--- title: WhereNode (Kapacitor TICKscript node) description: WhereNode filters a data stream by a given expression. note: Auto generated by tickdoc menu: kapacitor_1_4: name: WhereNode identifier: where_node weight: 330 parent: TICKscript nodes --- ### Constructor | Chaining Method | Description | |:---------|:---------| | **[where](#descr) ( `expression` `ast.LambdaNode`)** | Create a new node that filters the data stream by a given expression. | ### Property Methods This node has no properties that can be set. ### Chaining Methods [Alert](/kapacitor/v1.4/nodes/where_node/#alert), [Barrier](/kapacitor/v1.4/nodes/where_node/#barrier), [Bottom](/kapacitor/v1.4/nodes/where_node/#bottom), [Combine](/kapacitor/v1.4/nodes/where_node/#combine), [Count](/kapacitor/v1.4/nodes/where_node/#count), [CumulativeSum](/kapacitor/v1.4/nodes/where_node/#cumulativesum), [Deadman](/kapacitor/v1.4/nodes/where_node/#deadman), [Default](/kapacitor/v1.4/nodes/where_node/#default), [Delete](/kapacitor/v1.4/nodes/where_node/#delete), [Derivative](/kapacitor/v1.4/nodes/where_node/#derivative), [Difference](/kapacitor/v1.4/nodes/where_node/#difference), [Distinct](/kapacitor/v1.4/nodes/where_node/#distinct), [Ec2Autoscale](/kapacitor/v1.4/nodes/where_node/#ec2autoscale), [Elapsed](/kapacitor/v1.4/nodes/where_node/#elapsed), [Eval](/kapacitor/v1.4/nodes/where_node/#eval), [First](/kapacitor/v1.4/nodes/where_node/#first), [Flatten](/kapacitor/v1.4/nodes/where_node/#flatten), [GroupBy](/kapacitor/v1.4/nodes/where_node/#groupby), [HoltWinters](/kapacitor/v1.4/nodes/where_node/#holtwinters), [HoltWintersWithFit](/kapacitor/v1.4/nodes/where_node/#holtwinterswithfit), [HttpOut](/kapacitor/v1.4/nodes/where_node/#httpout), [HttpPost](/kapacitor/v1.4/nodes/where_node/#httppost), [InfluxDBOut](/kapacitor/v1.4/nodes/where_node/#influxdbout), [Join](/kapacitor/v1.4/nodes/where_node/#join), [K8sAutoscale](/kapacitor/v1.4/nodes/where_node/#k8sautoscale), [KapacitorLoopback](/kapacitor/v1.4/nodes/where_node/#kapacitorloopback), [Last](/kapacitor/v1.4/nodes/where_node/#last), [Log](/kapacitor/v1.4/nodes/where_node/#log), [Max](/kapacitor/v1.4/nodes/where_node/#max), [Mean](/kapacitor/v1.4/nodes/where_node/#mean), [Median](/kapacitor/v1.4/nodes/where_node/#median), [Min](/kapacitor/v1.4/nodes/where_node/#min), [Mode](/kapacitor/v1.4/nodes/where_node/#mode), [MovingAverage](/kapacitor/v1.4/nodes/where_node/#movingaverage), [Percentile](/kapacitor/v1.4/nodes/where_node/#percentile), [Sample](/kapacitor/v1.4/nodes/where_node/#sample), [Shift](/kapacitor/v1.4/nodes/where_node/#shift), [Sideload](/kapacitor/v1.4/nodes/where_node/#sideload), [Spread](/kapacitor/v1.4/nodes/where_node/#spread), [StateCount](/kapacitor/v1.4/nodes/where_node/#statecount), [StateDuration](/kapacitor/v1.4/nodes/where_node/#stateduration), [Stats](/kapacitor/v1.4/nodes/where_node/#stats), [Stddev](/kapacitor/v1.4/nodes/where_node/#stddev), [Sum](/kapacitor/v1.4/nodes/where_node/#sum), [SwarmAutoscale](/kapacitor/v1.4/nodes/where_node/#swarmautoscale), [Top](/kapacitor/v1.4/nodes/where_node/#top), [Union](/kapacitor/v1.4/nodes/where_node/#union), [Where](/kapacitor/v1.4/nodes/where_node/#where), [Window](/kapacitor/v1.4/nodes/where_node/#window)

### Description The [WhereNode](/kapacitor/v1.4/nodes/where_node/) filters the data stream by a given expression. Example: ```javascript var sums = stream |from() .groupBy('service', 'host') |sum('value') //Watch particular host for issues. sums |where(lambda: "host" == 'h001.example.com') |alert() .crit(lambda: TRUE) .email().to('user@example.com') ```
Chaining Methods ---------------- Chaining methods create a new node in the pipeline as a child of the calling node. They do not modify the calling node. Chaining methods are marked using the `|` operator. ### Alert Create an alert node, which can trigger alerts. ```javascript where|alert() ``` Returns: [AlertNode](/kapacitor/v1.4/nodes/alert_node/) ### Barrier Create a new Barrier node that emits a BarrierMessage periodically One BarrierMessage will be emitted every period duration ```javascript where|barrier() ``` Returns: [BarrierNode](/kapacitor/v1.4/nodes/barrier_node/) ### Bottom Select the bottom `num` points for `field` and sort by any extra tags or fields. ```javascript where|bottom(num int64, field string, fieldsAndTags ...string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Combine Combine this node with itself. The data is combined on timestamp. ```javascript where|combine(expressions ...ast.LambdaNode) ``` Returns: [CombineNode](/kapacitor/v1.4/nodes/combine_node/) ### Count Count the number of points. ```javascript where|count(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### CumulativeSum Compute a cumulative sum of each point that is received. A point is emitted for every point collected. ```javascript where|cumulativeSum(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Deadman Helper function for creating an alert on low throughput, a.k.a. deadman's switch. - Threshold -- trigger alert if throughput drops below threshold in points/interval. - Interval -- how often to check the