I have a measurement which I want to stream process in Kapacitor. The measurment contains 6 fields that I want to alert on if any of them increment between time intervals.
I see 2 options here:
- Having a single task with a branch->process->join pattern
- Having a template task with 6 instances
The 1st option would definitely be less elegant. However there is quite a lot of ingress stream data and other tasks running so minimizing the overhead is a concern as well. Which option would you recommend? Or something completely different?
If you need to join the data then option #1 is the only valid option. If you can treat them independently then option #2 will work well. The overhead of multiple nodes versus multiple tasks is minimal.
On the other hand if you do discover that the per task overhead is causing issues please do let us know, but I expect it won’t, lots of work has gone into reducing the per task cost.
They can be treated independently and I built a template around it.
A colleague had an idea of extending the difference etc. operator to work on multiple values similar to eval, like this:
|difference(‘rlat_gt_4s’, ‘rlat_lte_4s’, ‘rlat_lte_1s’, ‘wlat_gt_4s’, ‘wlat_lte_4s’, ‘wlat_lte_1s’).as(‘rlat_gt_4s_count’, ‘rlat_lte_4s_count’, ‘rlat_lte_1s_count’, ‘wlat_gt_4s_count’, ‘wlat_lte_4s_count’, ‘wlat_lte_1s_count’)
This would make it a bit more manageable, having to deal with a single file with the definition instead of the template and multiple JSON files. Templates just feel like a bit of overkill for this type of a use case.
