EvalNode

Evaluates expressions on each data point it receives. A list of expressions may be provided and will be evaluated in the order they are given. The results of expressions are available to later expressions in the list. See the property EvalNode.As for details on how to reference the results.

Example:

    stream
        |eval(lambda: "error_count" / "total_count")
          .as('error_percent')

The above example will add a new field error_percent to each data point with the result of error_count / total_count where error_count and total_count are existing fields on the data point.

Available Statistics:

• eval_errors – number of errors evaluating any expressions.

Index

Properties

• As
• Keep
• Quiet
• Tags

Chaining Methods

• Alert
• Bottom
• Combine
• Count
• CumulativeSum
• Deadman
• Default
• Delete
• Derivative
• Difference
• Distinct
• Elapsed
• Eval
• First
• Flatten
• GroupBy
• HoltWinters
• HoltWintersWithFit
• HttpOut
• InfluxDBOut
• Join
• K8sAutoscale
• Last
• Log
• Max
• Mean
• Median
• Min
• Mode
• MovingAverage
• Percentile
• Sample
• Shift
• Spread
• Stats
• Stddev
• Sum
• Top
• Union
• Where
• Window

Properties

Property methods modify state on the calling node. They do not add another node to the pipeline, and always return a reference to the calling node. Property methods are marked using the . operator.

As

List of names for each expression. The expressions are evaluated in order. The result of an expression may be referenced by later expressions via the name provided.

Example:

    stream
        |eval(lambda: "value" * "value", lambda: 1.0 / "value2")
            .as('value2', 'inv_value2')

The above example calculates two fields from the value and names them value2 and inv_value2 respectively.

node.as(names ...string)

Keep

If called the existing fields will be preserved in addition to the new fields being set. If not called then only new fields are preserved. (Tags are always preserved regardless how keep is used.)

Optionally, intermediate values can be discarded by passing a list of field names to be kept. Only fields in the list will be retained, the rest will be discarded. If no list is given then all fields are retained.

Example:

    stream
        |eval(lambda: "value" * "value", lambda: 1.0 / "value2")
            .as('value2', 'inv_value2')
            .keep('value', 'inv_value2')

In the above example the original field value is preserved. The new field value2 is calculated and used in evaluating inv_value2 but is discarded before the point is sent on to child nodes. The resulting point has only two fields: value and inv_value2.

node.keep(fields ...string)

Quiet

Suppress errors during evaluation.

node.quiet()

Tags

Convert the result of an expression into a tag. The result must be a string. Use the string() expression function to convert types.

Example:

    stream
        |eval(lambda: string(floor("value" / 10.0)))
            .as('value_bucket')
            .tags('value_bucket')

The above example calculates an expression from the field value, casts it as a string, and names it value_bucket. The value_bucket expression is then converted from a field on the point to a tag value_bucket on the point.

Example:

    stream
        |eval(lambda: string(floor("value" / 10.0)))
            .as('value_bucket')
            .tags('value_bucket')
            .keep('value') // keep the original field `value` as well

The above example calculates an expression from the field value, casts it as a string, and names it value_bucket. The value_bucket expression is then converted from a field on the point to a tag value_bucket on the point. The keep property preserves the original field value. Tags are always kept since creating a tag implies you want to keep it.

node.tags(names ...string)

Chaining Methods

Chaining methods create a new node in the pipeline as a child of the calling node. They do not modify the calling node. Chaining methods are marked using the | operator.

Alert

Create an alert node, which can trigger alerts.

node|alert()

Returns: AlertNode

Bottom

Select the bottom num points for field and sort by any extra tags or fields.

node|bottom(num int64, field string, fieldsAndTags ...string)

Returns: InfluxQLNode

Combine

Combine this node with itself. The data is combined on timestamp.

node|combine(expressions ...ast.LambdaNode)

Returns: CombineNode

Count

Count the number of points.

node|count(field string)

Returns: InfluxQLNode

CumulativeSum

Compute a cumulative sum of each point that is received. A point is emitted for every point collected.

node|cumulativeSum(field string)

Returns: InfluxQLNode

Deadman

Helper function for creating an alert on low throughput, a.k.a. deadman's switch.

• Threshold – trigger alert if throughput drops below threshold in points/interval.
• Interval – how often to check the throughput.
• Expressions – optional list of expressions to also evaluate. Useful for time of day alerting.

Example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |deadman(100.0, 10s)
    //Do normal processing of data
    data...

The above is equivalent to this Example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |stats(10s)
            .align()
        |derivative('emitted')
            .unit(10s)
            .nonNegative()
        |alert()
            .id('node \'stream0\' in task \'{{ .TaskName }}\'')
            .message('{{ .ID }} is {{ if eq .Level "OK" }}alive{{ else }}dead{{ end }}: {{ index .Fields "emitted" | printf "%0.3f" }} points/10s.')
            .crit(lambda: "emitted" <= 100.0)
    //Do normal processing of data
    data...

The id and message alert properties can be configured globally via the 'deadman' configuration section.

Since the AlertNode is the last piece it can be further modified as usual. Example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |deadman(100.0, 10s)
            .slack()
            .channel('#dead_tasks')
    //Do normal processing of data
    data...

