I think I don’t see any results because I have all other logs those don’t have team1 variable .if I need to include the condition like team1 is null or empty along with this condition , please guide how can I do that .
I have 3 servers where 2 servers have telegraf.conf with global_tags
server1 -
team1 = value1
server2 -
team1 = value2
server3 -
no tags
So when I put the condition as shown in tick script, it does not show the results.
var WARN_THRESHOLD = 5
var CRIT_THRESHOLD = 6
var period = 10s
var every = 10s
var where_filter = lambda: “team1” !~ /.*/ OR (“team1” != ‘value1’ AND “team1” != ‘value2’)
In the 1.3 release of Kapacitor a new function called isPresent will be available that will allow for this type of functionality. The where node will look like this
var where_filter = lambda: !isPresent("team1") OR ("team1" != 'value1' AND "team1" != 'value2')
Upgrading the version would be tough as we are sending the data over tcp to Fluentd directly in a particular format. Not sure how it would work with upgraded version.