{"id":20260288,"url":"https://github.com/influxdata/kapacitor-course","last_synced_at":"2026-03-07T11:03:06.001Z","repository":{"id":74459775,"uuid":"110902441","full_name":"influxdata/kapacitor-course","owner":"influxdata","description":null,"archived":false,"fork":false,"pushed_at":"2018-02-08T23:45:32.000Z","size":2534,"stargazers_count":24,"open_issues_count":0,"forks_count":5,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-03T18:47:58.641Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/influxdata.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-11-16T00:25:03.000Z","updated_at":"2024-12-15T12:04:26.000Z","dependencies_parsed_at":null,"dependency_job_id":"36bd90f0-5f8b-4622-af87-8d3e772937b4","html_url":"https://github.com/influxdata/kapacitor-course","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/influxdata/kapacitor-course","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/influxdata%2Fkapacitor-course","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/influxdata%2Fkapacitor-course/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/influxdata%2Fkapacitor-course/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/influxdata%2Fkapacitor-course/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/influxdata","download_url":"https://codeload.github.com/influxdata/kapacitor-course/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/influxdata%2Fkapacitor-course/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30212103,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-07T09:02:10.694Z","status":"ssl_error","status_checked_at":"2026-03-07T09:02:08.429Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-14T11:18:55.130Z","updated_at":"2026-03-07T11:03:05.995Z","avatar_url":"https://github.com/influxdata.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"## a_tick.tick \n```\nvar testname = 'Test'\n\n// TestAutomation,testname=A,clustername=1 testStatus=0,other=10\n// TestAutomation,testname=B,clustername=2 other=10\n// TestAutomation,testname=B,clustername=2 other=10\n// TestAutomation,testname=A,clustername=1 testStatus=0\n// TestAutomation,testname=B,clustername=2 testStatus=0,other=10\nvar success = batch\n    |query('select testStatus from \"test\".\"autogen\".\"TestAutomation\"')\n        .period(20s)\n        .every(10s)\n        .groupBy('testname', 'clustername')\n    |where(lambda: \"testStatus\" == 0)\n    |count('testStatus')\n        .as('count')\n    |where(lambda: \"count\" \u003e 2)\n    |stats(10s)\n    |derivative('emitted')\n    |alert()\n        .message('{{ .Level }} | Continous Fails US | {{ index .Tags \"clustername\" }} ' + string(testname))\n        .crit(lambda: \"emitted\" \u003e 0)\n        .stateChangesOnly(1m)\n        .log('/tmp/marathon_metrics_batch_alert_us.log')\n```\n## al.tick \n```\nstream\n    |from()\n    |eval(lambda: if(((weekday(\"time\") \u003e= 1 AND weekday(\"time\") \u003c= 5) AND (hour(\"time\") \u003e= 8 AND hour(\"time\") \u003c= 17)), 'true', 'false'))\n        .as('business_hours')\n        .tags('business_hours')\n        .keep()\n    |log()\n    |influxDBOut()\n        .database('telegraf')\n        .retentionPolicy('autogen')\n        .tag('kapacitor_augmented', 'true')\n```\n## alert.tick \n```\nvar data = stream\n  |from()\n    .measurement('cpu')\n  |window()\n   .period(5s)\n   .every(5s)\n   |httpPost('http://localhost:6060')\n     .header('example','b')\n```\n## any_influxdb_write_errors.tick \n```\n// SELECT writeError FROM telegraf..influxdb_write WHERE tmpltime() group by host\n// This assumes that you're using Telegraf and have the InfluxDB plugin enabled\n// https://github.com/influxdata/telegraf/tree/master/plugins/inputs/influxdb\n\nbatch\n    |query('SELECT writeError, writeOk, writeTimeout FROM \"telegraf\".\"default\".influxdb_write')\n        .period(10s)\n        .every(10s)\n        .groupBy('host')\n    |derivative('writeError')\n        .nonNegative()\n    |alert()\n        .crit(lambda: \"derivative\" \u003e 2)\n        .details('')\n        .log('/dev/stdout')\n```\n## b.tick \n```\nvar data = batch\n  |query('select * from \"telegraf\".autogen.cpu')\n    .every(10s)\n    .period(10s)\n  |log()\n\n```\n## batch.tick \n```\nbatch\n |query('SELECT * from \"_internal\".\"monitor\".