provide streams like runs but on duration
Closed this issue · 1 comments
mcorbin commented
I think it may be useful to have streams like (runs)
but on duration instead of moving-event-window.
For example, i want to be alerted if :metric is > to a threshold (600 for example) during 5 minutes. It would be nice to have :
(above 600 300 children)
If an event arrives at time 0 with :metric = 700, and a second event arrives at time 301 with :metric = 750, above passes on the last event.
Another example with a test case :
(test-stream (above 10 5) [{:time 0
:metric 2} ;; metric < 10
{:time 6
:metric 11} ;; metric > 10, valid event
{:time 12 ;; metric > 10, 12 - 6 > 5 => send to children
:metric 11}] [{:time 12
:metric 11}])
More generally, we could have a stream called cond-dt taking a function of events, a duration, and children, and use it to creates for example the above stream :
(defn above
[threshold dt & children]
(apply cond-dt (fn [event] (> (:metric event) threshold)) dt children))
I am working on it actually (i will do a PR tomorrow), do you think it can be useful to integrate it into Riemann ?
mcorbin commented