docs-v2/content/kapacitor/v1.5/nodes/alert_node.md

1979 lines
63 KiB
Markdown

---
title: AlertNode
description: >
A Kapacitor AlertNode triggers an event of varying severity levels and passes the event to alert handlers. The criteria for triggering an alert is specified using a lambda expression.
note: Auto generated by tickdoc
menu:
kapacitor_1_5_ref:
name: AlertNode
identifier: alert_node
weight: 10
parent: nodes
---
The `alert` node triggers an event of varying severity levels and passes the
event to [event handlers](/kapacitor/v1.5/event_handlers/). The criteria for
triggering an alert is specified via a [lambda expression](/kapacitor/v1.5/tick/expr/).
See [AlertNode.Info](/kapacitor/v1.5/nodes/alert_node/#info),
[AlertNode.Warn](/kapacitor/v1.5/nodes/alert_node/#warn),
and [AlertNode.Crit](/kapacitor/v1.5/nodes/alert_node/#crit) below.
### Constructor
| Chaining method | Description |
|:---------|:---------|
| **alert&nbsp;(&nbsp;)** | Create an alert node, which can trigger alerts. <br> <br>To dynamically construct a custom HTTP body or URL, use an [**alert template**](/kapacitor/v1.5/event_handlers/post/#alert-templates). For example, `httpPost('localhost/?host={{ index .Tags "host"}}&cpu={{ index .Tags "cpu" }}')`. <br> <br> |
### Property methods
| Setters | description |
|:---|:---|
| **[alerta](#alerta) \( \)** | Send the alert to Alerta. |
| **[all](#all)&nbsp;(&nbsp;)** | Indicates an alert should trigger only if all points in a batch match the criteria. Does not apply to stream alerts. |
| **[bigPanda](#bigpanda) \( \)** | Send the alert to BigPanda. |
| **[crit](#crit)&nbsp;(&nbsp;`value`&nbsp;`ast.LambdaNode`)** | Filter expression for the CRITICAL alert level. An empty value indicates the level is invalid and is skipped. |
| **[critReset](#critreset)&nbsp;(&nbsp;`value`&nbsp;`ast.LambdaNode`)** | Filter expression for resetting the CRITICAL alert level to lower level. |
| **[details](#details)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Template for constructing a detailed HTML message for the alert. The same template data is available as the AlertNode.Message property, in addition to a Message field that contains the rendered Message value. |
| **[discord](#discord)&nbsp;(&nbsp;)** | Send the alert to Discord. |
| **[durationField](#durationfield)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Optional field key to add the alert duration to the data. The duration is always in units of nanoseconds. |
| **[email](#email)&nbsp;(&nbsp;`to`&nbsp;`...string`)** | Email the alert data. |
| **[exec](#exec)&nbsp;(&nbsp;`executable`&nbsp;`string`,&nbsp;`args`&nbsp;`...string`)** | Execute a command whenever an alert is triggered and pass the alert data over STDIN in JSON format. |
| **[flapping](#flapping)&nbsp;(&nbsp;`low`&nbsp;`float64`,&nbsp;`high`&nbsp;`float64`)** | Perform flap detection on the alerts. The method used is similar method to Nagios: https://assets.nagios.com/downloads/nagioscore/docs/nagioscore/3/en/flapping.html |
| **[hipChat](#hipchat)&nbsp;(&nbsp;)** | Send the alert to HipChat. |
| **[history](#history)&nbsp;(&nbsp;`value`&nbsp;`int64`)** | Number of previous states to remember when computing flapping levels and checking for state changes. Minimum value is 2 in order to keep track of current and previous states. |
| **[id](#id)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Template for constructing a unique ID for a given alert. |
| **[idField](#idfield)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Optional field key to add to the data, containing the alert ID as a string. |
| **[idTag](#idtag)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Optional tag key to use when tagging the data with the alert ID. |
| **[info](#info)&nbsp;(&nbsp;`value`&nbsp;`ast.LambdaNode`)** | Filter expression for the INFO alert level. An empty value indicates the level is invalid and is skipped. |
| **[inhibit](#inhibit)&nbsp;(&nbsp;`category`&nbsp;`string`,&nbsp;`equalTags`&nbsp;`...string`)** | Inhibit other alerts in a category. The equal tags provides a list of tags that must be equal in order for an alert event to be inhibited. |
| **[infoReset](#inforeset)&nbsp;(&nbsp;`value`&nbsp;`ast.LambdaNode`)** | Filter expression for resetting the INFO alert level to lower level. |
| **[kafka](#kafka)&nbsp;(&nbsp;)** | Send the alert to a Kafka cluster. |
| **[levelField](#levelfield)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Optional field key to add to the data, containing the alert level as a string. |
