Kapacitor: How to check last n continue value

Created on 4 Mar 2016 · 6Comments · Source: influxdata/kapacitor

want to check cpu usage value for last 3 data sample ponits, when all of these data points match condition, then tirgger alarm. how to write it ?

var data = stream.from().measurement('cpu')
var data = data.where(lambda: hour("time") >= 10 AND hour("time") <= 17)

data
.groupBy('host', 'cpu')
//.window()
// .period(20s)
// .every(10s)
.eval(lambda: 100.0 - "usage_idle").as('used')
.alert()
.id('{{ .Name}}/{{ index .Tags "host" }}/{{ index .Tags "cpu"}}')
.message('this is msg')
.details('this is detail')
.warn(lambda: "used" > 80.0)
//.crit(lambda: "used" > 90.0)
.log('/tmp/alarms.log')
//.stateChangesOnly()var data = stream.from().measurement('cpu')
var data = data.where(lambda: hour("time") >= 10 AND hour("time") <= 17)
//var data = data.where(lambda: "cpu" == 'cpu1')
//var data_jq = stream.from().measurement('cpu').where(lambda: "dc" == 'jq')
//var data_njq = stream.from().measurement('cpu').where(lambda: "dc" != 'jq')

Source

haowells

Most helpful comment

Right now there is a way to do this but its a bit complex, more details below. What you really want is a way to tell the alert node how to treat of window of data. Right now it is hard coded to trigger an alert if any point matches instead of all. This should be easy to change and add a property to the alert node.

Something like this:

stream.from()...
.window()
   .period(20s)
   .every(10s)
 .alert()
   .all()// Only fire alert if all points in a window match
   .warn(lambda: "used" > 80.0)
   .crit(lambda: "used" > 90.0)
   .all()

Here is a workaround which involves counting the number of points in a window before and after the condition is applied.

var data = stream.from()...
.window()
   .period(20s)
   .every(10s)

var origCount = data.mapReduce(influxql.count('used'))
var filteredCount = data.where(lambda: "used" > 90).mapReduce(influxql.count('used'))

origCount.join(filteredCount)
     .as('orig', 'filtered')
     .alert()
         .crit(lambda: "orig.count" == "filtered.count")

Obviously overly complex and not good idea. Will definitely add the .all property to the alert node.

nathanielc on 4 Mar 2016

👍3

All 6 comments

Something like this:

stream.from()...
.window()
   .period(20s)
   .every(10s)
 .alert()
   .all()// Only fire alert if all points in a window match
   .warn(lambda: "used" > 80.0)
   .crit(lambda: "used" > 90.0)
   .all()

Here is a workaround which involves counting the number of points in a window before and after the condition is applied.

var data = stream.from()...
.window()
   .period(20s)
   .every(10s)

var origCount = data.mapReduce(influxql.count('used'))
var filteredCount = data.where(lambda: "used" > 90).mapReduce(influxql.count('used'))

origCount.join(filteredCount)
     .as('orig', 'filtered')
     .alert()
         .crit(lambda: "orig.count" == "filtered.count")

Obviously overly complex and not good idea. Will definitely add the .all property to the alert node.

nathanielc on 4 Mar 2016

👍3

I am also looking for something like this :)

Related: Can I compute the MEAN over a given time interval to alert only, if the MEAN is above a threshold? For example I would like to look at the MEAN over the last 5 minutes.

hrzbrg on 11 Mar 2016

@hrzbrg Using a time interval is possible and quite easy to do. Counting specific points is not so easy at the moment.

Example:

stream.from()...
    .window()
         .period(5m)
         .every(5m)
    .mapReduce(influxql.mean('value'))
    .alert()
         .crit(lambda: "mean" > 10)

nathanielc on 11 Mar 2016

@nathanielc
I can not find .all property in here, not updated in doc?
https://docs.influxdata.com/kapacitor/v0.10/tick/alert_node/

haowells on 15 Mar 2016

@haowells Its not implemented yet. My example is a proposed solution.

nathanielc on 15 Mar 2016

but the value when the alarm is restored is the value when the alarm is triggered.