Kapacitor Tick script where condition


I want to exclude the variable name team1 and value as value1 or value2 in the tick script alert.

So I have tried two options . But I see different results and not sure which one is right option . Please guide.

Option 1:
var where_filter = lambda: “team1” = ‘value1’ OR “team1” = ‘value2’
| where(where_filter)

Option 2:

var where_filter = lambda: “team1” = 'value1’
var where_filter1 = lambda: “team1” = ‘value2’
| where(where_filter)
| where(where_filter1)


If I understand correctly, you want to filter out any data that has "team1" = 'value1' or "team1" = 'value2'.

To express this in tickscript you’d do the following

|where(lambda: "team1" != 'value1' AND  "team1" != 'value2')

Thanks Michael.
Yes, your understanding is right.

Should not it be OR between team1 conditions?

No results are seen with this condition .

No results are seen with this condition .

Do you mean that is works as expected?

I just verified that it works myself

    |where(lambda: "team1" != 'value1' AND "team1" != 'value2')

writing data

> insert m team1="value1"
> insert m team1="value2"
> insert m team1="value3"
> insert m team1="value4"
    |where(lambda: "team1" != 'value1' AND "team1" != 'value2')

digraph ex {
graph [throughput="0.00 points/s"];

stream0 [avg_exec_time_ns="0s" errors="0" working_cardinality="0" ];
stream0 -> from1 [processed="4"];

from1 [avg_exec_time_ns="0s" errors="0" working_cardinality="0" ];
from1 -> where2 [processed="4"];

where2 [avg_exec_time_ns="29.496µs" errors="0" working_cardinality="1" ];
where2 -> log3 [processed="2"];

log3 [avg_exec_time_ns="0s" errors="0" working_cardinality="0" ];


from1 -> where2 [processed="4"];
where2 -> log3 [processed="2"];
1 Like

Hmm. Not sure why this condition is not working here .

I think I don’t see any results because I have all other logs those don’t have team1 variable .if I need to include the condition like team1 is null or empty along with this condition , please guide how can I do that .

Not sure I follow what the issue is.

Can you give me the tickscript and some example data.

So here is the example

  • I have 3 servers where 2 servers have telegraf.conf with global_tags
    server1 -
    team1 = value1
    server2 -
    team1 = value2
    server3 -
    no tags

So when I put the condition as shown in tick script, it does not show the results.

var period = 10s
var every = 10s
var where_filter = lambda: “team1” !~ /.*/ OR (“team1” != ‘value1’ AND “team1” != ‘value2’)


.id(’{{ index .Tags “path” }}-{{ index .Tags “host” }}’)

.warn(lambda: “mean” > WARN_THRESHOLD)
.crit(lambda: “mean” > CRIT_THRESHOLD)


I think this is the problem. What you’re saying where is filter out anything that has "team1" defined.

Right , I tried couple of option but nothing worked . Not sure how should I write this condition .

Please guide , how should I specify the condition as


Global tags : team1 = value1

Team1= value2

And server3
No tags.

Ah sorry I had a misunderstanding.

In the 1.3 release of Kapacitor a new function called isPresent will be available that will allow for this type of functionality. The where node will look like this

var where_filter = lambda: !isPresent("team1") OR ("team1" != 'value1' AND "team1" != 'value2')

That release should be available tomorrow.

Thank you Michael.

isPresent is not working probably because of version . :frowning: . Below is the error.

[disk_utilization_influx:where3] 2017/05/19 14:30:46 E! error while evaluating expression: undefined function: “isPresent”

Upgrading the version would be tough as we are sending the data over tcp to Fluentd directly in a particular format. Not sure how it would work with upgraded version.

Please guide.

Version 1.3 is currently unreleased.