MetricName.MetricGroup = []byte("metric")
-		r1.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("1"),
-			},
-		}
-		r2 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{0, 0, 0, 0, 0, 0},
-			Timestamps: timestampsExpected,
-		}
-		r2.MetricName.MetricGroup = []byte("metric")
-		r2.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("6"),
-			},
-		}
-		r3 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{14, 14, 14, 14, 14, 14},
-			Timestamps: timestampsExpected,
-		}
-		r3.MetricName.MetricGroup = []byte("metric")
-		r3.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("9"),
-			},
-		}
-		r4 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{27, 27, 27, 27, 27, 27},
-			Timestamps: timestampsExpected,
-		}
-		r4.MetricName.MetricGroup = []byte("metric")
-		r4.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("12"),
-			},
-		}
-		r5 := netstorage.Result{
-			MetricName: metricNameExpected,
-			Values:     []float64{36, 36, 36, 36, 36, 36},
-			Timestamps: timestampsExpected,
-		}
-		r5.MetricName.MetricGroup = []byte("metric")
-		r5.MetricName.Tags = []storage.Tag{
-			{
-				Key:   []byte("le"),
-				Value: []byte("16"),
-			},
-		}
-
-		resultExpected := []netstorage.Result{r1, r2, r3, r4, r5}
+		q := `buckets_limit(0, (
+			alias(label_set(100, "le", "inf", "x", "y"), "metric"),
+			alias(label_set(50, "le", "120", "x", "y"), "metric"),
+		))`
+		resultExpected := []netstorage.Result{}
 		f(q, resultExpected)
 	})
 	t.Run(`buckets_limit(unused)`, func(t *testing.T) {
@@ -6751,6 +6228,50 @@ func TestExecSuccess(t *testing.T) {
 		resultExpected := []netstorage.Result{r1, r2, r3, r4, r5, r6, r7}
 		f(q, resultExpected)
 	})
+	t.Run(`sum(histogram_over_time) by (vmrange)`, func(t *testing.T) {
+		t.Parallel()
+		q := `sort_by_label(
+			buckets_limit(
+				3,
+				sum(histogram_over_time(alias(label_set(rand(0)*1.3+1.1, "foo", "bar"), "xxx")[200s:5s])) by (vmrange)
+			), "le"
+		)`
+		r1 := netstorage.Result{
+			MetricName: metricNameExpected,
+			Values:     []float64{40, 40, 40, 40, 40, 40},
+			Timestamps: timestampsExpected,
+		}
+		r1.MetricName.Tags = []storage.Tag{
+			{
+				Key:   []byte("le"),
+				Value: []byte("+Inf"),
+			},
+		}
+		r2 := netstorage.Result{
+			MetricName: metricNameExpected,
+			Values:     []float64{0, 0, 0, 0, 0, 0},
+			Timestamps: timestampsExpected,
+		}
+		r2.MetricName.Tags = []storage.Tag{
+			{
+				Key:   []byte("le"),
+				Value: []byte("1.000e+00"),
+			},
+		}
+		r3 := netstorage.Result{
+			MetricName: metricNameExpected,
+			Values:     []float64{40, 40, 40, 40, 40, 40},
+			Timestamps: timestampsExpected,
+		}
+		r3.MetricName.Tags = []storage.Tag{
+			{
+				Key:   []byte("le"),
+				Value: []byte("2.448e+00"),
+			},
+		}
+		resultExpected := []netstorage.Result{r1, r2, r3}
+		f(q, resultExpected)
+	})
 	t.Run(`sum(histogram_over_time)`, func(t *testing.T) {
 		t.Parallel()
 		q := `sum(histogram_over_time(alias(label_set(rand(0)*1.3+1.1, "foo", "bar"), "xxx")[200s:5s]))`

app/vmselect/promql/rollup.go

@@ -1055,7 +1055,7 @@ func newRollupHoltWinters(args []any) (rollupFunc, error) {
 			return nan
 		}
 