| **[levelTag](#leveltag)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Optional tag key to use when tagging the data with the alert level. |
| **[log](#log)&nbsp;(&nbsp;`filepath`&nbsp;`string`)** | Log JSON alert data to file. One event per line. Must specify the absolute path to the log file. It will be created if it does not exist. Example: stream |alert() .log('/tmp/alert') |
| **[message](#message)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Template for constructing a meaningful message for the alert. |
| **[messageField](#messagefield)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Optional field key to add to the data, containing the alert message. |
| **[mqtt](#mqtt)&nbsp;(&nbsp;`topic`&nbsp;`string`)** | Send alert to an MQTT broker |
| **[noRecoveries](#norecoveries)&nbsp;(&nbsp;)** | Do not send recovery alerts. |
| **[opsGenie](#opsgenie-v1)&nbsp;(&nbsp;)** | Send alert to OpsGenie using OpsGenie's v1 API. <em style="opacity: .5">(Deprecated)</em> |
| **[opsGenie2](#opsgenie-v2)&nbsp;(&nbsp;)** | Send alert to OpsGenie using OpsGenie's v2 API. |
| **[pagerDuty](#pagerduty-v1)&nbsp;(&nbsp;)** | Send the alert to PagerDuty using PagerDuty's v1 API. <em style="opacity: .5">(Deprecated)</em> |
| **[pagerDuty2](#pagerduty-v2)&nbsp;(&nbsp;)** | Send the alert to PagerDuty using PagerDuty's v2 API. |
| **[post](#post)&nbsp;(&nbsp;`urls`&nbsp;`...string`)** | HTTP POST JSON alert data to a specified URL. |
| **[pushover](#pushover)&nbsp;(&nbsp;)** | Send the alert to Pushover. |
| **[quiet](#quiet)&nbsp;(&nbsp;)** | Suppresses all error logging events from this node. |
| **[sensu](#sensu)&nbsp;(&nbsp;)** | Send the alert to Sensu. |
| **[slack](#slack)&nbsp;(&nbsp;)** | Send the alert to Slack. |
| **[snmpTrap](#snmptrap)&nbsp;(&nbsp;`trapOid`&nbsp;`string`)** | Send the alert using SNMP traps. |
| **[stateChangesOnly](#statechangesonly)&nbsp;(&nbsp;`maxInterval`&nbsp;`...time.Duration`)** | Only sends events where the state changed. Each different alert level OK, INFO, WARNING, and CRITICAL are considered different states. |
| **[talk](#talk)&nbsp;(&nbsp;)** | Send the alert to Talk. |
| **[tcp](#tcp)&nbsp;(&nbsp;`address`&nbsp;`string`)** | Send JSON alert data to a specified address over TCP. |
| **[telegram](#telegram)&nbsp;(&nbsp;)** | Send the alert to Telegram. |
| **[topic](#topic)&nbsp;(&nbsp;`value`&nbsp;`string`)** | Topic specifies the name of an alert topic to which, alerts will be published. Alert handlers can be configured per topic, see the API documentation. |
| **[victorOps](#victorops)&nbsp;(&nbsp;)** | Send alert to VictorOps. |
| **[warn](#warn)&nbsp;(&nbsp;`value`&nbsp;`ast.LambdaNode`)** | Filter expression for the WARNING alert level. An empty value indicates the level is invalid and is skipped. |
| **[warnReset](#warnreset)&nbsp;(&nbsp;`value`&nbsp;`ast.LambdaNode`)** | Filter expression for resetting the WARNING alert level to lower level. |
### Chaining methods
[Alert](#alert),
[Barrier](#barrier),
[Bottom](#bottom),
[ChangeDetect](#changedetect),
[Combine](#combine),
[Count](#count),
[CumulativeSum](#cumulativesum),
[Deadman](#deadman),
[Default](#default),
[Delete](#delete),
[Derivative](#derivative),
[Difference](#difference),
[Distinct](#distinct),
[Ec2Autoscale](#ec2autoscale),
[Elapsed](#elapsed),
[Eval](#eval),
[First](#first),
[Flatten](#flatten),
[GroupBy](#groupby),
[HoltWinters](#holtwinters),
[HoltWintersWithFit](#holtwinterswithfit),
[HttpOut](#httpout),
[HttpPost](#httppost),
[InfluxDBOut](#influxdbout),
[Join](#join),
[K8sAutoscale](#k8sautoscale),
[KapacitorLoopback](#kapacitorloopback),
[Last](#last),
[Max](#max),
[Mean](#mean),
[Median](#median),
[Min](#min),
[Mode](#mode),
[MovingAverage](#movingaverage),
[Percentile](#percentile),
[Sample](#sample),
[Shift](#shift),
[Sideload](#sideload),
[Spread](#spread),
[StateCount](#statecount),
[StateDuration](#stateduration),
[Stats](#stats),
[Stddev](#stddev),
[Sum](#sum),
[SwarmAutoscale](#swarmautoscale),
[Top](#top),
[Union](#union),
[Where](#where),
[Window](#window)
---
#### Available event handlers
Different event handlers can be configured for each [AlertNode.](/kapacitor/v1.5/nodes/alert_node/)
Some handlers like Email, HipChat, Sensu, Slack, OpsGenie, VictorOps, PagerDuty, Telegram and Talk have a configuration
option, `global`, that indicates that all alerts implicitly use the handler.
