Alerting when 2 conditions are met and only when both are met

InfluxDB 1 Kapacitor
,
1

Hi community!

I’m trying to achieve something with a TICK script and have hit a brick wall in trying to get it to work (it seems to fire alerts but intermittently). Hopefully someone can help…

I have 1 single measurement called ‘CitrixLoginSim’ - The measurement contains 3 pieces of information i want to work with.

Success :- this is either a 1 (OK) or a 0 (NOT OK).
LoginTime :- Average time to login to a Citrix environment.
ServerTagName :- the names of the two systems that are sending data into this measurement. These are ‘Manchester’ and ‘Newcastle’.

What i want to achieve:

Right now i alert when one of the systems reports a 0 for a failure. This is causing some flapping as we’ve realised that ONE of these systems reporing a failure doesnt nessacarilly mean the citrix environment is down.

What i want to do is write a script that will check both of these servers and continue to do so unless both Manchester and Newcastle both come back with a 0 for the same time frame. If they both report a 0 then it is a safe bet the Citrix environment is down.

I wrote a bit of a script to do this but i don’t know if i’m headed in the right direction. I’ve basically queried the database for the records with either of those two tag values and used a lambda expression to basically say

If Manchester = 0 AND Newcastle = 0 then the result is 2. Then the alert works on whether or not the alert value reaches 2. Granted it isn’t written like the above but i’ve included the code from my script.

var data = stream
    |from()
        .database(db)
        .retentionPolicy(rp)
        .measurement(measurement)
        .groupBy(groupBy)
        .where(whereFilter)
    |eval(lambda: "Success")
        .as('value')

var trigger = data
    |eval(lambda: if("ServerTagName" == 'Manchester' AND "ServerTagName" == 'Newcastle' AND "value" == 0, 1, 2))
        .as('result')
    |alert()
        .crit(lambda: "result" == 2)
        .stateChangesOnly()
        .message(message)
        .id(idVar)
        .idTag(idTag)
        .levelTag(levelTag)
        .messageField(messageField)
        .durationField(durationField)
        .email('myeamil@domain.co.uk')

Can anybody offer any suggestions or advice on this? is it possible or am i completely off?

Appreciate any help given, thanks

PhilB