\"write\"')\n  .period(1m)\n  .every(5s)\n  .align()\n |log()\n```\n## c.tick \n```\n// Query the last years worth of data, but include `mean` call so that timestamp\n// returned will be the lower boundary of the time on the query issued. Without that\n// the timestamp would be variable\nvar last_year = batch\n   |query('SELECT last(\"my_field\") as my_field, mean(\"my_field\") FROM \"mydb\".\"myrp\".\"mymeasurement\"')\n      .period(56w)\n      .every(10m)\n   // Shift the data up to the current time so that we can join on that timestamp\n   |shift(56w)\n\n// Query the average over the last 10m\nvar mean = batch\n   |query('SELECT mean(\"my_field\") as my_field FROM \"mydb\".\"myrp\".\"mymeasurement\"')\n      .period(10m)\n      .every(10m)\n   // Shift the data up to the current time so that we can join on that timestamp\n   |shift(10m)\n\n// Join the last year data with the current average\nlast_year\n    |join(mean)\n      .as('last_year','mean')\n      .tolerance(5m)\n    |alert()\n      .crit(lambda: \"last_year.my_field\" \u003e 0 AND \"mean.my_field\" \u003c 10)\n```\n## cap_stream.tick \n```\nstream\n   |from()\n     .measurement('cpu')\n     .database('telegraf')\n     .retentionPolicy('autogen')\n     .where(lambda: \"cpu\" == 'cpu-total')\n     .groupBy(*)\n  |window()\n    .period(45s)\n    .every(10s)\n  |count('usage_user')\n    .as('user')\n  |log()\n  |deadman(0.0, 10s)\n    .post('http://localhost:5555')\n```\n## d.tick \n```\nstream\n    |from()\n        .database('door')\n        .measurement('door')\n    |stateDuration(lambda: \"value\" == FALSE)\n        .unit(1s)\n    |influxDBOut()\n        .database('door')\n        .retentionPolicy('autogen')\n        .measurement('door_open')\n```\n## deadman.tick \n```\nstream\n    |from()\n        .measurement('internal_agent')\n        .groupBy('host')\n    |deadman(1.0, 10s)\n        .id('{ index .Tags \"host\" }')\n```\n## derivative.tick \n```\nstream\n    |from()\n        .measurement('mysql')\n        .groupBy('host')\n    |window()\n        .period(30s)\n        .every(30s)\n    |max('commands_select')\n        .as('commands_select')\n    |derivative('commands_select')\n        .unit(1s)\n        // default\n        .nonNegative()\n        .as('div_commands_select')\n    |influxDBOut()\n        .database('performance')\n        .retentionPolicy('short')\n        .measurement('1m_mysql')\n        .precision('s')\n```\n## e.tick \n```\nstream\n    |from()\n        .database('stress')\n        .measurement('m0')\n        .groupBy(*)\n    |window()\n        .period(5m)\n        .every(5m)\n        .align()\n    |mean('v0')\n        .as('v0_mean')\n    |influxDBOut()\n        .database('stress')\n        .retentionPolicy('autogen')\n        .measurement('v0_mean_5_min')\n        .precision('s')\n```\n## elap.tick \n```\nstream\n  |from()\n    .measurement('cpu')\n  |window()\n    .period(30s)\n    .every(30s)\n  |mean('usage_user')\n    .as('usage')\n  |elapsed('usage',1s)\n    .as('value')\n  |log()\n```\n## example.tick \n```\nvar data = stream\n  |from()\n    .measurement('cpu')\n  |eval(lambda: \"usage_idle\")\n    .as('value')\n  |log()\n\n\n```\n## example_batch.tick \n```\ndbrp \"telegraf\".\"autogen\"\n\nvar data = batch\n  |query('select * from \"telegraf\".autogen.cpu')\n    .every(10s)\n    .period(10s)\n  |log()\n\n```\n## fc.tick \n```\nvar window_size = 20s\n\nvar m1 = stream\n    |from()\n        .measurement('cpu')\n    |window()\n        .period(window_size)\n        .every(window_size)\n        .align()\n    |count('usage_user')\n        .as('value')\n\nvar m2 = stream\n    |from()\n        .measurement('cpu')\n    |window()\n        .period(window_size)\n        .every(window_size)\n        .align()\n    |count('usage_user')\n        .as('value')\n\nvar data = m1\n    |join(m2)\n        .as('m1', 'm2')\n\ndata\n    |alert()\n        .crit(lambda: \"m1.value\" != \"m2.value\" + 1)\n        .message('values were not equal m1 value is {{ index .Fields \"m1.value\" }} m2 value is {{ index .Fields \"m2.value\" }}')\n\ndata\n    |eval(lambda: \"m1.value\" - \"m2.value\")\n        .as('value_diff')\n        .keep()\n    |eval(lambda: (float(\"value_diff\") / float(\"m1.value\")) * 100.0, lambda: (float(\"value_diff\") / float(\"m2.value\")) * 100.0)\n        .as('diff_percentage_m1', 'diff_percentage_m2')\n    |influxDBOut()\n        .measurement('diffs')\n        .database('mydb')\n        .create()\n```\n## group.tick \n```\nstream\n |from()\n  .measurement('my-meas')\n |default()\n  .tag('gauge_name','')\n  .tag('host','unknown')\n |where(lambda: \"host\" != 'unknown')\n |where(lambda: \"gauge_name\" == 'jvm_uptime')\n |groupBy('host')\n |log()\n |deadman(1.0, 15s)\n  .id('/{{ .Group }}/jvm_uptime_deadman')\n  .message('{{ .Level }}: {{ .ID }}')\n  .log('/tmp/alerts-deadman.log')\n\n\n// my-meas,gauge_name=jvm_uptime,host=A x=1\n// my-meas,gauge_name=jvm_uptime,host=A x=1\n// my-meas,gauge_name=jvm_uptime,host=B x=1\n// my-meas,gauge_name=jvm_uptime,host=A x=1\n// my-meas,gauge_name=jvm_uptime,host=B x=1\n// my-meas,gauge_name=jvm_uptime,host=A x=1\n// my-meas,gauge_name=jvm_uptime,host=B x=1\n// my-meas,gauge_name=jvm_uptime,host=A x=1\n// my-meas,gauge_name=jvm_uptime,host=B x=1\n```\n## high_host_disk.tick \n```\n// SELECT used_percent FROM telegraf..disk WHERE tmpltime() group by host\n// This TICKscript assumes that you're using Telegrafs standard system plugin\n\nbatch\n    |query('SELECT used_percent FROM \"telegraf\".\"default\".disk')\n        .period(10s)\n        .every(10s)\n        .groupBy('host')\n    |alert()\n        .crit(lambda: \"used_percent\" \u003e 80)\n        .details('')\n        .stateChangesOnly()\n        .log('/dev/stdout')\n```\n## high_host_mem.tick \n```\n// This TICKscript assumes that you're using Telegrafs standard system plugin\n\nbatch\n    |query('SELECT used_percent FROM \"telegraf\".\"default\".mem')\n        .period(10s)\n        .every(10s)\n        .groupBy('host')\n    |alert()\n        .crit(lambda: \"used_percent\" \u003e 80)\n        .stateChangesOnly()\n        .details('')\n        .log('/dev/stdout')\n        .victorOps()\n        .routingKey('awstest')\n```\n## idk.tick \n```\n// See what the count is when Kapacitor counts the raw data\nbatch\n    |query('SELECT * FROM \"demonstration\".\"telemetry_retention\".\"telemetry\"')\n        .period(3d)\n        .cron('0 55 13 * * * *')\n    |count('WK_Zen')\n        .as('a_WKZen')\n    |log()\n\n// See what the count is when the count query is issued directly to InfluxDb\nbatch\n    |query('SELECT count(*) AS b FROM \"demonstration\".\"telemetry_retention\".\"telemetry\"')\n        .period(3d)\n        .cron('0 55 13 * * * *')\n    |log()\n\n// The old query\nbatch\n    |query('SELECT * FROM \"demonstration\".\"telemetry_retention\".\"telemetry\"')\n        .period(3d)\n        .cron('0 55 13 * * * *')\n        .groupBy(*)\n    |shift(24h)\n    |influxDBOut()\n        .database('demowork')\n        .retentionPolicy('telemetry_retention')\n        .measurement('telemetry')\n        .precision('ms')\n```\n## idk_1.tick \n```\nvar warn = 401\n\nvar crit = 500\n\nvar threshold = 2\n\nstream\n    |from()\n        .measurement('http_response')\n        .where(lambda: \"server\" == 'xxx')\n        .groupBy('http_response_code', 'server', 'host')\n    |where(lambda: \"http_response_code\" \u003e= crit)\n    |stats(1m)\n    |derivative('emitted')\n        .unit(1m)\n        .nonNegative()\n        .as('emitted')\n    |alert()\n        .crit(lambda: \"emitted\" \u003e= threshold)\n        .warn(lambda: \"http_response_code\" \u003e warn AND \"http_response_code\" != 408)\n        .id('{{ index .Tags \"host\" }}')\n        .message('{{ .Level }}: HTTP Response is {{ index .Fields \"http_response_code\" }} for HEALTHCHECK {{ index .Tags \"server\"}}')\n        .pagerDuty()\n```\n## idk_2.tick \n```\n/ Dataframe\nvar data = stream\n    |from()\n        .database(database)\n        .retentionPolicy(rp)\n        .measurement('fluentd')\n        .groupBy('host', 'plugin_type')\n        .where(lambda: \"region\" == region)\n        .where(lambda: \"environment\" == environment)\n        .where(lambda: \"envid\" == envid)\n        .where(lambda: \"scope\" == scope)\n        .where(lambda: \"purpose\" == purpose)\n    |where(lambda: isPresent(\"buffer_queue_length\"))\n    |window()\n        .period(period)\n        .every(every)\n        .fillPeriod()\n    |mean('buffer_queue_length')\n        .as('stat')\n    |stateDuration(lambda: \"stat\" \u003e crit)\n        .unit(period)\n        .as('sd')\n```\n## issue1192.tick \n```\nbatch\n    |query('select mean(used_percent) from \"telegraf\".\"autogen\".\"mem\"')\n      .groupBy('tag1','missing-tag')\n      .period(30s)\n      .every(30s)\n    |eval(lambda: trunc(\"mean\"))\n      .as('mean')\n    |default()\n      .tag('missing-tag', 'unknown')\n    |log()\n    |alert()\n        .id('kapacitor/{{ index .Tags \"missing-tag\" }}/...')