| Handler | Description |
| ------- | ----------- |
| [Alerta](#alerta) | Post alert message to Alerta. |
| [BigPanda](#bigpanda) | Post alert message to BigPanda. |
| [Discord](#discord) | Post alert message to Discord channel. |
| [email](#email) | Send and email with alert data. |
| [exec](#exec) | Execute a command passing alert data over STDIN. |
| [HipChat](#hipchat) | Post alert message to HipChat room. |
| [Kafka](#kafka) | Send alert to a Apache Kafka cluster. |
| [log](#log) | Log alert data to file. |
| [MQTT](#mqtt) | Post alert message to MQTT. |
| [OpsGenie v1](#opsgenie-v1) | Send alert to OpsGenie using their v1 API. <em style="opacity: .5">(Deprecated)</em> |
| [OpsGenie v2](#opsgenie-v2) | Send alert to OpsGenie using their v2 API. |
| [PagerDuty v1](#pagerduty-v1) | Send alert to PagerDuty using their v1 API. <em style="opacity: .5">(Deprecated)</em> |
| [PagerDuty v2](#pagerduty-v2) | Send alert to PagerDuty using their v2 API. |
| [post](#post) | HTTP POST data to a specified URL. |
| [Pushover](#pushover) | Send alert to Pushover. |
| [Sensu](#sensu) | Post alert message to Sensu client. |
| [Slack](#slack) | Post alert message to Slack channel. |
| [SNMPTrap](#snmptrap) | Trigger SNMP traps. |
| [Talk](#talk) | Post alert message to Talk client. |
| [tcp](#tcp) | Send data to a specified address via raw TCP. |
| [Telegram](#telegram) | Post alert message to Telegram client. |
| [VictorOps](#victorops) | Send alert to VictorOps. |
#### Alert event data
Each event that gets sent to a handler contains the following alert data:
| Name | Description |
| ---- | ----------- |
| **ID** | The ID of the alert, user defined. |
| **Message** | The alert message, user defined. |
| **Details** | The alert details, user defined HTML content. |
| **Time** | The time the alert occurred. |
| **Duration** | The duration of the alert in nanoseconds. |
| **Level** | One of OK, INFO, WARNING or CRITICAL. |
| **Data** | influxql.Result containing the data that triggered the alert. |
| **Recoverable** | Indicates whether the alert is auto-recoverable. Determined by the [`.noRecoveries()`](#norecoveries) property. |
Events are sent to handlers if the alert is in a state other than 'OK'
or the alert just changed to the 'OK' state from a non 'OK' state (a.k.a. the alert recovered).
Using the [AlertNode.StateChangesOnly](/kapacitor/v1.5/nodes/alert_node/#statechangesonly)
property events will only be sent to handlers if the alert changed state.
It is valid to configure multiple alert handlers, even with the same type.
Example:
```js
stream
.groupBy('service')
|alert()
.id('kapacitor/{{ index .Tags "service" }}')
.message('{{ .ID }} is {{ .Level }} value:{{ index .Fields "value" }}')
.info(lambda: "value" > 10)
.warn(lambda: "value" > 20)
.crit(lambda: "value" > 30)
.post("http://example.com/api/alert")
.post("http://another.example.com/api/alert")
.tcp("exampleendpoint.com:5678")
.email('oncall@example.com')
```
Each expression maintains its own state.
The order of execution for the expressions is not considered to be deterministic.
For each point an expression may or may not be evaluated.
If no expression is true then the alert is considered to be in the OK state.