-		// See https://en.wikipedia.org/wiki/Exponential_smoothing#Double_exponential_smoothing_%28Holt_linear%29 .
+		// See https://en.wikipedia.org/wiki/Exponential_smoothing#Double_exponential_smoothing .
 		// TODO: determine whether this shit really works.
 		s0 := rfa.prevValue
 		if math.IsNaN(s0) {

app/vmselect/promql/timeseries.go

@@ -2,7 +2,6 @@ package promql
 
 import (
 	"fmt"
-	"math"
 	"sort"
 	"strconv"
 	"sync"
@@ -289,9 +288,6 @@ func marshalMetricTagsSorted(dst []byte, mn *storage.MetricName) []byte {
 }
 
 func marshalBytesFast(dst []byte, s []byte) []byte {
-	if len(s) > math.MaxUint16 {
-		logger.Panicf("BUG: s len %d cannot exceed %d", len(s), math.MaxUint16)
-	}
 	dst = encoding.MarshalUint16(dst, uint16(len(s)))
 	dst = append(dst, s...)
 	return dst

app/vmselect/promql/transform.go

@@ -2,7 +2,6 @@ package promql
 
 import (
 	"bytes"
-	"errors"
 	"fmt"
 	"math"
 	"math/rand"
@@ -394,7 +393,7 @@ func transformBucketsLimit(tfa *transformFuncArg) ([]*timeseries, error) {
 		return nil, err
 	}
 	if limit <= 0 {
-		return nil, fmt.Errorf("limit must be greater than 0; got %d", limit)
+		return nil, nil
 	}
 	if limit < 3 {
 		// Preserve the first and the last bucket for better accuracy for min and max values.
@@ -462,23 +461,6 @@ func transformBucketsLimit(tfa *transformFuncArg) ([]*timeseries, error) {
 				prevValue = value
 			}
 		}
-
-		// Remove buckets that are consecutively empty at left and right ends to obtain more accurate max and min values.
-		// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10417.
-		epsilon := 1e-9
-		isEmptyBucket := func(hits float64) bool {
-			return !math.IsNaN(hits) && math.Abs(hits) < epsilon
-		}
-		l := 0
-		r := len(leGroup) - 1
-		for r-l+1 > limit && isEmptyBucket(leGroup[r].hits) {
-			r--
-		}
-		for r-l+1 > limit && isEmptyBucket(leGroup[l].hits) {
-			l++
-		}
-		leGroup = leGroup[l : r+1]
-
 		for len(leGroup) > limit {
 			// Preserve the first and the last bucket for better accuracy for min and max values
 			xxMinIdx := 1
@@ -1139,29 +1121,29 @@ func groupLeTimeseries(tss []*timeseries) map[string][]leTimeseries {
 
 func fixBrokenBuckets(i int, xss []leTimeseries) {
 	// Buckets are already sorted by le, so their values must be in ascending order,
-	// since the upper bucket includes all the lower buckets.
-	// If the upper bucket has lower value than the current bucket,
-	// then the upper bucket must be substituted with the current bucket value.
+	// since the next bucket includes all the previous buckets.
+	// If the next bucket has lower value than the current bucket,
+	// then the next bucket must be substituted with the current bucket value.
 	// See https://github.com/VictoriaMetrics/VictoriaMetrics/issues/4580#issuecomment-2186659102
 	if len(xss) < 2 {
 		return
 	}
 
-	vPrev := xss[0].ts.Values[i]
+	vNext := xss[0].ts.Values[i]
 	// Set the lowest bucket to 0 if its value is NaN, so it can be properly
 	// compared with upper buckets in the loop below.
-	if math.IsNaN(vPrev) {
-		vPrev = 0
-		xss[0].ts.Values[i] = vPrev
+	if math.IsNaN(vNext) {
+		vNext = 0
+		xss[0].ts.Values[i] = vNext
 	}
 	// Substitute upper bucket values with lower bucket values if the upper values are NaN
-	// or are smaller than the lower bucket values.
+	// or are bigger than the lower bucket values.
 	for j := 1; j < len(xss); j++ {
 		v := xss[j].ts.Values[i]
-		if math.IsNaN(v) || vPrev > v {
-			xss[j].ts.Values[i] = vPrev
+		if math.IsNaN(v) || vNext > v {
+			xss[j].ts.Values[i] = vNext
 		} else {
-			vPrev = v
+			vNext = v
 		}
 	}
 }
@@ -2567,11 +2549,6 @@ func isDecimalChar(ch byte) bool {
 func mustParseNum(s string) float64 {
 	f, err := strconv.ParseFloat(s, 64)
 	if err != nil {
-		if errors.Is(err, strconv.ErrRange) {
-			// The number is too large to fit into float64; ParseFloat returns ±Inf in this case.
-			// Use ±Inf for sorting purposes — it is semantically correct.
-			return f
-		}
 		logger.Panicf("BUG: unexpected error when parsing the number %q: %s", s, err)
 	}
 	return f

