last pipe doesn't work with vmalert

[Sleuth56]

Describe the bug

When using the last pipe in vmalert no data is returned.

To Reproduce

Use the following logsql query in a vmalert rule. This query works just fine in VMUI/Grafana but returns no data in vmalert. This is likely do to the start and end fields in vmalert's queries.
* | last 1

Version

logs: 1.148.0
vmalert: v1.139.0

[cuongleqq]

Hi, for vmalert, the query needs to end with a stats pipe, for example | stats count(*), so the result can be converted into a time series for alerting / recording in Victoria Metrics.

Because of that, * | last 1 is not a valid vmalert rules. See the document here

However, I tried reproduce this locally, when I used * | last 1 in a vmalert rule, vmalert does not return "no data". It failed immediately & rejected the rule as invalid.

So I am not fully sure whether your case is the same one. Could you clarify:

1. Does your vmalert actually start successfully with that rule?
2. What exactly do you mean by "returning no data"?

[valyala]

@Sleuth56 , VictoriaLogs allows using the last pipe in queries to /select/logsql/stats_query and /select/logsql/stats_query_range. I added tests, which verify this - see d5b5feb .

If vmalert doesn't allow using last pipe, then this is the bug at vmalert side, which must be fixed. @Haleygo , could you investigate and fix this issue?

[func25]

@valyala vmalert already supports last after a stats pipe, for example * | stats by (x) count() q | last 1 by (q). But the reported query is * | last 1, which still isn't a valid vlogs rule for vmalert.

The need more info label is added because more information is required to determine whether the author reported the wrong query.

[valyala]

Probably @Sleuth56 assumed the limit pipe. It should be safe to use it in alerting rules. Added support for this pipe in alerting rules in the commit c317b93 . This commit will be included in the next release.