Combine after groupBy

InfluxDB 1 Kapacitor
1

I have an InfluxDB measurement that contains a count of events sent by each host. This measurement is populated with telegraf so each row contains the count of events over 10s for a host. When a host sends no events a zero is added to the measurement. Using Kapacitor, I want to alert when 0 events were recorded by n number of hosts over a period of time.

I’ve started with something like this:

var window_period = 150s
var window_every = 10

var data = stream
  |from()
    .measurement('events')
    .groupBy('host')
  |window()
    .period(window_period)
    .every(window_every)
    .align()
  | sum('event_count')
      .as('event_count')

That gets me the sum of events over an arbitrary window for each host. But now I want to see how many of those have an event_count == 0 and if that is greater than 4 then send an alert.

The documentation say that after a groupBy the groups are processed independently. I was hoping that I could combine them back together someone into a series of points where I could then do

data
    | someMagicalUngroupingNode(...)
    | where(lambda: 'event_count' == 0)
    | count('event_count')
    | alert()
      .crit(lambda: "count" >= 4)

But I can see no way to combine after a groupBy. Is there way that I’m missing? Perhaps there is a way to sum events without using a groupBy, preventing independent pipelines and allowing my second code sample to work?

1 Like