app/vmselect/promql/transform_test.go

@@ -385,12 +385,4 @@ func TestNumericLess(t *testing.T) {
 	f("12.9", "12.56", false)
 	f("12.56", "12.9", true)
 	f("12.9", "12.9", false)
-
-	// 309-digit numbers - must not panic (regression test for GHSA-9g98-8jgr-x2vv)
-	big := strings.Repeat("9", 309)
-	f(big, "1", false)
-	f("1", big, true)
-	f(big, big, false)
-	f("-"+big, big, true)
-	f(big, "-"+big, false)
 }

app/vmselect/vmui/assets/MetricsQL-DmQtQmkX.md

@@ -91,9 +91,9 @@ The list of MetricsQL features on top of PromQL:
   Labels from the `on()` list aren't copied.
 * [Aggregate functions](#aggregate-functions) accept arbitrary number of args.
   For example, `avg(q1, q2, q3)` would return the average values for every point across time series returned by `q1`, `q2` and `q3`.
-* [@ modifier](https://prometheus.io/docs/prometheus/latest/querying/basics/#-modifier) can be put anywhere in the query.
+* [@ modifier](https://prometheus.io/docs/prometheus/latest/querying/basics/#modifier) can be put anywhere in the query.
   For example, `sum(foo) @ end()` calculates `sum(foo)` at the `end` timestamp of the selected time range `[start ... end]`.
-* Arbitrary subexpression can be used as [@ modifier](https://prometheus.io/docs/prometheus/latest/querying/basics/#-modifier).
+* Arbitrary subexpression can be used as [@ modifier](https://prometheus.io/docs/prometheus/latest/querying/basics/#modifier).
   For example, `foo @ (end() - 1h)` calculates `foo` at the `end - 1 hour` timestamp on the selected time range `[start ... end]`.
 * [offset](https://prometheus.io/docs/prometheus/latest/querying/basics/#offset-modifier), lookbehind window in square brackets
   and `step` value for [subquery](#subqueries) may refer to the current step aka `$__interval` value from Grafana with `[Ni]` syntax.
@@ -482,7 +482,7 @@ See also [hoeffding_bound_lower](#hoeffding_bound_lower).
 #### holt_winters
 
 `holt_winters(series_selector[d], sf, tf)` is a [rollup function](#rollup-functions), which calculates Holt-Winters value
-(aka [double exponential smoothing](https://en.wikipedia.org/wiki/Exponential_smoothing#Double_exponential_smoothing_%28Holt_linear%29)) for [raw samples](https://docs.victoriametrics.com/victoriametrics/keyconcepts/#raw-samples)
+(aka [double exponential smoothing](https://en.wikipedia.org/wiki/Exponential_smoothing#Double_exponential_smoothing)) for [raw samples](https://docs.victoriametrics.com/victoriametrics/keyconcepts/#raw-samples)
 over the given lookbehind window `d` using the given smoothing factor `sf` and the given trend factor `tf`.
 Both `sf` and `tf` must be in the range `[0...1]`.
 
@@ -1154,7 +1154,7 @@ See also [asin](#asin) and [cos](#cos).
 #### acosh
 
 `acosh(q)` is a [transform function](#transform-functions), which returns
-[inverse hyperbolic cosine](https://en.wikipedia.org/wiki/Inverse_hyperbolic_functions#Definitions_in_terms_of_logarithms) for every point of every time series returned by `q`.
+[inverse hyperbolic cosine](https://en.wikipedia.org/wiki/Inverse_hyperbolic_functions#Inverse_hyperbolic_cosine) for every point of every time series returned by `q`.
 
 Metric names are stripped from the resulting series. Add [keep_metric_names](#keep_metric_names) modifier in order to keep metric names.
 
@@ -1176,7 +1176,7 @@ See also [acos](#acos) and [sin](#sin).
 #### asinh
 
 `asinh(q)` is a [transform function](#transform-functions), which returns
-[inverse hyperbolic sine](https://en.wikipedia.org/wiki/Inverse_hyperbolic_functions#Definitions_in_terms_of_logarithms) for every point of every time series returned by `q`.
+[inverse hyperbolic sine](https://en.wikipedia.org/wiki/Inverse_hyperbolic_functions#Inverse_hyperbolic_sine) for every point of every time series returned by `q`.
 
 Metric names are stripped from the resulting series. Add [keep_metric_names](#keep_metric_names) modifier in order to keep metric names.
 
@@ -1198,7 +1198,7 @@ See also [tan](#tan).
 #### atanh
 
 `atanh(q)` is a [transform function](#transform-functions), which returns
-[inverse hyperbolic tangent](https://en.wikipedia.org/wiki/Inverse_hyperbolic_functions#Definitions_in_terms_of_logarithms) for every point of every time series returned by `q`.
+[inverse hyperbolic tangent](https://en.wikipedia.org/wiki/Inverse_hyperbolic_functions#Inverse_hyperbolic_tangent) for every point of every time series returned by `q`.
 
