Allow regex to keep for promql/aggregate

[leagueofsoups]

Hey! Can you please allow regex to be used for "keep"? My prometheus uses a webhook to send alerts to corporate monitoring, it expects to receive alerts with at least one label from the set.

For example:

rule {
  match {
    kind = "alerting"
  }

  aggregate ".+" {
    keep = ["lable1|lable2"]
  }
}

more information:

Is there a way to check label by regex in the resulting vector, like promql/series (api request)? (after aggregating and adding additional labels)

I whant find alerts WITHOUT special_label

#situation 1:

- name: "<name>"
  rules:
  - alert: AlertName
    expr: <aggregate expression>
    labels:
      special_label: ...

#situation 2:

- name: "<name>"
  rules:
  - alert: AlertName
    expr: sum by (special_label)...

[prymitive]

Is there a way to check label by regex in the resulting vector, like promql/series (api request)? (after aggregating and adding additional labels)

This check is currently an "offline" one, doing only static analysis by looking at the rule definition and nothing else; so it doesn't know all the possible labels that the query returns, or the labels of the input time series used by it, so no.
It could do that but that would convert it to an "online" check, which requires having a Prometheus server configured in pint config.
Not 100% convinced that it's worth the effort of making a braking change for this.

[prymitive]

I think the best way forward here is to get rid of checks being "online" or "offline" ones and instead --offline flag will disable API queries, checks that try to use Prometheus API can then decide what to do when API queries are no available. That way a single check can have both online and offline logic and simply skip some steps that require API calls.