filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system")
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") Comments
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") Named Arguments
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") String Literals
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") Buckets, not DBs
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") Duration Literal
filter that by the last hour |> range(start:2018-11-07T00:00:00Z) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") Time Literal
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") Pipe forward operator
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => r._measurement == "cpu" and r._field == "usage_system") Anonymous Function
filter that by the last hour |> range(start:-1h) // filter further by series with a specific measurement and field |> filter(fn: (r) => (r._measurement == "cpu" or r._measurement == “cpu") and r.host == “serverA") Predicate Function
A west free 2018-06-14T09:15:00 10 mem A west free 2018-06-14T09:14:50 11 _measurement host region _field _time _value mem B west free 2018-06-14T09:15:00 20 mem B west free 2018-06-14T09:14:50 22 _measurement host region _field _time _value cpu A west usage_user 2018-06-14T09:15:00 45 cpu A west usage_user 2018-06-14T09:14:50 49 _measurement host region _field _time _value cpu A west usage_system 2018-06-14T09:15:00 35 cpu A west usage_system 2018-06-14T09:14:50 38
region _field _time _valu e mem A west free 2018-06- 14T09:1 10 mem A west free 2018-06- 14T09:1 11 _meas ureme host region _field _time _valu e mem B west free 2018-06- 14T09:15 20 mem B west free 2018-06- 14T09:14 22 Input in table form // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:50, start:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> sum()
region _field _time _valu e mem A west free 2018-06- 14T09:1 10 mem A west free 2018-06- 14T09:1 11 _meas ureme host region _field _time _valu e mem B west free 2018-06- 14T09:15 20 mem B west free 2018-06- 14T09:14 22 sum() // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:50, start:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> sum()
from(db:"telegraf") |> range(start:2018-06-14T09:14:50, start:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> sum() _meas ureme host region _field _time _valu e mem A west free 2018-06- 14T09:1 10 mem A west free 2018-06- 14T09:1 11 _meas ureme host region _field _time _valu e mem B west free 2018-06- 14T09:15 20 mem B west free 2018-06- 14T09:14 22 sum() _meas ureme host region _field _time _valu e mem A west free 2018-06- 14T09:1 21 _meas ureme host region _field _time _valu e mem B west free 2018-06- 14T09:15 42
free …14:30 10 mem A west free …14:40 11 mem A west free …14:50 12 mem A west free …15:00 13 _meas host region _field _time _valu mem B west free …14:30 20 mem B west free …14:40 22 mem B west free …14:50 23 mem B west free …15:00 24 // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:30, end:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> window(every:20s) Input
free …14:30 10 mem A west free …14:40 11 mem A west free …14:50 12 mem A west free …15:00 13 _meas host region _field _time _valu mem B west free …14:30 20 mem B west free …14:40 22 mem B west free …14:50 23 mem B west free …15:00 24 window( every:20s) // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:30, end:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> window(every:20s)
free …14:30 10 mem A west free …14:40 11 mem A west free …14:50 12 mem A west free …15:00 13 _meas host region _field _time _valu mem B west free …14:30 20 mem B west free …14:40 22 mem B west free …14:50 23 mem B west free …15:00 24 window( every:20s) // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:30, end:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> window(every:20s) _meas ureme host region _field _time _valu e mem A west free …14:30 10 mem A west free …14:40 11 _meas ureme host region _field _time _valu e mem B west free …14:50 23 mem B west free …15:00 24 _meas ureme host region _field _time _valu e mem B west free …14:30 20 mem B west free …14:40 22 _meas ureme host region _field _time _valu e mem A west free …14:50 12 mem A west free …15:00 13
free …14:30 10 mem A west free …14:40 11 mem A west free …14:50 12 mem A west free …15:00 13 _meas host region _field _time _valu mem B west free …14:30 20 mem B west free …14:40 22 mem B west free …14:50 23 mem B west free …15:00 24 window( every:20s) // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:30, end:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> window(every:20s) _meas ureme host region _field _time _valu e mem A west free …14:30 10 mem A west free …14:40 11 _meas ureme host region _field _time _valu e mem B west free …14:50 23 mem B west free …15:00 24 _meas ureme host region _field _time _valu e mem B west free …14:30 20 mem B west free …14:40 22 _meas ureme host region _field _time _valu e mem A west free …14:50 12 mem A west free …15:00 13 N to M tables
free …14:30 10 mem A west free …14:40 11 mem A west free …14:50 12 mem A west free …15:00 13 _meas host region _field _time _valu mem B west free …14:30 20 mem B west free …14:40 22 mem B west free …14:50 23 mem B west free …15:00 24 // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:30, end:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> group(keys:[“region"])
free …14:30 10 mem A west free …14:40 11 mem A west free …14:50 12 mem A west free …15:00 13 _meas host region _field _time _valu mem B west free …14:30 20 mem B west free …14:40 22 mem B west free …14:50 23 mem B west free …15:00 24 group( keys: [“region”]) // example query from(db:"telegraf") |> range(start:2018-06-14T09:14:30, end:2018-06-14T09:15:01) |> filter(fn: r => r._measurement == “mem" and r._field == “free”) |> group(keys:[“region"]) _meas ureme host region _field _time _valu e mem A west free …14:30 10 mem B west free …14:30 20 mem A west free …14:40 11 mem B west free …14:40 21 mem A west free …14:50 12 mem B west free …14:50 22 mem B west free …15:00 13 mem B west free …15:00 23 N to M tables M == cardinality(group keys)