 Metric names are stripped from the resulting series. Add [keep_metric_names](#keep_metric_names) modifier in order to keep metric names.
 
@@ -1229,7 +1229,8 @@ Metric names are stripped from the resulting series. Add [keep_metric_names](#ke
 `buckets_limit(limit, buckets)` is a [transform function](#transform-functions), which limits the number
 of [histogram buckets](https://valyala.medium.com/improving-histogram-usability-for-prometheus-and-grafana-bc7e5df0e350) to the given `limit`. 
 
-The given `limit` should be greater than `0`. If it is less than `3`, it will be automatically raised to `3` to preserve the first and last buckets for better accuracy of min and max values.
+The result will preserve the first and the last bucket to improve accuracy for min and max values. 
+So, if the `limit` is greater than 0 and less than 3, the function will still return 3 buckets: the first bucket, the last bucket, and a selected bucket.
 
 See also [prometheus_buckets](#prometheus_buckets) and [histogram_quantile](#histogram_quantile).
 

app/vmselect/vmui/assets/favicon.svg

@@ -1,5 +0,0 @@
-<svg width="48" height="48" fill="#020202" xmlns="http://www.w3.org/2000/svg">
-    <path d="M24.5475 0C10.3246.0265251 1.11379 3.06365 4.40623 6.10077c0 0 12.32997 11.23333 16.58217 14.84083.8131.6896 2.1728 1.1936 3.5191 1.2201h.1199c1.3463-.0265 2.706-.5305 3.5191-1.2201 4.2522-3.5942 16.5422-14.84083 16.5422-14.84083C48.0478 3.06365 38.8636.0265251 24.6674 0"/>
-    <path d="M28.1579 27.0159c-.8131.6896-2.1728 1.1936-3.5191 1.2201h-.12c-1.3463-.0265-2.7059-.5305-3.519-1.2201-2.9725-2.5067-13.35639-11.87-17.26201-15.3979v5.4112c0 .5968.22661 1.3793.6265 1.7506C7.00358 21.1936 17.2675 30.5437 20.9731 33.6737c.8132.6896 2.1728 1.1936 3.5191 1.2201h.12c1.3463-.0265 2.7059-.5305 3.519-1.2201 3.679-3.13 13.9429-12.4536 16.6089-14.8939.4132-.3713.6265-1.1538.6265-1.7506V11.618c-3.9323 3.5411-14.3162 12.931-17.2354 15.3979h.0267Z"/>
-    <path d="M28.1579 39.748c-.8131.6897-2.1728 1.1937-3.5191 1.2202h-.12c-1.3463-.0265-2.7059-.5305-3.519-1.2202-2.9725-2.4933-13.35639-11.8567-17.26201-15.3978v5.4111c0 .5969.22661 1.3793.6265 1.7507C7.00358 33.9258 17.2675 43.2759 20.9731 46.4058c.8132.6897 2.1728 1.1937 3.5191 1.2202h.12c1.3463-.0265 2.7059-.5305 3.519-1.2202 3.679-3.1299 13.9429-12.4535 16.6089-14.8938.4132-.3714.6265-1.1538.6265-1.7507v-5.4111c-3.9323 3.5411-14.3162 12.931-17.2354 15.3978h.0267Z"/>
-</svg>

app/vmselect/vmui/assets/rolldown-runtime-CNC7AqOf.js

@@ -1 +0,0 @@
-var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t,n)=>()=>{if(n)throw n[0];try{return e&&(t=e(e=0)),t}catch(e){throw n=[e],e}},s=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),c=(e,n)=>{let r={};for(var i in e)t(r,i,{get:e[i],enumerable:!0});return n||t(r,Symbol.toStringTag,{value:`Module`}),r},l=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},u=(n,r,a)=>(a=n==null?{}:e(i(n)),l(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n)),d=e=>a.call(e,`module.exports`)?e[`module.exports`]:l(t({},`__esModule`,{value:!0}),e);export{u as a,d as i,o as n,c as r,s as t};

app/vmselect/vmui/assets/rolldown-runtime-COnpUsM8.js

@@ -0,0 +1 @@
+var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(e&&(t=e(e=0)),t),s=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),c=(e,n)=>{let r={};for(var i in e)t(r,i,{get:e[i],enumerable:!0});return n||t(r,Symbol.toStringTag,{value:`Module`}),r},l=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},u=(n,r,a)=>(a=n==null?{}:e(i(n)),l(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n)),d=e=>a.call(e,`module.exports`)?e[`module.exports`]:l(t({},`__esModule`,{value:!0}),e);export{u as a,d as i,o as n,c as r,s as t};