Kapacitor supports alert reset expressions.
This way when an alert enters a state, it can only be lowered in severity if its
reset expression evaluates to true.
**Example:**
```js
stream
|from()
.measurement('cpu')
.where(lambda: "host" == 'serverA')
.groupBy('host')
|alert()
.info(lambda: "value" > 60)
.infoReset(lambda: "value" < 50)
.warn(lambda: "value" > 70)
.warnReset(lambda: "value" < 60)
.crit(lambda: "value" > 80)
.critReset(lambda: "value" < 70)
```
For example, given the following values, the corresponding alert states are:
| Value | Alert State |
| ----- | ----------- |
| 61 | INFO |
| 73 | WARNING |
| 64 | WARNING |
| 85 | CRITICAL |
| 62 | INFO |
| 56 | INFO |
| 47 | OK |
**Available Statistics:**
* `alerts_triggered`: Total number of alerts triggered
* `oks_triggered`: Number of OK alerts triggered
* `infos_triggered`: Number of Info alerts triggered
* `warns_triggered`: Number of Warn alerts triggered
* `crits_triggered`: Number of Crit alerts triggered
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
## Properties
Property methods modify state on the calling node.
They do not add another node to the pipeline, and always return a reference to the calling node.
Property methods are marked using the `.` operator.
### Alerta
Send the alert to Alerta.
Detailed configuration options and setup instructions are provided in the
[Alerta Event Handler](/kapacitor/v1.5/event_handlers/alerta/) article.
_**Example kapacitor.conf**_
```toml
[alerta]
enabled = true
url = "https://alerta.yourdomain"
token = "9hiWoDOZ9IbmHsOTeST123ABciWTIqXQVFDo63h9"
environment = "Production"
origin = "Kapacitor"
```
_**Example TICKscript**_
```js
stream
|alert()
.alerta()
.resource('Hostname or service')
.event('Something went wrong')
```
### All
Indicates an alert should trigger only if all points in a batch match the criteria.
Does not apply to stream alerts.
```js
alert.all()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### BigPanda
Send the alert to BigPanda.
Detailed configuration options and setup instructions are provided in the
[BigPanda Event Handler](/kapacitor/v1.5/event_handlers/bigpanda/) article.
_**Example kapacitor.conf**_
```toml
[bigpanda]
enabled = true
url = "https://api.bigpanda.io/data/v2/alerts"
token = "BigPanda-API-auth-bearer-token"
app-key = "BigPanda-integration-app-key"
```
_**Example TICKscript**_
```js
stream
|alert()
.bigPanda()
.appKey('fc39458f98e91eb0310258c3b725d643')
.primaryProperty('device')
.secondaryProperty('sensor_name')
.topic('bigpanda-topic')
```
### Category
Category places this alert in a named category.
Categories are used to [inhibit](#inhibit) alerts.
```js
alert.category(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Crit
Filter expression for the CRITICAL alert level.
An empty value indicates the level is invalid and is skipped.
```js
alert.crit(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### CritReset
Filter expression for resetting the CRITICAL alert level to lower level.
```js
alert.critReset(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Details
Template for constructing a detailed HTML message for the alert.
The same template data is available as the [AlertNode.Message](/kapacitor/v1.5/nodes/alert_node/#message) property,
in addition to a Message field that contains the rendered Message value.
The intent is that the Message property be a single line summary while the
Details property is a more detailed message possibly spanning multiple lines,
and containing HTML formatting.
This template is rendered using the html/template package in Go so safe and
valid HTML is generated.
The `json` method is available within the template to convert any variable to a valid
JSON string.
_**xExample:**_
```js
|alert()
.id('{{ .Name }}')
.details('''
<h1>{{ .ID }}</h1>
<b>{{ .Message }}</b>
Value: {{ index .Fields "value" }}
''')
.email()
```
**Default:** `{{ json . }}`
```js
alert.details(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Discord
Send the alert to Discord.
Detailed configuration options and setup instructions are provided in the
[Discord Event Handler](/kapacitor/v1.5/event_handlers/discord/) article.
_**Example kapacitor.conf**_
```toml
[discord]
enabled = true
url = "https://discordapp.com/api/webhooks/xxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
```
_**Example TICKscript**_
```js
stream
|alert()
.discord()
.embedTitle('Alert!')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### DurationField
Optional field key to add the alert duration to the data.
The duration is always in units of nanoseconds.
```js
alert.durationField(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Email
Email the alert data to specified "To" email addresses.
