If I use in .json file as below it shows me the error on enabling : enabling task disk_ect: Failed to compile 0 expression: Given node type is not valid evaluation node: *ast.IdentifierNode
var measurement string
// Optional where filter
var where_filter = lambda: TRUE
// Optional list of group by dimensions
var groups = [*]
// Which field to process
var field string
// Warning criteria, has access to ‘mean’ field
var warn lambda
// Critical criteria, has access to ‘mean’ field
var crit lambda
// How much data to window
var window = 5m
stream
|from()
.measurement(measurement)
.groupBy(groups)
|eval(lambda: “team”)
.as(‘team1’)
.keep()
.quiet()
|where(where_filter)
|window()
.period(window)
.every(window)
|mean(field).as(‘mean’)
|alert()
.id(’{{ index .Tags “path” }}-{{ index .Tags “host” }}’)
.details(’{{ .ID }} is {{ .Level }} Current average Disk Utilization value past 15m is: {{ index .Fields “mean” }} exceeds threshold of {{ if eq .Level “WARNING” }} 90% with Severity:2 {{ else
if eq .Level “CRITICAL” }} 95% with Severity:1 {{ end }})’)
.warn(warn)
.crit(crit)
Thanks, that script does not have a var named eval_field did you mean to do something like this
var measurement string
// Optional where filter
var where_filter = lambda: TRUE
// Optional list of group by dimensions
var groups = [*]
// Which field to process
var field string
// Warning criteria, has access to 'mean' field
var warn lambda
// Critical criteria, has access to 'mean' field
var crit lambda
// How much data to window
var window = 5m
var eval_field string
stream
|from()
.measurement(measurement)
.groupBy(groups)
|eval(lambda: "team")
.as(eval_field)
.keep()
.quiet()
|where(where_filter)
|window()
.period(window)
.every(window)
|mean(field).as('mean')
|alert()
.id('{{ index .Tags "path" }}-{{ index .Tags "host" }}')
.details('{{ .ID }} is {{ .Level }} Current average Disk Utilization value past 15m is: {{ index .Fields "mean" }} exceeds threshold of {{ if eq .Level "WARNING" }} 90% with Severity:2 {{ else
if eq .Level "CRITICAL" }} 95% with Severity:1 {{ end }})')
.warn(warn)
.crit(crit)