How to check last n continue value

[haowells]

want to check cpu usage value for last 3 data sample ponits, when all of these data points match condition, then tirgger alarm. how to write it ?

var data = stream.from().measurement('cpu')
var data = data.where(lambda: hour("time") >= 10 AND hour("time") <= 17)

data
.groupBy('host', 'cpu')
//.window()
// .period(20s)
// .every(10s)
.eval(lambda: 100.0 - "usage_idle").as('used')
.alert()
.id('{{ .Name}}/{{ index .Tags "host" }}/{{ index .Tags "cpu"}}')
.message('this is msg')
.details('this is detail')
.warn(lambda: "used" > 80.0)
//.crit(lambda: "used" > 90.0)
.log('/tmp/alarms.log')
//.stateChangesOnly()var data = stream.from().measurement('cpu')
var data = data.where(lambda: hour("time") >= 10 AND hour("time") <= 17)
//var data = data.where(lambda: "cpu" == 'cpu1')
//var data_jq = stream.from().measurement('cpu').where(lambda: "dc" == 'jq')
//var data_njq = stream.from().measurement('cpu').where(lambda: "dc" != 'jq')

[nathanielc]

Right now there is a way to do this but its a bit complex, more details below. What you really want is a way to tell the alert node how to treat of window of data. Right now it is hard coded to trigger an alert if any point matches instead of all. This should be easy to change and add a property to the alert node.

Something like this:

stream.from()...
.window()
   .period(20s)
   .every(10s)
 .alert()
   .all()// Only fire alert if all points in a window match
   .warn(lambda: "used" > 80.0)
   .crit(lambda: "used" > 90.0)
   .all()

Here is a workaround which involves counting the number of points in a window before and after the condition is applied.

var data = stream.from()...
.window()
   .period(20s)
   .every(10s)

var origCount = data.mapReduce(influxql.count('used'))
var filteredCount = data.where(lambda: "used" > 90).mapReduce(influxql.count('used'))

origCount.join(filteredCount)
     .as('orig', 'filtered')
     .alert()
         .crit(lambda: "orig.count" == "filtered.count")

Obviously overly complex and not good idea. Will definitely add the .all property to the alert node.

[hrzbrg]

I am also looking for something like this :)

Related: Can I compute the MEAN over a given time interval to alert only, if the MEAN is above a threshold? For example I would like to look at the MEAN over the last 5 minutes.

[nathanielc]

@hrzbrg Using a time interval is possible and quite easy to do. Counting specific points is not so easy at the moment.

Example:

stream.from()...
    .window()
         .period(5m)
         .every(5m)
    .mapReduce(influxql.mean('value'))
    .alert()
         .crit(lambda: "mean" > 10)

[haowells]

@nathanielc
I can not find .all property in here, not updated in doc?
https://docs.influxdata.com/kapacitor/v0.10/tick/alert_node/

[nathanielc]

@haowells Its not implemented yet. My example is a proposed solution.

[xaon2017]

but the value when the alarm is restored is the value when the alarm is triggered.