Detailed configuration options and setup instructions are provided in the
[Email Event Handler](/kapacitor/v1.5/event_handlers/email/) article.
_**Example kapacitor.conf**_
```toml
[smtp]
enabled = true
host = "localhost"
port = 25
username = "xxxx"
password = "xxxx"
from = "kapacitor@example.com"
to = ["oncall@example.com"]
global = true
state-changes-only = true
```
_**Example TICKscript**_
```js
|alert()
.id('{{ .Name }}')
// Email subject
.message('{{ .ID }}:{{ .Level }}')
// Email body as HTML
.details('''
<h1>{{ .ID }}</h1>
<b>{{ .Message }}</b>
Value: {{ index .Fields "value" }}
''')
.email()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Exec
Execute a command whenever an alert is triggered and pass the alert data over STDIN in JSON format.
Detailed usage instructions and examples are provided in the
[Exec Event Handler](/kapacitor/v1.5/event_handlers/exec/) article.
```js
// Pattern
alert.exec(executable string, args ...string)
// Example
alert.exec('/usr/bin/python', 'myscript.py')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Flapping
Perform flap detection on the alerts.
The method used is similar method to
[Nagios flapping](https://assets.nagios.com/downloads/nagioscore/docs/nagioscore/3/en/flapping.html)
Each different alerting level is considered a different state.
The low and high thresholds are inverted thresholds of a percentage of state changes.
Meaning that if the percentage of state changes goes above the `high`
threshold, the alert enters a flapping state. The alert remains in the flapping state
until the percentage of state changes goes below the `low` threshold.
Typical values are low: 0.25 and high: 0.5. The percentage values represent the number state changes
over the total possible number of state changes. A percentage change of 0.5 means that the alert changed
state in half of the recorded history, and remained the same in the other half of the history.
```js
// Pattern
alert.flapping(low float64, high float64)
// Example
alert.flapping(0.25, 0.5)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Kafka
Send the alert to an Apache Kafka cluster.
Detailed configuration options and setup instructions are provided in the
[Kafka Event Handler](/kapacitor/v1.5/event_handlers/kafka/) article.
_**Example kapacitor.conf**_
```toml
[[kafka]]
enabled = true
id = "localhost"
timeout = 10s
```
_**Example TICKscript**_
```js
stream
|alert()
.kafka()
.cluster('kafka-cluster')
.kafkaTopic('kafka-topic-name')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### History
Number of previous states to remember when computing flapping levels and
checking for state changes.
Minimum value is 2 in order to keep track of current and previous states.
**Default:** 21
```js
// Pattern
alert.history(value int64)
// Example
alert.history(21)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HipChat
Send the alert to HipChat.
Detailed configuration options and setup instructions are provided in the
[HipChat Event Handler](/kapacitor/v1.5/event_handlers/hipchat/) article.
_**Example kapacitor.conf**_
```toml
[hipchat]
enabled = true
url = "https://orgname.hipchat.com/v2/room"
room = "4189212"
token = "9hiWoDOZ9IbmHsOTeST123ABciWTIqXQVFDo63h9"
```
_**Example TICKscript**_
```js
stream
|alert()
.hipChat()
.room('Kapacitor')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Id
Template for constructing a unique ID for a given alert.
_**Available template data**_
| Data Name | Description |
| --------- | ----------- |
| **Name** | Measurement name. |
| **TaskName** | The name of the task |
| **Group** | Concatenation of all group-by tags of the form `[key=value,]+`. If no groupBy is performed equal to literal 'nil'. |
| **Tags** | Map of tags. Use `{{ index .Tags "key" }}`` to get a specific tag value. |
| **ServerInfo** | Information about the running server. Available nested fields are `Hostname`, `ClusterID` and `ServerID`. |
**Default:** {{ .Name }}:{{ .Group }}
```js
// Pattern
alert.id(value string)
// Example
alert.id('{{ .Name }}:{{ .Group }}')
```
_**Example: ID template using name and group**_
```js
stream
|from()
.measurement('cpu')
.groupBy('cpu')
|alert()
.id('kapacitor/{{ .Name }}/{{ .Group }}')
```
Resulting ID: `kapacitor/cpu/cpu=cpu0`
_**Example: ID template using a tag**_
```js
stream
|from()
.measurement('cpu')
.groupBy('service')
|alert()
.id('kapacitor/{{ index .Tags "service" }}')
```
Resulting ID: `kapacitor/authentication`
_**Example: ID template using multiple tags**_
```js
stream
|from()
.measurement('cpu')
.groupBy('service', 'host')
|alert()
.id('kapacitor/{{ index .Tags "service" }}/{{ index .Tags "host" }}')
```
Resulting ID: `kapacitor/authentication/auth001.example.com`
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### IdField
Optional field key to add to the data, containing the alert ID as a string.
