influxdata / influxdata/kapacitor
Batch query aggregated data in message
- Dominant language
- Go
- Stars
- 2.4k
- Forks
- 479
- Avg merge
- 4d 16h
- Merged PRs (30d)
- 4
Description
I am making a logging alerting system. I have logs in the influxdb database and I want to trigger alerts based on them. I have tried doing it with stream and it worked fine, but sending an alert for each log was too much for me.
Because of that I tried to make a batch alert every 10 minutes with a window of 10 minutes to check for all the logs in the database and alert on them. This is why I need all the "values" from the "series" field.
I am doing a batch query like so:
```
batch
|query('''SELECT * FROM "foo"."bar".foobar''')
.period(10m)
.every(10m)
.groupBy('spam')
|alert()
.crit(lambda: 2 > 1)
.log('alerts.log')
```
And this is the (simplified) output when I log into a file.
```
{
"id":"foobar",
"message":"...",
"details":"{.... {log:"message1", ...}},
"time":"2016-10-25T08:20:13Z",
"duration":0,
"level":"CRITICAL",
"data":{
"series":[
{
"name":"docker",
"columns":[
"time",
"log"
],
"values":[
[
"2016-10-25T08:20:13Z",
"message1",
],
[
"2016-10-25T08:20:23Z",
"message2",
]
]
}
]
}
}
```
This is a fairly reduced example, but as you can see, only the first element of the "values" list is present in the "details" field.
Ideally I would like to get all these "values" and join them somehow into a single message. I want to be able to access them when I am constructing my message for example: {{ index .values }}
Thank you.
Contributor guide
Research direction
The issue names no source files or tests. Start by tracing the batch query's alert data into the logged details and message template, then determine how the complete values list should be exposed for batched alerts. Done means all values from the series are available during message construction and the behavior is covered by an appropriate regression test.
Written by the indexing model from the issue text.
Assessment
- Domain
- backend, data, observability
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100