Extreme Values during threshold alert

InfluxDB 1 Kapacitor
1

Hey folks,

I’am quite new to influxDB and i am having difficulties with alerting.

I successfully implemented alerting based on thresholds.
So far so good. But I have no idea how to set my alerts up to get the extreme Values (on LevelReset)

What i want to do:

  • Alert me imeedialely (no window) if a Value exceeds threshold [works already] (e.g level is below 49)
    • i get noitified via pushover about the alert [works already] “Attention value is 48.85”
  • I want to get notified if the alert cleared and the value is above 50 again [works already] “Value is good again 50.02”
  • What i really want to know [dont know how to implement it]
    “Value is good again 50.02 extreme Value was 45.88”

As you can see, i get alerted if the value exceeds the threshold, but i do not get the absolute extreme value of the anomaly.

Do you guys have any information for me on this topic?

var db = 'homeassistant'

var rp = 'autogen'

var measurement = 'Hz'

var groupBy = []

var whereFilter = lambda: ("entity_id" == 'frequency') AND isPresent("value")

var name = 'Frequenz crit'

var idVar = name

var message = ' {{.Level}}  {{ index .Fields "value" }} {{.Time}}'

var idTag = 'alertID'

var levelTag = 'level'

var messageField = 'message'

var durationField = 'duration'

var outputDB = 'chronograf'

var outputRP = 'autogen'

var outputMeasurement = 'alerts'

var triggerType = 'threshold'

var lcrit = 49.85

var ucrit = 50.15

var lwarn = 49.9

var uwarn = 50.1

var lok = 49.95

var uok = 50.05

var data = stream
    |from()
        .database(db)
        .retentionPolicy(rp)
        .measurement(measurement)
        .groupBy(groupBy)
        .where(whereFilter)
    |eval(lambda: "value")
        .as('value')

var trigger = data
    |alert()
        .crit(lambda: "value" < lcrit OR "value" > ucrit)
        .critReset(lambda: "value" > lwarn AND "value" < uwarn)
        .warn(lambda: "value" < lwarn OR "value" > uwarn)
        .warnReset(lambda: "value" > lok AND "value" < uok)
        .message(message)
        .id(idVar)
        .idTag(idTag)
        .levelTag(levelTag)
        .messageField(messageField)
        .durationField(durationField)
        .stateChangesOnly()
        .pushover()
        .device('xperiaz3')
        .title('AbNormal Frequency ')

trigger
    |eval(lambda: float("value"))
        .as('value')
        .keep()
    |influxDBOut()
        .create()
        .database(outputDB)
        .retentionPolicy(outputRP)
        .measurement(outputMeasurement)
        .tag('alertName', name)
        .tag('triggerType', triggerType)

trigger
    |httpOut('output')
2

Hello @Spyman,
Welcome!
You’re new to InfluxDB but you’re using 1.x and kapacitor? May I ask why?
Have you considered using 2.x? This type of alerting would be easy with 2.x.

I’m not sure how to help here. I think you’d have to write alert values to a new database so you could gather the last good value and join it. I can ask someone on the kapacitor team…or we can solve this with 2.x? I’m sorry I’m not much more help. I’m not too familiar with kapacitor and TICKscripts.

3

Hey thanks for your quick reply. I just used what’s default within homeassistant. I never really cared about it. If you could assist with 2.0 I could try to migrate to 2.0

I use influx as a default where all values are stored. I set Grafana up on it that’s it. Nothing really fancy so chances are great that I would be able to upgrade

4

Just a quick update. I kindof worked around it.

I combined the alerts that i had (see code) with 2 new alerts.
Those two alerts don’t eval the value, they simply min(value).as(value)
and max(value).as(value)
for a windowed (5min window) data set.

so therefore i get the extremes (at the latest roundabout 5 minutes or earlier after the official threshold breaking event) but then with the absolute minimum / maximum information (from the last 5 minutes)