Only send alert if later than and earlier than

1

Hi

I set up an alert using the Chronograph UI, but I only want to send it between 5PM and 10PM. I understand this is not possible with the UI, but how can I achieve it with the Tickscript? This is what Chronograph automatically created. Where do I have to define the times? In the where filter?

var db = 'DBNAME'

var rp = 'autogen'

var measurement = 'device_frmpayload_data_co2_ppm'

var groupBy = ['device_name']

var whereFilter = lambda: ("dev_eui" != 'SERIAL' OR "dev_eui" != 'SERIAL' OR "dev_eui" != 'SERIAL')

var name = 'ppm > 800'

var idVar = name + '-{{.Group}}'

var message = 'Alert {{ index .Tags "device_name" }} - CO2 is {{.Level}}'

var idTag = 'alertID'

var levelTag = 'level'

var messageField = 'message'

var durationField = 'duration'

var outputDB = 'chronograf'

var outputRP = 'autogen'

var outputMeasurement = 'alerts'

var triggerType = 'threshold'

var details = 'HTML data'

var crit = 800

var data = stream
|from()
    .database(db)
    .retentionPolicy(rp)
    .measurement(measurement)
    .groupBy(groupBy)
    .where(whereFilter)
|eval(lambda: "value")
    .as('value')

var trigger = data
|alert()
    .crit(lambda: "value" > crit)
    .message(message)
    .id(idVar)
    .idTag(idTag)
    .levelTag(levelTag)
    .messageField(messageField)
    .durationField(durationField)
    .details(details)
    .email()
    .to('EMAIL')

trigger
|eval(lambda: float("value"))
    .as('value')
    .keep()
|influxDBOut()
    .create()
    .database(outputDB)
    .retentionPolicy(outputRP)
    .measurement(outputMeasurement)
    .tag('alertName', name)
    .tag('triggerType', triggerType)

trigger
|httpOut('output')

I left out some personal details.

Thanks!
Regards,
Bert

2

Hello, you can do this with the alert node in Kapacitor.

There is an example in the deadman section of this link Alert Node

I think if you update this line

.crit(lambda: "value" > crit)

to the following, you should get the result you want

.crit(lambda: "value" > crit AND hour("time") >= 8 AND hour("time") <= 17)

You just need to adjust the time values to suit your needs.

Hope that helps.

1 Like
3

Thanks for your update.
I tested this with

.crit(lambda: "value" > crit AND hour("time") >= 14 AND hour("time") <= 15)

even changed it to

.crit(lambda: "value" > crit AND hour("time") >= 14 AND hour("time") < 15)

But after 15h I still receive alerts.

4

I think only the “OK” value - normally sent after the value is normal again are sent after 15h

5

Solved it by sending the messages to a topic and only match level = CRITICAL

7

sorry for the delay, I haven’t been on as much. glad you got it sorted :slight_smile:

8

have you tried a similar lambda expression with the time filter in the .critReset() or the .info() properties of alert ?

I use this code snippit to alert based on different thresholds for different times of day. So I can have different ok,warn,crit thresholds for standard times and exception times. This means I can tune the alerts per time of day.
Starttime_of_standard_alerting and endtime_of_standard_alerting are integer values representing hours eg. 9 and 17 to alert during the day.

|alert()
    .crit(lambda: ("value" >= standard_critical_threshold AND (hour("time") >= starttime_of_standard_alerting AND hour("time") < endtime_of_standard_alerting)) OR
        ("value" >= exception_critical_threshold AND (hour("time") < starttime_of_standard_alerting OR hour("time") >= endtime_of_standard_alerting)))
    .warn(lambda: ("value" >= standard_warning_threshold AND (hour("time") >= starttime_of_standard_alerting AND hour("time") < endtime_of_standard_alerting)) OR
        ("value" >= exception_warning_threshold AND (hour("time") < starttime_of_standard_alerting OR hour("time") >= endtime_of_standard_alerting)))
    .warnReset(lambda: ("value" < standard_warning_threshold AND (hour("time") >= starttime_of_standard_alerting AND hour("time") < endtime_of_standard_alerting)) OR
        ("value" < exception_warning_threshold AND (hour("time") < starttime_of_standard_alerting OR hour("time") >= endtime_of_standard_alerting)))