Kapacitor Tick script where condition

Hi,

I want to exclude the variable name team1 and value as value1 or value2 in the tick script alert.

So I have tried two options . But I see different results and not sure which one is right option . Please guide.

Option 1:
var where_filter = lambda: “team1” = ‘value1’ OR “team1” = ‘value2’
| where(where_filter)

Option 2:

var where_filter = lambda: “team1” = 'value1’
var where_filter1 = lambda: “team1” = ‘value2’
| where(where_filter)
| where(where_filter1)

@errishma

If I understand correctly, you want to filter out any data that has "team1" = 'value1' or "team1" = 'value2'.

To express this in tickscript you’d do the following

|where(lambda: "team1" != 'value1' AND  "team1" != 'value2')

Thanks Michael.
Yes, your understanding is right.

Should not it be OR between team1 conditions?

No results are seen with this condition .

No results are seen with this condition .

Do you mean that is works as expected?

I just verified that it works myself

stream
    |from()
        .measurement('m')
    |where(lambda: "team1" != 'value1' AND "team1" != 'value2')
    |log()

writing data

> insert m team1="value1"
> insert m team1="value2"
> insert m team1="value3"
> insert m team1="value4"
TICKscript:
stream
    |from()
        .measurement('m')
    |where(lambda: "team1" != 'value1' AND "team1" != 'value2')
    |log()

DOT:
digraph ex {
graph [throughput="0.00 points/s"];

stream0 [avg_exec_time_ns="0s" errors="0" working_cardinality="0" ];
stream0 -> from1 [processed="4"];

from1 [avg_exec_time_ns="0s" errors="0" working_cardinality="0" ];
from1 -> where2 [processed="4"];

where2 [avg_exec_time_ns="29.496µs" errors="0" working_cardinality="1" ];
where2 -> log3 [processed="2"];

log3 [avg_exec_time_ns="0s" errors="0" working_cardinality="0" ];
}

Note

...
from1 -> where2 [processed="4"];
...
where2 -> log3 [processed="2"];
....
1 Like

Hmm. Not sure why this condition is not working here .

I think I don’t see any results because I have all other logs those don’t have team1 variable .if I need to include the condition like team1 is null or empty along with this condition , please guide how can I do that .

Not sure I follow what the issue is.

Can you give me the tickscript and some example data.

So here is the example

  • I have 3 servers where 2 servers have telegraf.conf with global_tags
    server1 -
    team1 = value1
    server2 -
    team1 = value2
    server3 -
    no tags

So when I put the condition as shown in tick script, it does not show the results.

var WARN_THRESHOLD = 5
var CRIT_THRESHOLD = 6
var period = 10s
var every = 10s
var where_filter = lambda: “team1” !~ /.*/ OR (“team1” != ‘value1’ AND “team1” != ‘value2’)

stream
|from().database(‘telegraf’).measurement(‘disk’).groupBy(‘host’,‘path’)
|where(where_filter)

|window()
.period(period)
.every(every)
|mean(‘used_percent’).as(‘mean’)
|alert()
.id(’{{ index .Tags “path” }}-{{ index .Tags “host” }}’)

.warn(lambda: “mean” > WARN_THRESHOLD)
.crit(lambda: “mean” > CRIT_THRESHOLD)

.log(’/tmp/disk_usage1.log’)

I think this is the problem. What you’re saying where is filter out anything that has "team1" defined.

Right , I tried couple of option but nothing worked . Not sure how should I write this condition .

Please guide , how should I specify the condition as

Server1:

Global tags : team1 = value1

Server2:
Team1= value2

And server3
No tags.

Ah sorry I had a misunderstanding.

In the 1.3 release of Kapacitor a new function called isPresent will be available that will allow for this type of functionality. The where node will look like this

var where_filter = lambda: !isPresent("team1") OR ("team1" != 'value1' AND "team1" != 'value2')

That release should be available tomorrow.

Thank you Michael.

isPresent is not working probably because of version . :frowning: . Below is the error.

[disk_utilization_influx:where3] 2017/05/19 14:30:46 E! error while evaluating expression: undefined function: “isPresent”

Upgrading the version would be tough as we are sending the data over tcp to Fluentd directly in a particular format. Not sure how it would work with upgraded version.

Please guide.

Version 1.3 is currently unreleased.