```js
// Pattern
alert.idField(value string)
// Example
alert.idField('id')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### IdTag
Optional tag key to use when tagging the data with the alert ID.
```js
// Pattern
alert.idTag(value string)
// Example
alert.idTag('alertID')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Info
Filter expression for the INFO alert level.
An empty value indicates the level is invalid and is skipped.
```js
// Pattern
alert.info(value ast.LambdaNode)
// Example
alert.info(lambda: 'usage_idle' < 60)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### InfoReset
Filter expression for resetting the INFO alert level to lower level.
```js
// Pattern
alert.infoReset(value ast.LambdaNode)
// Example
alert.infoReset(lamda: 'usage_idle' > 60)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Inhibit
Inhibit other alerts in a category.
The equal tags provides a list of tags that must be equal in order for an alert event to be inhibited.
The following two TICKscripts demonstrate how to use the inhibit feature:
```js
//cpu_alert.tick
stream
|from()
.measurement('cpu')
.groupBy('host')
|alert()
.category('system_alerts')
.crit(lambda: "usage_idle" < 10.0)
```
```js
//host_alert.tick
stream
|from()
.measurement('uptime')
.groupBy('host')
|deadman(0.0, 1m)
.inhibit('system_alerts', 'host')
```
The deadman is a type of alert node and can be used to inhibit all alerts in the `system_alerts` category when triggered.
The `host` argument to the inhibit function says that the host tag must be equal between the CPU alert and the host alert in order for it to be inhibited.
This has the effect of the deadman alerts only inhibiting CPU alerts for hosts that are currently dead.
```js
alert.inhibit(category string, equalTags ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Kafka
Send the alert to a Kafka topic.
Detailed setup and usage instructions are provided in the
[Kafka Event Handler](/kapacitor/v1.5/event_handlers/kafka/) article.
_**Example: kapacitor.conf**_
```toml
[[kafka]]
enabled = true
id = "default"
brokers = ["localhost:9092"]
```
_**Example: TICKscript**_
```js
stream
|alert()
.kafka()
.cluster('default')
.kafkaTopic('alerts')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### LevelField
Optional field key to add to the data, containing the alert level as a string.
```js
// Pattern
alert.levelField(value string)
// Example
alert.levelField('INFO')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### LevelTag
Optional tag key to use when tagging the data with the alert level.
```js
// Pattern
alert.levelTag(value string)
// Example
alert.levelTag('level')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Log
Log JSON alert data to file.
Detailed setup and usage instructions are provided in the
[Log Event Handler](/kapacitor/v1.5/event_handlers/log/) article.
_**Example TICKscript**_
```js
stream
|alert()
.log('/tmp/alert')
.mode(0644)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Message
Template for constructing a meaningful message for the alert.
_**Available template data**_
| Data Name | Description |
| --------- | ----------- |
| **ID** | The ID of the alert. |
| **Name** | Measurement name. |
| **TaskName** | The name of the task |
| **Group** | Concatenation of all group-by tags of the form 1. If no groupBy is performed equal to literal 'nil'. |
| **Tags** | Map of tags. Use `{{ index .Tags "key" }}` to get a specific tag value. |
| **Level** | Alert Level - `INFO`, `WARNING`, `CRITICAL`. |
| **Fields** | Map of fields. Use `{{ index .Fields "key" }}` to get a specific field value. |
| **Time** | The time of the point that triggered the event. Default format is `YYYY-MM-DD 00:00:00 +0000 UTC` |
| **Duration** | The duration of the alert. |
**Default:** `{{ .ID }} is {{ .Level }}`
_**Example:**_
```js
stream
|from()
.measurement('cpu')
.groupBy('service', 'host')
|alert()
.id('{{ index .Tags "service" }}/{{ index .Tags "host" }}')
.message('{{ .ID }} is {{ .Level}} value: {{ index .Fields "value" }}')
```
Resulting Message: authentication/auth001.example.com is CRITICAL value:42
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### MessageField
Optional field key to add to the data containing the alert message.
```js
// Pattern
alert.messageField(value string)
// Example
alert.messageField('message')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### MQTT
Send alert to an MQTT broker.
Detailed configuration options and usage instructions are provided in the
[MQTT Event Handler](/kapacitor/v1.5/event_handlers/mqtt/) article.