You can specify additional lambda expressions to further constrain when the deadman's switch is triggered. Example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    // Only trigger the alert if the time of day is between 8am-5pm.
    data
        |deadman(100.0, 10s, lambda: hour("time") >= 8 AND hour("time") <= 17)
    //Do normal processing of data
    data...

node|deadman(threshold float64, interval time.Duration, expr ...ast.LambdaNode)

Returns: AlertNode

Default

Create a node that can set defaults for missing tags or fields.

node|default()

Returns: DefaultNode

Delete

Create a node that can delete tags or fields.

node|delete()

Returns: DeleteNode

Derivative

Create a new node that computes the derivative of adjacent points.

node|derivative(field string)

Returns: DerivativeNode

Difference

Compute the difference between points independent of elapsed time.

node|difference(field string)

Returns: InfluxQLNode

Distinct

Produce batch of only the distinct points.

node|distinct(field string)

Returns: InfluxQLNode

Elapsed

Compute the elapsed time between points

node|elapsed(field string, unit time.Duration)

Returns: InfluxQLNode

Eval

Create an eval node that will evaluate the given transformation function to each data point. A list of expressions may be provided and will be evaluated in the order they are given. The results are available to later expressions.

node|eval(expressions ...ast.LambdaNode)

Returns: EvalNode

First

Select the first point.

node|first(field string)

Returns: InfluxQLNode

Flatten

Flatten points with similar times into a single point.

node|flatten()

Returns: FlattenNode

GroupBy

Group the data by a set of tags.

Can pass literal * to group by all dimensions. Example:

    |groupBy(*)

node|groupBy(tag ...interface{})

Returns: GroupByNode

HoltWinters

Compute the holt-winters forecast of a data set.

node|holtWinters(field string, h int64, m int64, interval time.Duration)

Returns: InfluxQLNode

HoltWintersWithFit

Compute the holt-winters forecast of a data set. This method also outputs all the points used to fit the data in addition to the forecasted data.

node|holtWintersWithFit(field string, h int64, m int64, interval time.Duration)

Returns: InfluxQLNode

HttpOut

Create an HTTP output node that caches the most recent data it has received. The cached data is available at the given endpoint. The endpoint is the relative path from the API endpoint of the running task. For example, if the task endpoint is at /kapacitor/v1/tasks/<task_id> and endpoint is top10, then the data can be requested from /kapacitor/v1/tasks/<task_id>/top10.

node|httpOut(endpoint string)

Returns: HTTPOutNode

InfluxDBOut

Create an influxdb output node that will store the incoming data into InfluxDB.

node|influxDBOut()

Returns: InfluxDBOutNode

Join

Join this node with other nodes. The data is joined on timestamp.

node|join(others ...Node)

Returns: JoinNode

K8sAutoscale

Create a node that can trigger autoscale events for a kubernetes cluster.

node|k8sAutoscale()

Returns: K8sAutoscaleNode

Last

Select the last point.

node|last(field string)

Returns: InfluxQLNode

Log

Create a node that logs all data it receives.

node|log()

Returns: LogNode

Max

Select the maximum point.

node|max(field string)

Returns: InfluxQLNode

Mean

Compute the mean of the data.

node|mean(field string)

Returns: InfluxQLNode

Median

Compute the median of the data. Note, this method is not a selector, if you want the median point use .percentile(field, 50.0).

node|median(field string)

Returns: InfluxQLNode

Min

Select the minimum point.

node|min(field string)

Returns: InfluxQLNode

Mode

Compute the mode of the data.

node|mode(field string)

Returns: InfluxQLNode

MovingAverage

Compute a moving average of the last window points. No points are emitted until the window is full.

node|movingAverage(field string, window int64)

Returns: InfluxQLNode

Percentile

Select a point at the given percentile. This is a selector function, no interpolation between points is performed.

node|percentile(field string, percentile float64)

Returns: InfluxQLNode

Sample

Create a new node that samples the incoming points or batches.

One point will be emitted every count or duration specified.

node|sample(rate interface{})

Returns: SampleNode

Shift

Create a new node that shifts the incoming points or batches in time.

node|shift(shift time.Duration)

Returns: ShiftNode

Spread

Compute the difference between min and max points.

node|spread(field string)

Returns: InfluxQLNode

Stats

Create a new stream of data that contains the internal statistics of the node. The interval represents how often to emit the statistics based on real time. This means the interval time is independent of the times of the data points the source node is receiving.

node|stats(interval time.Duration)

Returns: StatsNode

Stddev

Compute the standard deviation.

node|stddev(field string)

Returns: InfluxQLNode

Sum

Compute the sum of all values.

node|sum(field string)

Returns: InfluxQLNode

Top

Select the top num points for field and sort by any extra tags or fields.

node|top(num int64, field string, fieldsAndTags ...string)

Returns: InfluxQLNode

Union

Perform the union of this node and all other given nodes.

node|union(node ...Node)

Returns: UnionNode

Where

Create a new node that filters the data stream by a given expression.

node|where(expression ast.LambdaNode)

Returns: WhereNode

Window

Create a new node that windows the stream by time.

NOTE: Window can only be applied to stream edges.

node|window()

Returns: WindowNode