app/vmselect/vmui/favicon.svg

@@ -0,0 +1 @@
+<svg width="48" height="48" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M24.5475 0C10.3246.0265251 1.11379 3.06365 4.40623 6.10077c0 0 12.32997 11.23333 16.58217 14.84083.8131.6896 2.1728 1.1936 3.5191 1.2201h.1199c1.3463-.0265 2.706-.5305 3.5191-1.2201 4.2522-3.5942 16.5422-14.84083 16.5422-14.84083C48.0478 3.06365 38.8636.0265251 24.6674 0" fill="#020202"/><path d="M28.1579 27.0159c-.8131.6896-2.1728 1.1936-3.5191 1.2201h-.12c-1.3463-.0265-2.7059-.5305-3.519-1.2201-2.9725-2.5067-13.35639-11.87-17.26201-15.3979v5.4112c0 .5968.22661 1.3793.6265 1.7506C7.00358 21.1936 17.2675 30.5437 20.9731 33.6737c.8132.6896 2.1728 1.1936 3.5191 1.2201h.12c1.3463-.0265 2.7059-.5305 3.519-1.2201 3.679-3.13 13.9429-12.4536 16.6089-14.8939.4132-.3713.6265-1.1538.6265-1.7506V11.618c-3.9323 3.5411-14.3162 12.931-17.2354 15.3979h.0267Z" fill="#020202"/><path d="M28.1579 39.748c-.8131.6897-2.1728 1.1937-3.5191 1.2202h-.12c-1.3463-.0265-2.7059-.5305-3.519-1.2202-2.9725-2.4933-13.35639-11.8567-17.26201-15.3978v5.4111c0 .5969.22661 1.3793.6265 1.7507C7.00358 33.9258 17.2675 43.2759 20.9731 46.4058c.8132.6897 2.1728 1.1937 3.5191 1.2202h.12c1.3463-.0265 2.7059-.5305 3.519-1.2202 3.679-3.1299 13.9429-12.4535 16.6089-14.8938.4132-.3714.6265-1.1538.6265-1.7507v-5.4111c-3.9323 3.5411-14.3162 12.931-17.2354 15.3978h.0267Z" fill="#020202"/></svg>

app/vmselect/vmui/index.html

@@ -2,9 +2,9 @@
 <html lang="en">
 <head>
   <meta charset="utf-8"/>
-  <link id="favicon" rel="icon" href="./assets/favicon.svg" />
-  <link rel="apple-touch-icon" href="./assets/favicon.svg" />
-  <link id="mask-icon" rel="mask-icon" href="./assets/favicon.svg" color="#000000">
+  <link rel="icon" href="./favicon.svg"/>
+  <link rel="apple-touch-icon" href="./favicon.svg"/>
+  <link rel="mask-icon" href="./favicon.svg" color="#000000">
 
   <meta name="robots" content="noindex">
   <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=5"/>
@@ -37,11 +37,11 @@
   <meta property="og:title" content="UI for VictoriaMetrics">
   <meta property="og:url" content="https://victoriametrics.com/">
   <meta property="og:description" content="Explore and troubleshoot your VictoriaMetrics data">
-  <script type="module" crossorigin src="./assets/index-BiDX4bB6.js"></script>
-  <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-CNC7AqOf.js">
-  <link rel="modulepreload" crossorigin href="./assets/vendor-DwJYpOdw.js">
+  <script type="module" crossorigin src="./assets/index-CoGukb-x.js"></script>
+  <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-COnpUsM8.js">
+  <link rel="modulepreload" crossorigin href="./assets/vendor-C8Kwp93_.js">
   <link rel="stylesheet" crossorigin href="./assets/vendor-CnsZ1jie.css">
-  <link rel="stylesheet" crossorigin href="./assets/index-CymA7XYg.css">
+  <link rel="stylesheet" crossorigin href="./assets/index-BBUnmLOr.css">
 </head>
 <body>
 <noscript>You need to enable JavaScript to run this app.</noscript>

app/vmselect/vmui/manifest.json

@@ -3,7 +3,7 @@
   "name": "vmui",
   "icons": [
     {
-      "src": "./assets/favicon.svg",
+      "src": "favicon.svg",
       "sizes": "any",
       "type": "image/svg+xml"
     }