openTSDB/Bosun報警語法 介紹/學習筆記

openTSDB表達式概述

/api/query, 內含rate options, filters

m=sum:rate{counter,,1000}:if.octets.in

Name	Data Type	Required	Description	Default	Example
counter	Boolean	Optional	Whether or not the underlying data is a monotonically increasing counter that may roll over	false	true
counterMax	Integer	Optional	A positive integer representing the maximum value for the counter.	Java Long.MaxValue	65535
resetValue	Integer	Optional	An optional value that, when exceeded, will cause the aggregator to return a 0 instead of the calculated rate. Useful when data sources are frequently reset to avoid spurious spikes.	0	65000
dropResets	Boolean	Optional	Whether or not to simply drop rolled-over or reset data points.	false	true

Filters

Whether or not results are grouped depends on which curly bracket the filter is in. Two curly braces are now supported per metric query. The first set is the group by filter and the second is a non group by filter, e.g. {host=wildcard(web*)}{colo=regexp(sjc.*)}. This specifies any metrics where the colo matches the regex expression "sjc.*" and the host tag value starts with "web" and the results are grouped by host. If you only want to filter without grouping then the first curly set must be empty, e.g. {}{host=wildcard(web*),colo=regexp(sjc.*)}.

Metric Query String Format

m=<aggregator>:[rate[{counter[,<counter_max>[,<reset_value>]]]}:][<down_sampler>:][percentiles\[<p1>, <pn>\]:][explicit_tags:]<metric_name>[{<tag_name1>=<grouping filter>[,...<tag_nameN>=<grouping_filter>]}][{<tag_name1>=<non grouping filter>[,...<tag_nameN>=<non_grouping_filter>]}]

openTSDB中文版

Bosun表達式 - 英文

運算優先級

1. Filtering
2. Grouping
3. Downsampling
4. Interpolation
5. Aggregation
6. Rate Conversion
7. Functions
8. Expressions

Bosun查詢舉例

avg(q("sum:sys.cpu{host=ny-*}", "5m", "")) > 0.8

Bosun常用函數

q(query string, startDuration string, endDuration string) seriesSet *
band(query string, duration string, period string, num scalar) seriesSet *
over(query string, duration string, period string, num scalar) seriesSet *
change(query string, startDuration string, endDuration string) numberSet *
count(query string, startDuration string, endDuration string) scalar *
window(query string, duration string, period string, num scalar, funcName string) seriesSet *
avg(seriesSet) numberSet
取數據集的平均值
sum(seriesSet) numberSet
求和
cCount(seriesSet) numberSet
數據集的變化程度，根據每個數據與它前一個數據的比較得出。例如，數據集cCount([0,1,0,1])返回3
dev(seriesSet) numberSet
標準差
diff(seriesSet) numberSet
最後一個數減去第一個數的差值
first(seriesSet) numberSet
數據集的第一個數據
last(seriesSet) numberSet
數據集的最後一個數據
len(seriesSet) numberSet
數據集的長度
max(seriesSet) numberSet
最大值
median(seriesSet) numberSet
中間值
min(seriesSet) numberSet
最小值
percentile(seriesSet, p numberSet|scalar) numberSet
返回數據集前百分比爲p的數據，例如最大值max相當於p>=1, 中間值相當於p==0.5
since(seriesSet) numberSet
Returns the number of seconds since the most recent data point in each series.
streak(seriesSet) numberSet
連續非零數據的最大長度
t(numberSet, group string) seriesSet
Transposes N series of length 1 to 1 series of length N. If the group parameter is not the empty string, the number of series returned is equal to the number of tagks passed. This is useful for performing scalar aggregation across multiple results from a query. For example, to get the total memory used on the web tier: sum(t(avg(q("avg:os.mem.used{host=-web}", "5m", "")), "")).
alert(name string, key string) numberSet *
abs(numberSet) numberSet
返回數據集中每個元素的絕對值
d(string) scalar
返回一個時間段的秒數，例如d("1h")返回60
tod(scalar) string
Returns an OpenTSDB duration string that represents the given number of seconds. This lets you do math on durations and then pass it to the duration arguments in functions like q()
des(series, alpha scalar, beta scalar) series
Returns series smoothed using Holt-Winters double exponential smoothing. Alpha (scalar) is the data smoothing factor. Beta (scalar) is the trend smoothing factor.
dropg(seriesSet, threshold numberSet|scalar) seriesSet
移除數據集中大於指定閥值的元素
dropge(seriesSet, threshold numberSet|scalar) seriesSet
移除數據集中大於等於指定閥值的元素
dropl(seriesSet, threshold numberSet|scalar) seriesSet
移除數據集中小於等於指定閥值的元素
drople(seriesSet, threshold numberSet|scalar) seriesSet
移除數據集中小於等於指定閥值的元素
dropna(seriesSet) seriesSet
移除數據集中類型是NaN是Inf的元素
dropbool(seriesSet, seriesSet) seriesSet
epoch() scalar
返回當前的Unix時間戳
filter(seriesSet, numberSet) seriesSet
limit(numberSet, count scalar) numberSet
lookup(table string, key string) numberSet
shift(seriesSet, dur string) seriesSet
merge(SeriesSet…) seriesSet
nv(numberSet, scalar) numberSet