throughput. - Expressions -- optional list of expressions to also evaluate. Useful for time of day alerting. Example: ```javascript var data = stream |from()... // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s. data |deadman(100.0, 10s) //Do normal processing of data data... ``` The above is equivalent to this Example: ```javascript var data = stream |from()... // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s. data |stats(10s) .align() |derivative('emitted') .unit(10s) .nonNegative() |alert() .id('node \'stream0\' in task \'{{ .TaskName }}\'') .message('{{ .ID }} is {{ if eq .Level "OK" }}alive{{ else }}dead{{ end }}: {{ index .Fields "emitted" | printf "%0.3f" }} points/10s.') .crit(lambda: "emitted" <= 100.0) //Do normal processing of data data... ``` The `id` and `message` alert properties can be configured globally via the 'deadman' configuration section. Since the [AlertNode](/kapacitor/v1.4/nodes/alert_node/) is the last piece it can be further modified as usual. Example: ```javascript var data = stream |from()... // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s. data |deadman(100.0, 10s) .slack() .channel('#dead_tasks') //Do normal processing of data data... ``` You can specify additional lambda expressions to further constrain when the deadman's switch is triggered. Example: ```javascript var data = stream |from()... // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s. // Only trigger the alert if the time of day is between 8am-5pm. data |deadman(100.0, 10s, lambda: hour("time") >= 8 AND hour("time") <= 17) //Do normal processing of data data... ``` ```javascript where|deadman(threshold float64, interval time.Duration, expr ...ast.LambdaNode) ``` Returns: [AlertNode](/kapacitor/v1.4/nodes/alert_node/) ### Default Create a node that can set defaults for missing tags or fields. ```javascript where|default() ``` Returns: [DefaultNode](/kapacitor/v1.4/nodes/default_node/) ### Delete Create a node that can delete tags or fields. ```javascript where|delete() ``` Returns: [DeleteNode](/kapacitor/v1.4/nodes/delete_node/) ### Derivative Create a new node that computes the derivative of adjacent points. ```javascript where|derivative(field string) ``` Returns: [DerivativeNode](/kapacitor/v1.4/nodes/derivative_node/) ### Difference Compute the difference between points independent of elapsed time. ```javascript where|difference(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Distinct Produce batch of only the distinct points. ```javascript where|distinct(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Ec2Autoscale Create a node that can trigger autoscale events for a ec2 autoscalegroup. ```javascript where|ec2Autoscale() ``` Returns: [Ec2AutoscaleNode](/kapacitor/v1.4/nodes/ec2_autoscale_node/) ### Elapsed Compute the elapsed time between points ```javascript where|elapsed(field string, unit time.Duration) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Eval Create an eval node that will evaluate the given transformation function to each data point. A list of expressions may be provided and will be evaluated in the order they are given. The results are available to later expressions. ```javascript where|eval(expressions ...ast.LambdaNode) ``` Returns: [EvalNode](/kapacitor/v1.4/nodes/eval_node/) ### First Select the first point. ```javascript where|first(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Flatten Flatten points with similar times into a single point. ```javascript where|flatten() ``` Returns: [FlattenNode](/kapacitor/v1.4/nodes/flatten_node/) ### GroupBy Group the data by a set of tags. Can pass literal * to group by all dimensions. Example: ```javascript |groupBy(*) ``` ```javascript where|groupBy(tag ...interface{}) ``` Returns: [GroupByNode](/kapacitor/v1.4/nodes/group_by_node/) ### HoltWinters Compute the holt-winters (/{{< latest "influxdb" "v1" >}}/query_language/functions/#holt-winters) forecast of a data set. ```javascript where|holtWinters(field string, h int64, m int64, interval time.Duration) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### HoltWintersWithFit Compute the holt-winters (/{{< latest "influxdb" "v1" >}}/query_language/functions/#holt-winters) forecast of a data set. This method also outputs all the points used to fit the data in addition to the forecasted data. ```javascript where|holtWintersWithFit(field string, h int64, m int64, interval time.Duration) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### HttpOut Create an HTTP output node that caches the most recent data it has received. The cached data is available at the given endpoint. The endpoint is the relative path from the API endpoint of the running task. For example, if the task endpoint is at `/kapacitor/v1/tasks/` and endpoint is `top10`, then the data can be requested from `/kapacitor/v1/tasks//top10`. ```javascript where|httpOut(endpoint string) ``` Returns: [HTTPOutNode](/kapacitor/v1.4/nodes/http_out_node/) ### HttpPost Creates an HTTP Post node that POSTS received data to the provided HTTP endpoint. HttpPost expects 0 or 1 arguments. If 0 arguments are provided, you must