\n```\n## jack_join.tick \n```\nvar points = 12.0\nvar period = 1m\nvar every = 1m\n\nvar data = stream\n    |from()\n        .measurement('http_response')\n        .groupBy(*)\n    |eval()\n        .keep('response_time')\n    |window()\n        .period(period)\n        .every(every)\n        .align\n\nvar success_rate = data\n  |where(lambda: \"http_response_code\" \u003c 302 AND \"response_string_match\" == 1)\n  |count('response_time')\n    .as('count')\n  |eval(lambda: (float(\"count\") / points) * 100.0)\n    .as('rate')\n\nvar mean_data = data\n  |mean('response_time')\n    .as('response_time')\n  |eval(lambda: \"response_time\" * 1000.0)\n    .as('response_time')\n\nvar p50_data = data\n  |percentile('response_time', 50.0)\n    .as('response_time')\n  |eval(lambda: \"response_time\" * 1000.0)\n    .as('response_time')\n\nvar p95_data = data\n  |percentile('response_time', 95.0)\n    .as('response_time')\n  |eval(lambda: \"response_time\" * 1000.0)\n    .as('response_time')\n\nvar p99_data = data\n  |percentile('response_time', 99.0)\n    .as('response_time')\n  |eval(lambda: \"response_time\" * 1000.0)\n    .as('response_time')\n\nsuccess_rate\n  |join(mean_data, p50_data, p95_data, p99_data)\n    .as('success', 'mean', 'p50', 'p95', 'p99')\n  |influxDBOut()\n    .create()\n    .database('telegraf_derived')\n    .retentionPolicy('autogen')\n    .measurement('http_response_rates')\n```\n## kap_stream.tick \n```\nvar period = 10s\n\nvar every = 10s\n\nvar data = stream\n    |from()\n        .measurement('m')\n        .groupBy('hname')\n    |window()\n        .period(period)\n        .every(every)\n        .fillPeriod()\n\nvar stata = data\n    |where(lambda: \"sts\" == 'ok')\n    |sum('count')\n        .as('value')\n\nvar statb = data\n    |sum('count')\n        .as('value')\n\nstata\n    |join(statb)\n        .as('stata', 'statb')\n    |eval(lambda: (float(\"stata.value\") / float(\"statb.value\")) * 100.0)\n        .as('stat')\n    |where(lambda: \"stat\" \u003e 0.0)\n    |log()\n    |alert()\n        // .id('{{ index .Tags \"host\"}}/rmqh_d-fail-ratio')\n        .id('{{ index .Tags \"hname\"}}')\n        .message('xxx')\n        .crit(lambda: \"stat\" \u003e 0.0)\n        .stateChangesOnly()\n        // .flapping(0.25, 0.5)\n        .log('xxx')\n```\n## l.tick \n```\nvar message = 'batch alerting {{.Time}} {{ index .Fields \"value\" }}'\n\nvar current = batch\n    |query('select mean(nummeasurements) as value from \"_internal\".\"monitor\".\"database\"')\n        .period(1m)\n        .every(1m)\n        .align()\n\nvar past = batch\n    |query('select mean(nummeasurements) as value from \"_internal\".\"monitor\".\"database\"')\n        .period(1m)\n        .every(1m)\n        .align()\n        .offset(24h)\n    |shift(24h)\n\nvar trigger = past\n    |join(current)\n        .as('past', 'current')\n    |eval(lambda: float(\"current.value\" - \"past.value\"))\n        .keep()\n        .as('value')\n    |alert()\n        .crit(lambda: \"value\" \u003e 0)\n        .stateChangesOnly()\n        .message(message)\n        .post('http://xxxxx')\n```\n## local_write_failures.tick \n```\n// Fire an alert when write errors occur (grouped by database)\nvar period = 10s\nvar every = 10s\nvar delta = 1s\n\nstream\n    |from()\n        .database('_internal')\n        .measurement('shard')\n        .groupBy('database')\n    |window()\n        .period(period)\n        .every(every)\n    |max('writePointsFail')\n        .as('max')\n    |derivative('max')\n        .unit(delta)\n        .nonNegative()\n        .as('derivative')\n    |alert()\n        .id('write_failures/{{ index .Tags \"database\" }}')\n        .message('There have been write failures on database: {{ index .Tags \"database\" }}')\n        .details('')\n        .warn(lambda: \"derivative\" \u003e= 1)\n        .stateChangesOnly()\n        .log('/var/log/kapacitor/write_failures.log')\n```\n## missing_isPresent.tick \n```\nvar data = stream\n  |from()\n    .measurement('cpu')\n  |eval(lambda: isPresent(\"usage_funny\"))\n    .as('missing')\n```\n## new_example.tick \n```\n// kapacitor define e -tick example.tick -dbrp stress.autogen -type stream\n// kapacitor enable e\nstream\n    |from()\n        .measurement('mysql')\n        .groupBy(*)\n    |window()\n        .period(1m)\n        .every(1m)\n        .align()\n    |default()\n        .field('threads_connected', 0)\n    |mean('threads_connected')\n        .as('mean_threads_connected')\n//    |eval()\n//        .keep('max_threads_connected')\n    |log()\n```\n## new_join.tick \n```\nvar data = stream\n    |from()\n        .measurement('mysql')\n        .retentionPolicy('default')\n        .database('performance')\n        .groupBy(*)\n    |where(lambda: \"host\" == 'xxx')\n\nvar c1 = data\n    |where(lambda: isPresent(\"commands_select\"))\n    |derivative('commands_select')\n        .unit(1s)\n        .nonNegative()\n        .as('div1')\n\nvar c2 = data\n    |where(lambda: isPresent(\"commands_insert\"))\n    |derivative('commands_insert')\n        .unit(1s)\n        .nonNegative()\n        .as('div2')\n\nc1\n    |join(c2)\n        .as('c1', 'c2')\n    |eval()\n        .keep('c1.div1', 'c2.div2')\n    |httpOut('out')\n```\n## old_example.tick \n```\nvar data = stream\n  |from()\n    .measurement('cpu')\n  |log()\n\n```\n## other.tick \n```\nvar data = stream\n  |from()\n    .measurement('example')\n  |eval(lambda: (float(\"x\")/float(\"y\")) * 100)\n   .as('result')\n  |log()\n```\n## other_d.tick \n```\nvar db = 'iotdata'\n\nvar rp = 'autogen'\n\nvar measurement = 'influxdata_sensors'\n\nvar groupBy = [*]\n\nvar whereFilter = lambda: (\"location\" == 'TravelingWilbury')\n\nvar name = 'relative-temp'\n\nvar idVar = name + ':{{.Group}}'\n\nvar message = ' {{ index .Fields \"value\" }}'\n\nvar idTag = 'alertID'\n\nvar levelTag = 'level'\n\nvar messageField = 'message'\n\nvar durationField = 'duration'\n\nvar outputDB = 'chronograf'\n\nvar outputRP = 'autogen'\n\nvar outputMeasurement = 'alerts'\n\nvar triggerType = 'relative'\n\nvar shift = 5s\n\n0s\n\nvar crit = 0.5\n\nvar data = stream\n    |from()\n        .database(db)\n        .retentionPolicy(rp)\n        .measurement(measurement)\n        .groupBy(groupBy)\n        .where(whereFilter)\n    |eval(lambda: \"temp_f\")\n        .as('value')\n    |window()\n      .period(3s)\n      .every(1s)\n      .align()\n\nvar max = data|max('value').as('value')\n\nvar min = data|min('value').as('value')\n\nvar trigger = max\n    |join(min)\n        .as('max', 'min')\n        .tolerance(100ms)\n    |eval(lambda: float(\"max.value\" - \"min.value\"))\n        .keep()\n        .as('chng')\n    |log()\n      .level('ERROR')\n\ntrigger\n    |influxDBOut()\n       .create()\n       .database('derived_iotdata')\n       .measurement('influxdata_sensors')\n\ntrigger\n    |alert()\n        .crit(lambda: abs(\"chng\") \u003e crit)\n        .stateChangesOnly()\n        .message(message)\n        .id(idVar)\n        .idTag(idTag)\n        .levelTag(levelTag)\n        .messageField(messageField)\n        .durationField(durationField)\n        .post('http://davidgs.com:1880/sensor-reading')\n\ntrigger\n    |influxDBOut()\n        .create()\n        .database(outputDB)\n        .retentionPolicy(outputRP)\n        .measurement(outputMeasurement)\n        .tag('alertName', name)\n        .tag('triggerType', triggerType)\n\ntrigger\n    |httpOut('output')\n```\n## other_sh.tick \n```\n// kapacitor define nnd_net_stream -type stream -tick nnd_net.tick -dbrp telegraf.rp_2w\nvar db = 'telegraf'\nvar rp = 'rp_2w'\nvar measurement = 'net'\nvar outputDB = 'chronograf'\nvar outputRP = 'rp_24h'\nvar outputMeasurement = 'nnd_net_stream'\n\nvar netdata = stream\n    |from()\n        .database(db)\n        .retentionPolicy(rp)\n        .measurement(measurement)\n        // .where(lambda: \"bytes_recv\" \u003e 0)\n\n        // .where(lambda: \"bytes_sent\" \u003e 0)\n\n        // .where(lambda: \"packets_sent\" \u003e 0)\n        .groupBy(*)\n    |eval(lambda: float(\"bytes_recv\"))\n        .as('bytes_recv_f')\n        .keep()\n    |eval(lambda: float(\"bytes_sent\"))\n        .as('bytes_sent_f')\n        .keep()\n    |eval(lambda: float(\"packets_recv\"))\n        .as('packets_recv_f')\n        .keep()\n    |eval(lambda: float(\"packets_sent\"))\n        .as('packets_sent_f')\n        .keep()\n    // |eval(lambda: float(\"drop_in\"))\n\n    // .as('drop_in_f')\n\n    // .keep()\n\n    // |eval(lambda: float(\"drop_out\"))\n\n    // .as('drop_out_f')\n\n    // .keep()\n\n    // |eval(lambda: float(\"err_in\"))\n\n    // .as('err_in_f')\n\n    // .keep()\n\n    // |eval(lambda: float(\"err_out\"))\n\n    // .as('err_out_f')\n\n    // .keep()\n    |window()\n        .period(20s)\n        .every(10s)\n        .align()\n\nnetdata\n    |derivative('bytes_recv_f')\n        .unit(1s)\n        .nonNegative()\n        .as('bytes_recv_d')\n\nnetdata\n    |derivative('bytes_sent_f')\n        .unit(1s)\n        .nonNegative()\n        .as('bytes_sent_d')\n\nnetdata\n    |derivative('packets_recv_f')\n        .unit(1s)\n        .nonNegative()\n        .as('packets_recv_d')\n\nnetdata\n    |derivative('packets_sent_f')\n        .unit(1s)\n        .nonNegative()\n        .as('packets_sent_d')\n    // netdata\n\n    // |derivative('drop_in_f')\n\n    // .unit(1s)\n\n    // .nonNegative()\n\n    // .as('drop_in_d')\n\n    // netdata\n\n    // |derivative('drop_sent_f')\n\n    // .unit(1s)\n\n    // .nonNegative()\n\n    // .as('drop_sent_d')\n\n    // netdata\n\n    // |derivative('err_in_f')\n\n    // .unit(1s)\n\n    // .nonNegative()\n\n    // .as('err_in_d')\n\n    // netdata\n\n    // |derivative('err_out_f')\n\n    // .unit(1s)\n\n    // .nonNegative()\n\n    // .as('err_out_d')\n    |influxDBOut()\n        .database(outputDB)\n        .retentionPolicy(outputRP)\n        .measurement(outputMeasurement)\n        .precision('s')\n```\n## panic.tick \n```\nvar measurement = 'event_trend2'\n\nvar period = 1m\n\nvar every = 20s\n\nvar data = batch\n    |query('SELECT count(event_id) as alert_count FROM \"a\".\"autogen\".State')\n        .period(period)\n        .every(every)\n        .groupBy(time(every), *)\n        .fill(0)\n\nvar mean_data = data\n    |mean('alert_count')\n        .as('mean')\n\nvar deriv_data = data\n    |derivative('alert_count')\n        .unit(every)\n        .nonNegative()\n        .as('derivative')\n    |last('derivative')\n        .as('derivative')\n\nmean_data\n    |join(deriv_data)\n        .as('mean', 'deriv')\n    |influxDBOut()\n        .database('_a_analytics')\n        .measurement(measurement)\n\nmean_data\n    |httpOut('result')\n```\n## record_series_count.tick \n```\n// Fire an alert when series count exceeds threshold\n// Also rewrite downsampled points back to _internal database\nvar period = 10s\nvar every = 10s\nvar delta = 1s\n\nvar warn_threshold = 800000\n\nvar data = stream\n    |from()\n    .database('_internal')\n    .measurement('database')\n    .groupBy('hostname')\n    |window()\n    .period(period)\n    .every(every)\n    |default()\n    .field('numSeries', 0)\n    |sum('numSeries')\n    .as('totalNumSeries')\n\ndata\n    |alert()\n    .id('high_series_count/{{ index .Tags \"hostname\" }}')\n    .message('High series count for host: {{ index .Tags \"hostname\" }}')\n    .details('')\n    .warn(lambda: \"totalNumSeries\" \u003e warn_threshold)\n    .stateChangesOnly()\n    .log('/var/log/kapacitor/high_series_count.log')\n\ndata\n    |influxDBOut()\n    .database('_internal')\n    .retentionPolicy('monitor')\n    .measurement('database')\n    .tag('source', 'kapacitor')\n```\n## record_throughput.tick \n```\n// Fire an alert when write throughput exceeds threshold\n// Also rewrite downsampled points back to _internal database\nvar period = 10s\nvar every = 10s\nvar delta = 1s\n\nvar warn_threshold = 500000\n\nvar data = stream\n    |from()\n    .database('_internal')\n    .measurement('write')\n    |window()\n    .period(period)\n    .every(every)\n    |default()\n    .field('pointReq', 0)\n    |max('pointReq')\n    .as('max')\n    |derivative('max')\n    .unit(delta)\n    .nonNegative()\n    .as('pointsPerSecond')\n\ndata\n    |alert()\n    .id('high_throughput/{{ index .Tags \"hostname\" }}')\n    .message('High write throughput on host: {{ index .Tags \"hostname\" }}')\n    .details('')\n    .warn(lambda: \"pointsPerSecond\" \u003e warn_threshold)\n    .stateChangesOnly()\n    .log('/var/log/kapacitor/high_throughput.log')\n\ndata\n    |influxDBOut()\n    .database('_internal')\n    .retentionPolicy('monitor')\n    .measurement('write')\n    .tag('source', 'kapacitor')\n```\n## rename.tick \n```\n///////////////////////////////\n// writes are failing\nvar data = stream\n            |from()\n              .measurement('shard')\n            |groupBy('database')\n            |window()\n              .period(10s)\n              .every(10s)\n\nvar writeOk = data\n                |max('writePointsOk')\n                  .as('maxWritePointsOk')\n                |derivative('maxWritePointsOk')\n                  .unit(1s)\n                  .nonNegative()\n                  .as('derivativeMaxWritePointsOk')\n\nvar writeFail = data\n                  |max('writePointsFail')\n                    .as('maxWritePointsFail')\n                  |derivative('maxWritePointsFail')\n                    .unit(1s)\n                    .nonNegative()\n                    .as('derivativeMaxWritePointsFail')\n\nwriteOk\n  |join(writeFail)\n    .as('ok', 'fail')\n    .tolerance(1s)\n    .fill(0.0)\n    .streamName('write_ok_fail')\n  |eval(lambda: \"fail.derivativeMaxWritePointsFail\" / (\"ok.derivativeMaxWritePointsOk\" + \"fail.derivativeMaxWritePointsFail\"))\n    .as('percentFailedWrites')\n  |alert()\n    .id('kapacitor/{{ index .Tags \"datbase\" }}') // ??\n    .message('{{ .ID }} is {{ .Level }} value:{{index .Fields \"value\" }}') // ?\n    .info(lambda: \"derivativeMeanWritePointOk\" \u003e 10) // ??\n    .warn(lambda: \"derivativeMeanWritePointOk\" \u003e 30) // ??\n    .crit(lambda: \"derivativeMeanWritePointOk\" \u003e 90) // ??\n    .slack() // ??\n      .channel('#alerts')\n  |influxDBOut()\n    .database('internal_stats') // ??\n    .retentionPolicy('myrp') // ??\n    .measurement('percent_failed_disk_writes')\n    .tag('kapacitor', 'true')\n\n\n\n\n/////////////////////////////////////////////////////////\n// you currently have high throughput\n\nstream\n  |from()\n    .measurement('write')\n  |max('pointReq')\n    .as('maxPointReq')\n  |derivative('maxPointReq')\n    .unit(1s)\n    .nonNegative()\n    .as('pointsPerSecond')\n  |alert()\n    .message('idk?')\n    .info(lambda: 'pointsPerSecond' \u003e 150000)\n    .warn(lambda: 'pointsPerSecond' \u003e 300000)\n    .crit(lambda: 'pointsPerSecond' \u003e 500000)\n  |influxDBOut()\n    .database('internal_stats') // ??\n    .retentionPolicy('myrp') // ??\n    .measurement('throughput')\n    .tag('kapacitor', 'true')\n\n////////////////////////////////////////////////////////////\n///// too many series\n\nstream\n  |from()\n    .measurement('database')\n  |sum('numSeries')\n    .as('totalNumSeries')\n  |alert()\n    .message('you have this many series')\n    .warn(lambda: 'totalNumSeries' \u003e 1000000)\n    .crit(lambda: 'totalNumSeries' \u003e 10000000)\n  |influxDBOut()\n    .database('internal_stats') // ??\n    .retentionPolicy('myrp') // ??\n    .measurement('series')\n    .tag('kapacitor', 'true')\n\n\n```\n## rollup.tick \n```\n// DEPLOYAS:stream\n// DBRP:telegraf.default\n// Which measurement to consume\nvar measurement = 'cpu'\n\n// Which database to consume\nvar db = 'telegraf'\n\n// Which retention policy to consume\nvar rp = 'autogen'\n\n// Which field to process\nvar field = 'usage_user'\n\nvar data = stream\n    |from()\n        .database('telegraf')\n        .retentionPolicy('default')\n        .measurement(measurement)\n        .groupBy(*)\n\n// 1m rollup\ndata\n    |window()\n        .period(1m)\n        .every(1m)\n    |mean(field)\n        .as(field)\n    |influxDBOut()\n        .database('telegaf')\n        .retentionPolicy('autogen')\n        .measurement(measurement)\n        .tag('resolution', '1m')\n        .create()\n\n// 5m rollup\ndata\n    |window()\n        .period(5m)\n        .every(5m)\n    |mean(field)\n        .as(field)\n    |influxDBOut()\n        .database('telegaf')\n        .retentionPolicy('autogen')\n        .measurement(measurement)\n        .tag('resolution', '5m')\n        .create()\n```\n## s.tick \n```\nvar db = 'telegraf'\nvar rp = 'rp_2w'\nvar measurement = 'net'\nvar outputDB = 'chronograf'\nvar outputRP = 'rp_2w'\nvar outputMeasurement = 'nnd_net'\n\nbatch\n|query('select non_negative_derivative(*) as nnd from telegraf.rp_2w.net')\n  .period(20s)\n  .every(20s)\n  .groupBy(*)\n|influxDBOut()\n  .database(outputDB)\n  .retentionPolicy(outputRP)\n  .measurement(outputMeasurement)\n  .precision('s')\n```\n## shift.tick \n```\ndbrp \"telegraf\".\"autogen\"\n\nbatch\n    |query('SELECT * FROM \"telegraf\".\"autogen\".