_**Example kapacitor.conf**_
```toml
[[mqtt]]
enabled = true
name = "localhost"
default = true
url = "tcp://localhost:1883"
client-id = "kapacitor"
username = "myusername"
password = "mysupersecretpassw0rd"
```
_**Example TICKscript**_
```js
stream
|alert()
.mqtt('topic')
.brokerName('localhost')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### NoRecoveries
Do not send recovery alerts. Sets `recoverable` alert data field to `false`.
```js
alert.noRecoveries()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### OpsGenie v1
Send alert to OpsGenie using OpsGenie's v1 API.
Detailed configuration options and setup instructions are provided in the
[OpsGenie v1 Event Handler](/kapacitor/v1.5/event_handlers/opsgenie/v1/) article.
_**Example kapacitor.conf**_
```toml
[opsgenie]
enabled = true
api-key = "xxxxx"
teams = ["everyone"]
recipients = ["jim", "bob"]
```
_**Example TICKscript**_
```js
stream
|alert()
.opsGenie()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### OpsGenie v2
Send alert to OpsGenie using OpsGenie's v2 API.
Detailed configuration options and setup instructions are provided in the
[OpsGenie v2 Event Handler](/kapacitor/v1.5/event_handlers/opsgenie/v2/) article.
_**Example kapacitor.conf**_
```toml
[opsgenie2]
enabled = true
api-key = "xxxxx"
teams = ["everyone"]
recipients = ["jim", "bob"]
```
_**Example TICKscript**_
```js
stream
|alert()
.opsGenie2()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### PagerDuty v1
Send the alert to PagerDuty using PagerDuty's v1 API.
Detailed configuration options and setup instructions are provided in the
[PagerDuty v1 Event Handler](/kapacitor/v1.5/event_handlers/pagerduty/v1/) article.
_**Example kapacitor.conf**_
```toml
[pagerduty]
enabled = true
service-key = "xxxx"
url = "https://events.pagerduty.com/generic/2010-04-15/create_event.json"
```
_**Example TICKscript**_
```js
stream
|alert()
.pagerDuty()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### PagerDuty v2
Send the alert to PagerDuty using PagerDuty's v2 API.
Detailed configuration options and setup instructions are provided in the
[PagerDuty v2 Event Handler](/kapacitor/v1.5/event_handlers/pagerduty/v2/) article.
_**Example kapacitor.conf**_
```toml
[pagerduty2]
enabled = true
routing-key = "xxxx"
url = "https://events.pagerduty.com/v2/enqueue"
```
_**Example TICKscript**_
```js
stream
|alert()
.pagerDuty2()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Post
HTTP POST JSON alert data to a specified URL.
Detailed configuration options and setup instructions are provided in the
[Post Event Handler](/kapacitor/v1.5/event_handlers/post/) article.
_**Example TICKscript**_
```js
stream
|alert()
.post('http://example.com')
.captureResponse()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Pushover
Send the alert to Pushover.
Detailed configuration options and setup instructions are provided in the
[Pushover Event Handler](/kapacitor/v1.5/event_handlers/pushover/) article.
_**Example kapacitor.conf**_
```toml
[pushover]
enabled = true
token = "9hiWoDOZ9IbmHsOTeST123ABciWTIqXQVFDo63h9"
user_key = "Pushover"
```
_**Example TICKscript**_
```js
stream
|alert()
.pushover()
.sound('siren')
.user_key('other user')
.device('mydev')
.title('mytitle')
.uRL('myurl')
.URLTitle('mytitle')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Quiet
Suppress all error logging events from this node.
```js
alert.quiet()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sensu
Send the alert to Sensu.
Detailed configuration options and setup instructions are provided in the
[Sensu Event Handler](/kapacitor/v1.5/event_handlers/sensu/) article.
_**Example kapacitor.conf*_
```toml
[sensu]
enabled = true
url = "http://sensu:3030"
source = "Kapacitor"
handlers = ["sns","slack"]
```
_**Example TICKscript**_
```js
stream
|alert()
.sensu()
.handlers('sns','slack')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Slack
Send the alert to Slack.
Detailed configuration options and setup instructions are provided in the
[Slack Event Handler](/kapacitor/v1.5/event_handlers/slack/) article.
_**Example kapacitor.conf**_
```toml
[slack]
enabled = true
url = "https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx"
channel = "#general"
```
_**Example TICKscript**_
```js
stream
|alert()
.slack()
.channel('#alerts')
.channel('@jsmith')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### SnmpTrap
Send the alert using SNMP traps.
