|window node and creating tags with |eval()

Hi,

I don’t know if this is an issue or just down to how I’m trying to use Kapacitor templates but…I have noticed something strange when using the |window() node and casting new tags with |eval().

I convert fields to tags in my templates ready for an http endpoint to receive them, which is working fine. hwoever if i add a template with the window node the tags are added to the “columns” section of the output. If i remove the window now the tags appear in the tags section of payload.

|window()
        .period(period)
        .every(every)
        .align()

    |eval(lambda: float("capacity_bytes") / mb,
          lambda: float("capacity_bytes") / mb,
          lambda: string(float("capacity_bytes") / mb), // Var1
          lambda: string(host), // Var2
          lambda: string(source), // Alert Source
          lambda: string(metric), // Metric that triggered the alert
          lambda: string(unit), // unit type %, MB, GB
          lambda: string(module), // Module - Nutanix
          lambda: string(priority) // Alert priority. not to be confused with alert level
          )
        .as('capacity_bytes','capacity_tb','Var1','Var2','Source','Metric','Unit','Module','Priority')
        .tags('Var1','Var2','Source','Metric','Unit','Module','Priority')
        .keep('capacity_bytes','capacity_tb')

I’m not sure why this is happening and was wondering, is this something to do with how the templates work? Am i using |window incorrectly? or is this some kind of weird behviour that shouldn’t be happening? If this is normal, then fair enough. I’d just like to understand why this might be happening.

Thanks

edit: I can provide some log output, but it isn’t very pretty

Hello @philb,
Yes can you please share some logs?
Thank you

Hi @Anaisdg

I’ve put the logs through a JSON validator so its easier to read. BrokenNutanixAlert.txt (2.9 KB) NutanixWorks.txt (3.2 KB)

You’ll be able to see the difference straight away. In the broken log the values for Var1, Var2, Metric, Source, Unit, Priority and Module are all in the columns / values section. The working log file shows these in the Tags section of the payload.

We convert the fields into tags like this because parsing the columns and values in the MS Flow api can be cumbersome, there is a lot of iteration and for each loops that we’d need to use and it impacts performance (run time goes from ~1s to closer to 20s). Sending them in as tags works for us because the tags are easily accessible in the MS flow API.

The only thing I’ve changed in the template is commenting out the |window() node and its properties - proper confused.

If thats the expected behaviour then fair enoughs, I’ll just remove the |window node from my scripts but it does seem odd. Be good to understand why though for future reference.

Thanks

PhilB

Just as an update,

I have another template similar to this one. The difference is the second template alerts on the available stroage and not overall capacity. I get the same behaviour with that template if i add |window()

This is still an issue. I can’t create a deadman alert template and create tags. The period in the deadman is the problem. Same as the other templates and the window node.