"slack" lastNotificationTime = from(bucket: "notificatons") |> filter(fn: (r) => r.level == "critical" and r._field == "alert_time") |> group(none:true) |> last() |> recordValue(column:"_value") from(bucket: "alerts") |> range(start: lastNotificationTime) |> filter(fn: (r) => r.level == "critical") // shape the alert data to what we care about in notifications |> renameColumn(from: "_time", to: "alert_time") |> renameColumn(from: "_value", to: "used_percent") // set the time the notification is being sent |> addColumn(key: "_time", value: now()) // get rid of unneeded columns |> drop(columns: ["_start", "_stop"]) // write the message |> map(fn: (r) => r._value = "{r.host} disk usage is at {r.used_percent}%") |> slack.to(config: loadSecret(name: “slack_alert_config”), message: “_value”) |> to(bucket: “notifications")
"slack" lastNotificationTime = from(bucket: "notificatons") |> filter(fn: (r) => r.level == "critical" and r._field == "alert_time") |> group(none:true) |> last() |> recordValue(column:"_value") from(bucket: "alerts") |> range(start: lastNotificationTime) |> filter(fn: (r) => r.level == “critical”) // shape the alert data to what we care about in notifications |> renameColumn(from: "_time", to: "alert_time") |> renameColumn(from: "_value", to: "used_percent") // set the time the notification is being sent |> addColumn(key: "_time", value: now()) // get rid of unneeded columns |> drop(columns: ["_start", "_stop"]) // write the message |> map(fn: (r) => r._value = "{r.host} disk usage is at {r.used_percent}%") |> slack.to(config: loadSecret(name: "slack_alert")) |> to(bucket: “notifications") We have state so we don’t resend
"slack" lastNotificationTime = from(bucket: "notificatons") |> filter(fn: (r) => r.level == "critical" and r._field == "alert_time") |> group(none:true) |> last() |> recordValue(column:"_value") from(bucket: "alerts") |> range(start: lastNotificationTime) |> filter(fn: (r) => r.level == "critical") // shape the alert data to what we care about in notifications |> renameColumn(from: "_time", to: "alert_time") |> renameColumn(from: "_value", to: "used_percent") // set the time the notification is being sent |> addColumn(key: "_time", value: now()) // get rid of unneeded columns |> drop(columns: ["_start", "_stop"]) // write the message |> map(fn: (r) => r._value = "{r.host} disk usage is at {r.used_percent}%") |> slack.to(config: loadSecret(name: "slack_alert")) |> to(bucket: “notifications") Use last time as argument to range
"slack" lastNotificationTime = from(bucket: "notificatons") |> filter(fn: (r) => r.level == "critical" and r._field == "alert_time") |> group(none:true) |> last() |> recordValue(column:"_value") from(bucket: "alerts") |> range(start: lastNotificationTime) |> filter(fn: (r) => r.level == "critical") // shape the alert data to what we care about in notifications |> renameColumn(from: "_time", to: "alert_time") |> renameColumn(from: "_value", to: "used_percent") // set the time the notification is being sent |> addColumn(key: "_time", value: now()) // get rid of unneeded columns |> drop(columns: ["_start", "_stop"]) // write the message |> map(fn: (r) => r._value = "{r.host} disk usage is at {r.used_percent}%") |> slack.to(config: loadSecret(name: "slack_alert")) |> to(bucket: “notifications") Now function for current time
"slack" lastNotificationTime = from(bucket: "notificatons") |> filter(fn: (r) => r.level == "critical" and r._field == "alert_time") |> group(none:true) |> last() |> recordValue(column:"_value") from(bucket: "alerts") |> range(start: lastNotificationTime) |> filter(fn: (r) => r.level == "critical") // shape the alert data to what we care about in notifications |> renameColumn(from: "_time", to: "alert_time") |> renameColumn(from: "_value", to: "used_percent") // set the time the notification is being sent |> addColumn(key: "_time", value: now()) // get rid of unneeded columns |> drop(columns: ["_start", "_stop"]) // write the message |> map(fn: (r) => r._value = "{r.host} disk usage is at {r.used_percent}%") |> slack.to(config: loadSecret(name: "slack_alert")) |> to(bucket: “notifications") Map function to iterate over values
"slack" lastNotificationTime = from(bucket: "notificatons") |> filter(fn: (r) => r.level == "critical" and r._field == "alert_time") |> group(none:true) |> last() |> recordValue(column:"_value") from(bucket: "alerts") |> range(start: lastNotificationTime) |> filter(fn: (r) => r.level == "critical") // shape the alert data to what we care about in notifications |> renameColumn(from: "_time", to: "alert_time") |> renameColumn(from: "_value", to: "used_percent") // set the time the notification is being sent |> addColumn(key: "_time", value: now()) // get rid of unneeded columns |> drop(columns: ["_start", "_stop"]) // write the message |> map(fn: (r) => r._value = "{r.host} disk usage is at {r.used_percent}%") |> slack.to(config: loadSecret(name: "slack_alert")) |> to(bucket: “notifications") String interpolation
"slack" lastNotificationTime = from(bucket: "notificatons") |> filter(fn: (r) => r.level == "critical" and r._field == "alert_time") |> group(none:true) |> last() |> recordValue(column:"_value") from(bucket: "alerts") |> range(start: lastNotificationTime) |> filter(fn: (r) => r.level == "critical") // shape the alert data to what we care about in notifications |> renameColumn(from: "_time", to: "alert_time") |> renameColumn(from: "_value", to: "used_percent") // set the time the notification is being sent |> addColumn(key: "_time", value: now()) // get rid of unneeded columns |> drop(columns: ["_start", "_stop"]) // write the message |> map(fn: (r) => r._value = "{r.host} disk usage is at {r.used_percent}%") |> slack.to(config: loadSecret(name: "slack_alert")) |> to(bucket: “notifications") Send to Slack and record in InfluxDB