Hello. I’ve been working on setting up a few deadman alerts and now have found that relative alerts would be beneficial to my goals of determining if one of my processes (out of many) is not running optimally in comparison to previous periods. What I have determined is to base this off the time it is normally allowed to be “quiet” as well.
Thus far my difficulty has proven to be getting two streams (batches may be better, but another complication). One stream(or batch) must be the current value of the field, the second must be the value of the previous 7 days, with some math to round it to the nearest allowed “quiet” period as well (lets say 10 mintues). Here is what I’ve worked up thus far:
var db = ‘db’
var rp = ‘rp’
var measurement = ‘measurement’
var groupBy = [‘host’, ‘topic’]
var whereFilter = lambda: (“topic” == ‘test_test’)
var divisor = 1008
var offsetWhereFilter = lambda: (“topic” == ‘test_test’) AND time > now() - 14d AND time < now() - 7d
var name = ‘Relative Alert’
var idVar = name
var message = ‘’
var idTag = ‘alertID’
var levelTag = ‘level’
var messageField = ‘message’
var durationField = ‘duration’
var outputDB = ‘chronograf’
var outputRP = ‘autogen’
var outputMeasurement = ‘alerts’
var triggerType = ‘relative’
var crit = 20 //minimum percentage of allowed change
var data = stream
|from()
.database(db)
.retentionPolicy(rp)
.measurement(measurement)
.groupBy(groupBy)
.where(whereFilter)
|eval(lambda: “attr_value”)
.as(‘value’)var past = stream
|from()
.database(db)
.retentionPolicy(rp)
.measurement(measurement)
.groupBy(groupBy)
.where(offsetWhereFilter)
|eval(lambda: “attr_value” / divisor)
.as(‘pastValue’)var old = past
var current = data
var trigger = old
|join(current)
.as(‘past’, ‘current’)
|eval(lambda: float(“past.value” - “current.value”) / float(“past.value”) * 100.0)
.keep()
.as(‘newValue’)
|alert()
.crit(lambda: “newValue” > crit)
.stateChangesOnly()
.message(message)
.id(idVar)
.idTag(idTag)
.levelTag(levelTag)
.messageField(messageField)
.durationField(durationField)trigger
|eval(lambda: float(“value”))
.as(‘value’)
.keep()
|influxDBOut()
.create()
.database(outputDB)
.retentionPolicy(outputRP)
.measurement(outputMeasurement)
.tag(‘alertName’, name)
.tag(‘triggerType’, triggerType)trigger
|httpOut(‘output’)
This is the first problem I’ve run into thus far
invalid TICKscript: unsupported literal type func(time.Duration, …time.Duration) (kapacitor.TimeDimension, error)
from this line…
var offsetWhereFilter = lambda: (“beanTopic” == ‘test_test’) AND time > now() - 14d AND time < now() - 7d
There’s likely more that could be corrected in the script, but I’m not sure how to get past this first issue yet.