influxdata / influxdata/kapacitor

Add a new alert node property method to match all points to reset alert.

Open
#1,862 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.4k
Forks
479
Avg merge
4d 16h
Merged PRs (30d)
4

Description

Based on discussion on #1859, I'd like to suggest to add a feature.

Alert node needs a property method which matches all points to reset alert.

So all points should be matched to reset the alert not just 1 of them.
Simply it equivalents `.all` property method but for resting the alert.

For example, in some use cases when the joined sources have more than 1 point, it will be hard to join min as a single point.

```
var threshold = 80

// This returns 5 points.
var source01 = batch
|query('''
SELECT percentile("used_percent", 95.0) AS "used_percent"
FROM "telegraf"."autogen"."mem"
''')
.groupBy(time(1m), 'host')
.period(5m)
.every(2m)
.fill('none')

// This returns 1 point, which is the `min` point in 5 min.
var min = source01
|min('used_percent')
.as('used_percent')
|window()
.period(1m)
.every(1m)

// This returns 1 point, which is the `max` point in 5 min.
var max = source01
|max('used_percent')
.as('used_percent)
|window()
.period(1m)
.every(1m)

var data = min
|join(max)
.as('min', 'max')
|eval(lambda: "min.used_percent", lambda: "max.used_percent")
.as('used_percent_min', 'used_percent_max')
|alert()
.warn(lambda: "used_percent_min" > threshold)
.warnReset(lambda: "used_percent_max" < threshold)
```

As you see here, on one hand, that needs more work to be achieved, and on the other hand, not all points are included in the alert (we here just have 2 point out of 5)

My suggestion is something exactly like `.all()` property method but for reset.

```
var threshold = 80

// This returns 5 points.
var source01 = batch
|query('''
SELECT percentile("used_percent", 95.0) AS "used_percent"
FROM "telegraf"."autogen"."mem"
''')
.groupBy(time(1m), 'host')
.period(5m)
.every(2m)
.fill('none')
|alert()
.all()
.resetOnAll()
.warn(lambda: "used_percent" > threshold)
```

Thanks.

Contributor guide

Open the contributing guide

Research direction

Start with the alert node and its existing .all() property method, then trace how warnReset handles joined points. Compare the proposed resetOnAll() behavior against the example's five-point stream; done means all points must satisfy the reset condition before the alert resets, with coverage for the multi-point case.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.