specify an endpoint property method. ```javascript where|httpPost(url ...string) ``` Returns: [HTTPPostNode](/kapacitor/v1.4/nodes/http_post_node/) ### InfluxDBOut Create an influxdb output node that will store the incoming data into InfluxDB. ```javascript where|influxDBOut() ``` Returns: [InfluxDBOutNode](/kapacitor/v1.4/nodes/influx_d_b_out_node/) ### Join Join this node with other nodes. The data is joined on timestamp. ```javascript where|join(others ...Node) ``` Returns: [JoinNode](/kapacitor/v1.4/nodes/join_node/) ### K8sAutoscale Create a node that can trigger autoscale events for a kubernetes cluster. ```javascript where|k8sAutoscale() ``` Returns: [K8sAutoscaleNode](/kapacitor/v1.4/nodes/k8s_autoscale_node/) ### KapacitorLoopback Create an kapacitor loopback node that will send data back into Kapacitor as a stream. ```javascript where|kapacitorLoopback() ``` Returns: [KapacitorLoopbackNode](/kapacitor/v1.4/nodes/kapacitor_loopback_node/) ### Last Select the last point. ```javascript where|last(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Log Create a node that logs all data it receives. ```javascript where|log() ``` Returns: [LogNode](/kapacitor/v1.4/nodes/log_node/) ### Max Select the maximum point. ```javascript where|max(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Mean Compute the mean of the data. ```javascript where|mean(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Median Compute the median of the data. Note, this method is not a selector, if you want the median point use `.percentile(field, 50.0)`. ```javascript where|median(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Min Select the minimum point. ```javascript where|min(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Mode Compute the mode of the data. ```javascript where|mode(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### MovingAverage Compute a moving average of the last window points. No points are emitted until the window is full. ```javascript where|movingAverage(field string, window int64) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Percentile Select a point at the given percentile. This is a selector function, no interpolation between points is performed. ```javascript where|percentile(field string, percentile float64) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Sample Create a new node that samples the incoming points or batches. One point will be emitted every count or duration specified. ```javascript where|sample(rate interface{}) ``` Returns: [SampleNode](/kapacitor/v1.4/nodes/sample_node/) ### Shift Create a new node that shifts the incoming points or batches in time. ```javascript where|shift(shift time.Duration) ``` Returns: [ShiftNode](/kapacitor/v1.4/nodes/shift_node/) ### Sideload Create a node that can load data from external sources ```javascript where|sideload() ``` Returns: [SideloadNode](/kapacitor/v1.4/nodes/sideload_node/) ### Spread Compute the difference between `min` and `max` points. ```javascript where|spread(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### StateCount Create a node that tracks number of consecutive points in a given state. ```javascript where|stateCount(expression ast.LambdaNode) ``` Returns: [StateCountNode](/kapacitor/v1.4/nodes/state_count_node/) ### StateDuration Create a node that tracks duration in a given state. ```javascript where|stateDuration(expression ast.LambdaNode) ``` Returns: [StateDurationNode](/kapacitor/v1.4/nodes/state_duration_node/) ### Stats Create a new stream of data that contains the internal statistics of the node. The interval represents how often to emit the statistics based on real time. This means the interval time is independent of the times of the data points the source node is receiving. ```javascript where|stats(interval time.Duration) ``` Returns: [StatsNode](/kapacitor/v1.4/nodes/stats_node/) ### Stddev Compute the standard deviation. ```javascript where|stddev(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Sum Compute the sum of all values. ```javascript where|sum(field string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### SwarmAutoscale Create a node that can trigger autoscale events for a docker swarm cluster. ```javascript where|swarmAutoscale() ``` Returns: [SwarmAutoscaleNode](/kapacitor/v1.4/nodes/swarm_autoscale_node/) ### Top Select the top `num` points for `field` and sort by any extra tags or fields. ```javascript where|top(num int64, field string, fieldsAndTags ...string) ``` Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/) ### Union Perform the union of this node and all other given nodes. ```javascript where|union(node ...Node) ``` Returns: [UnionNode](/kapacitor/v1.4/nodes/union_node/) ### Where Create a new node that filters the data stream by a given expression. ```javascript where|where(expression ast.LambdaNode) ``` Returns: [WhereNode](/kapacitor/v1.4/nodes/where_node/) ### Window Create a new node that windows the stream by time. NOTE: Window can only be applied to stream edges. ```javascript where|window() ``` Returns: [WindowNode](/kapacitor/v1.4/nodes/window_node/)