\"cpu\" GROUP BY *')\n        .period(1m)\n        .every(1m)\n        .groupBy(*)\n    |shift(10m)\n    |influxDBOut()\n        .database('telegraf')\n        .retentionPolicy('newrp2')\n```\n## st.tick \n```\nstream\n    |from()\n        .measurement('cpu')\n        .database('telegraf')\n        .retentionPolicy('autogen')\n        .where(lambda: \"cpu\" == 'cpu-total')\n        .groupBy('host')\n    |log()\n    |deadman(0.0, 10s)\n        .post('http://localhost:5555')\n```\n## system_down.tick \n```\n// This TICKscript assumes that you have telegraf running and the Kapacitor slack plugin enabled\nvar period = 120s\nvar every = 60s\n\nvar sys_data = stream\n    |from()\n      .database('telegraf')\n      .measurement('system')\n      .groupBy('host')\n    |window()\n      .period(period)\n      .every(every)\n\nsys_data|deadman(1.0, period)\n    .id('deadman/{{ index .Tags \"host\" }}')\n    .message('Node {{ index .Tags \"host\" }} {{ if ne .Level \"OK\" }}has not responded in 120s!{{ else }}is back online.{{ end }}')\n    .stateChangesOnly()\n    .slack()\n```\n## telemetry_retention.tick \n```\nbatch\n    |query('''SELECT * FROM \"production\".\"telemetry_retention\".\"telemetry\"''')\n        .cron('0 20 11 * * * *')\n        .period(4d)\n        .groupBy(*)\n    |count('WK_Zen')\n    |log()\n    |shift(24h)\n    |influxDBOut()\n        .database('work')\n        .retentionPolicy('telemetry_retention')\n        .measurement('telemetry')\n        .precision('s')\n```\n## test_auto.tick \n```\nvar testname = 'Test'\n\n// TestAutomation,testname=A,clustername=1 testStatus=0,other=10\n// TestAutomation,testname=B,clustername=2 other=10\n// TestAutomation,testname=B,clustername=2 other=10\n// TestAutomation,testname=A,clustername=1 testStatus=0\n// TestAutomation,testname=B,clustername=2 testStatus=0,other=10\nvar success = batch\n    |query('select testStatus from \"test\".\"autogen\".\"TestAutomation\"')\n        .period(20s)\n        .every(10s)\n        .groupBy('testname', 'clustername')\n    |where(lambda: \"testStatus\" == 0)\n    |count('testStatus')\n        .as('count')\n    |where(lambda: \"count\" \u003e 2)\n    |stats(10s)\n    |log()\n    |alert()\n        .message('{{ .Level }} | Continous Fails US | {{ index .Tags \"clustername\" }} ' + string(testname))\n        .crit(lambda: \"emitted\" \u003e 0)\n        .stateChangesOnly(1m)\n        .log('/tmp/marathon_metrics_batch_alert_us.log')\n```\n## tick.tick \n```\nvar tolerance = 0.0001\nvar sq = stream\n |from()\n   .measurement('m')\n |eval(lambda: 0.5 * (\"x\" + (\"s\" / \"x\")))\n  .as('xn')\n  .keep()\n\nsq|where(lambda: abs(\"x\" - \"xn\") \u003c tolerance)\n |log()\n\nsq|where(lambda: abs(\"x\" - \"xn\") \u003e tolerance)\n  |eval(lambda: \"xn\")\n   .as('x')\n   .keep('s','x')\n |kapacitorLoopback()\n  .database('mydb2')\n  .retentionPolicy('autogen')\n```\n## time.tick \n```\nvar secondsPerMinute = 60\nvar secondsPerHour   = 60 * 60\nvar secondsPerDay    = 24 * secondsPerHour\nvar secondsPerWeek   = 7 * secondsPerDay\nstream\n  |from()\n    .measurement('cpu')\n  |eval(lambda: unixNano(\"time\") - \"usage_time\")\n    .as('t2')\n  |log()\n```\n## week_on_week.tick \n```\n// Query the current minute\nvar this_minute = batch\n    |query('''\nSELECT count(\"usage_user\") FROM \"telegraf\".\"autogen\".\"cpu\"\n''')\n        .period(1m)\n        .every(1m)\n\nvar last_minute = batch\n    |query('''\nSELECT count(\"usage_user\") FROM \"telegraf\".\"autogen\".\"cpu\"\n''')\n        .period(1m)\n        .every(1m)\n        // This is what gives us the previous miniute of data\n        .offset(24h)\n    // we need to shift the previous minute forward\n    |shift(1m)\n\nthis_minute\n    |join(last_minute)\n        .as('this', 'last')\n    |log()\n```\n## working-issue1192.tick \n```\nbatch\n    |query('select mean(used_percent) from \"telegraf\".\"autogen\".\"mem\"')\n      .groupBy('tag1','missing-tag')\n      .period(30s)\n      .every(30s)\n    // By using last here the edge type switches from batch to stream and the bug only exists in the batch handling, so this is a hack workaround. \n    // Using last doesn't change anything since the batch query only returns a single aggregated point anyways.\n    |last('mean')\n       .as('mean')\n    |eval(lambda: trunc(\"mean\"))\n      .as('mean')\n    |default()\n      .tag('missing-tag', 'unknown')\n    |log()\n    |alert()\n        .id('kapacitor/{{ index .Tags \"missing-tag\" }}/...')\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfluxdata%2Fkapacitor-course","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finfluxdata%2Fkapacitor-course","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfluxdata%2Fkapacitor-course/lists"}