Hi ,
I would like to check for multiple conditions and if any one them is true i would like to do some post.
Here is the snippet of the code.
data
|eval(lambda: "hourlyAverage.usage_user" - "weeklyMinimum.usage_user")
.as('1h_avg-7d_min')
.keep()
|eval(lambda: "weeklyAverage.usage_user" - "weeklyMinimum.usage_user")
.as('7d_avg-7d_min')
.keep()
|eval(lambda: "hourlyAverage.usage_user" - "customAverage.usage_user")
.as('1h_avg-1h_custom_avg')
.keep()
|eval(lambda: "customAverage.usage_user" - "weeklyMinimum.usage_user")
.as('1h_custom_avg-7d_min')
.keep()
|eval(lambda: "hourlyAverage.usage_user" - "weeklyMinimum.usage_user")
.as('1h_avg-7d_min')
.keep()
|eval(lambda: float("1h_avg-7d_min") - 1.5 * float("7d_avg-7d_min"))
.as('Rule1')
.keep()
|eval(lambda: float("1h_avg-1h_custom_avg") / float("1h_custom_avg-7d_min"))
.as('Rule2')
.keep()
|eval(lambda: float("1h_avg-7d_min") - 3.0 * float("7d_avg-7d_min"))
.as('Rule3')
.keep()
|eval(lambda: float("1h_avg-1h_custom_avg") / float("1h_custom_avg-7d_min"))
.as('Rule4')
.keep()
|eval(lambda: float("1h_avg-7d_min") - 0.5 * float("7d_avg-7d_min"))
.as('Rule5')
.keep()
data
|alert()
.crit(lambda: "Rule5" > 0.0)
.message(message)
.messageField(messageField)
.durationField(durationField)
.post('http://192.168.0.5:3123')
.header('Content-type', 'application/json')
|httpOut('step8')
data
|alert()
.crit(lambda: "Rule1" > 0.0)
.message(message)
.messageField(messageField)
.durationField(durationField)
.post('http://192.168.0.5:3123')
.header('Content-type', 'application/json')
data
|alert()
.crit(lambda: "Rule2" > 2.0)
.message(message)
.messageField(messageField)
.durationField(durationField)
.post('http://192.168.0.5:3123')
.header('Content-type', 'application/json')
data
|alert()
.crit(lambda: "Rule3" > 0.0)
.message(message)
.messageField(messageField)
.durationField(durationField)
.post('http://192.168.0.5:3123')
.header('Content-type', 'application/json')
data
|alert()
.crit(lambda: "Rule4" > 5.0)
.message(message)
.messageField(messageField)
.durationField(durationField)
.post('http://192.168.0.5:3123')
.header('Content-type', 'application/json')
Firstly does this script check for all the alerts every single time it runs ? Is this is a good way of doing or is there a better to check for multiple conditions for the alert ? It would also be nice to know which rule is creating the alert out of all the rules ?