influxdata / influxdata/kapacitor
Relative alerts not working
- Dominant language
- Go
- Stars
- 2.4k
- Forks
- 479
- Avg merge
- 4d 16h
- Merged PRs (30d)
- 4
Description
I have never been able to use relative alerts as they dont seem to work.
Here is how my builder looks https://imgur.com/a/jEoaPgL and as you can see there is a spike of way more than 200 and it didnt log it, maybe I am getting this wrong?
And here is the Tickscript generated
```
var db = 'telegraf'
var rp = 'autogen'
var measurement = 'game_stats'
var groupBy = []
var whereFilter = lambda: ("host" == 'public')
var period = 10s
var every = 30s
var name = 'Gems'
var idVar = name
var message = 'Gems;'
var idTag = 'alertID'
var levelTag = 'level'
var messageField = 'message'
var durationField = 'duration'
var outputDB = 'chronograf'
var outputRP = 'autogen'
var outputMeasurement = 'alerts'
var triggerType = 'relative'
var shift = 1m
0s
var crit = 200
var data = stream
|from()
.database(db)
.retentionPolicy(rp)
.measurement(measurement)
.groupBy(groupBy)
.where(whereFilter)
|window()
.period(period)
.every(every)
.align()
|max('total_gems')
.as('value')
var past = data
|shift(shift)
var current = data
var trigger = past
|join(current)
.as('past', 'current')
|eval(lambda: float("current.value" - "past.value"))
.keep()
.as('value')
|alert()
.crit(lambda: "value" > crit)
.message(message)
.id(idVar)
.idTag(idTag)
.levelTag(levelTag)
.messageField(messageField)
.durationField(durationField)
.stateChangesOnly()
.telegram()
.chatId('telegramChatID_here')
.parseMode('Markdown')
trigger
|eval(lambda: float("value"))
.as('value')
.keep()
|influxDBOut()
.create()
.database(outputDB)
.retentionPolicy(outputRP)
.measurement(outputMeasurement)
.tag('alertName', name)
.tag('triggerType', triggerType)
trigger
|httpOut('output')
```
Contributor guide
Research direction
Start with the generated TICKscript in the issue, especially the window, shift, join, and relative alert stages. Reproduce the reported spike and trace the past/current values through the comparison; done means a value exceeding 200 reliably produces the expected alert.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- observability
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100