Kapacitor alert node ability to evaluate formulas

1

In Kapacitor we have the message property method that, according to the documentation uses a “template” to construct a meaningful message.

From the documentation example, we have:

stream…
.groupBy(‘service’, ‘host’)
.alert()
.id(‘{{ index .Tags “service” }}/{{ index .Tags “host” }}’)
.message(‘{{ .ID }} is {{ .Level}} value: {{ index .Fields “value” }}’)
If the “service” tag contains: ‘authentication’, the “host” tag contains: server123.domain.com, the Level is set to Critical and the “value” field contains 53, then the message is built as:
‘authentication/server123.domain.com is CRITICAL value:53’

Is it possible to use the Lambda functions to build any of the nodes?

Say I need to replace server123.domain.com with device123.domain.com, then by using :

RegexReplace(/server([0-9]+).domain.com/, “host”, ‘device$1.domain.com’). This returns the desired:
device123.domain.com content.

Then the idea is to have the message to contain:

‘authentication/device123.domain.com is CRITICAL value:53’

Thus, .Id must be something like:

.id(‘{{ index .Tags “service” }}/ RegexReplace(/server([0-9]+).domain.com/, “host”, ‘device$1.domain.com’)’) or similar.

Another example:
Say we need .message to contain the upper case version of a field, then something like:

.message(strToUpper(“field_with_lowercase_text”))

2

I think a workaround is to use eval and assign the temporary value to an extra InfluxDb Field, making sure to use .keep to preserve the value.

3

As you said, prepare the variables before .alert(). Then use those new fields and tags in the template.

So, read host, use the string functions of the lambda expression (doc link below) and save it to a new field and tag name with .as(‘renamed_host’) and .tags(‘renamed_host’). The message template has access to the fields so you can probably do {{ index .Fields “renamed_host” }}. The Id only has access to the tags so {{ index .Tags “renamed_host” }}.

Documentation :