influxdata / influxdata/kapacitor
Add a new alert node property method to match all points to reset alert.
- Dominant language
- Go
- Stars
- 2.4k
- Forks
- 479
- Avg merge
- 4d 16h
- Merged PRs (30d)
- 4
Description
Based on discussion on #1859, I'd like to suggest to add a feature.
Alert node needs a property method which matches all points to reset alert.
So all points should be matched to reset the alert not just 1 of them.
Simply it equivalents `.all` property method but for resting the alert.
For example, in some use cases when the joined sources have more than 1 point, it will be hard to join min as a single point.
```
var threshold = 80
// This returns 5 points.
var source01 = batch
|query('''
SELECT percentile("used_percent", 95.0) AS "used_percent"
FROM "telegraf"."autogen"."mem"
''')
.groupBy(time(1m), 'host')
.period(5m)
.every(2m)
.fill('none')
// This returns 1 point, which is the `min` point in 5 min.
var min = source01
|min('used_percent')
.as('used_percent')
|window()
.period(1m)
.every(1m)
// This returns 1 point, which is the `max` point in 5 min.
var max = source01
|max('used_percent')
.as('used_percent)
|window()
.period(1m)
.every(1m)
var data = min
|join(max)
.as('min', 'max')
|eval(lambda: "min.used_percent", lambda: "max.used_percent")
.as('used_percent_min', 'used_percent_max')
|alert()
.warn(lambda: "used_percent_min" > threshold)
.warnReset(lambda: "used_percent_max" < threshold)
```
As you see here, on one hand, that needs more work to be achieved, and on the other hand, not all points are included in the alert (we here just have 2 point out of 5)
My suggestion is something exactly like `.all()` property method but for reset.
```
var threshold = 80
// This returns 5 points.
var source01 = batch
|query('''
SELECT percentile("used_percent", 95.0) AS "used_percent"
FROM "telegraf"."autogen"."mem"
''')
.groupBy(time(1m), 'host')
.period(5m)
.every(2m)
.fill('none')
|alert()
.all()
.resetOnAll()
.warn(lambda: "used_percent" > threshold)
```
Thanks.
Contributor guide
Research direction
Start with the alert node and its existing .all() property method, then trace how warnReset handles joined points. Compare the proposed resetOnAll() behavior against the example's five-point stream; done means all points must satisfy the reset condition before the alert resets, with coverage for the multi-point case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- observability-sre
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100