Detailed configuration options and setup instructions are provided in the
[SNMP Trap Event Handler](/kapacitor/v1.5/event_handlers/snmptrap/) article.
_**Example kapacitor.conf**_
```toml
[snmptrap]
enabled = true
addr = "127.0.0.1:9162"
community = "public"
```
_**Example TICKscript**_
```js
stream
|alert()
.snmpTrap('1.3.6.1.2.1.1')
.data('1.3.6.1.2.1.1.6', 'i', '{{ index .Field "value" }}')
.data('1.3.6.1.2.1.1.7', 's', '{{ .Message }}')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### StateChangesOnly
Only sends events where the state changed.
Each different alert level OK, INFO, WARNING, and CRITICAL
are considered different states.
_**Example**_
```js
stream
|from()
.measurement('cpu')
|window()
.period(10s)
.every(10s)
|alert()
.crit(lambda: "value" > 10)
.stateChangesOnly()
.slack()
```
If the "value" is greater than 10 for a total of 60s, then
only two events will be sent. First, when the value crosses
the threshold, and second, when it falls back into an OK state.
Without stateChangesOnly, the alert would have triggered 7 times:
6 times for each 10s period where the condition was met and once more
for the recovery.
An optional maximum interval duration can be provided.
An event will not be ignored (aka trigger an alert) if more than the maximum interval has elapsed
since the last alert.
_**Example**_
```js
stream
// ...
|alert()
.crit(lambda: "value" > 10)
.stateChangesOnly(10m)
.slack()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Talk
Send the alert to Talk.
Detailed configuration options and setup instructions are provided in the
[Talk Event Handler](/kapacitor/v1.5/event_handlers/talk/) article.
_**Example kapacitor.conf**_
```toml
[talk]
enabled = true
url = "https://jianliao.com/v2/services/webhook/uuid"
author_name = "Kapacitor"
```
_**Example TICKscript**_
```js
stream
alert()
.talk()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### TCP
Send JSON alert data to a specified address over TCP.
Detailed usage instructions are provided in the
[TCPEvent Handler](/kapacitor/v1.5/event_handlers/tcp/) article.
```js
// Pattern
alert.tcp(address string)
// Example
alert.tcp('127.0.0.1:7777')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Telegram
Send the alert to Telegram.
Detailed configuration options and setup instructions are provided in the
[Telegram Event Handler](/kapacitor/v1.5/event_handlers/telegram/) article.
_**Example kapacitor.conf**_
```toml
[telegram]
enabled = true
token = "123456789:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
chat-id = "xxxxxxxxx"
parse-mode = "Markdown"
disable-web-page-preview = true
disable-notification = false
```
_**Example TICKscript**_
```js
stream
|alert()
.telegram()
.chatId('xxxxxxx')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Topic
Topic specifies the name of an alert topic to which alerts will be published.
Alert handlers can be configured per topic. See the [API documentation](/kapacitor/v1.5/working/api#topics).
```js
// Pattern
alert.topic(value string)
// Example
alert.topic('cpu')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### VictorOps
Send alert to VictorOps.
Detailed configuration options and setup instructions are provided in the
[VictorOps Event Handler](/kapacitor/v1.5/event_handlers/victorops/) article.
_**Example kapacitor.conf**_
```toml
[victorops]
enabled = true
api-key = "xxxxx"
routing-key = "everyone"
```
_**Example TICKscript**_
```js
stream
|alert()
.victorOps()
.routingKey('team_rocket')
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Warn
Filter expression for the WARNING alert level.
An empty value indicates the level is invalid and is skipped.
```js
// Pattern
alert.warn(value ast.LambdaNode)
// Example
alert.warn(lambda: 'usage_idle' < 20)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### WarnReset
Filter expression for resetting the WARNING alert level to lower level.
```js
// Pattern
alert.warnReset(value ast.LambdaNode)
// Example
alert.warnReset(lambda: 'usage_idle' > 20)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
## Chaining Methods
Chaining methods create a new node in the pipeline as a child of the calling node.
They do not modify the calling node.
Chaining methods are marked using the `|` operator.
### Alert
Create an alert node, which can trigger alerts.
```js
alert|alert()
```
Returns: [AlertNode](/kapacitor/v1.5/nodes/alert_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Barrier
Create a new Barrier node that emits a BarrierMessage periodically.
One BarrierMessage will be emitted every period duration.
```js
alert|barrier()
```
Returns: [BarrierNode](/kapacitor/v1.5/nodes/barrier_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Bottom
Select the bottom `num` points for `field` and sort by any extra tags or fields.
```js
alert|bottom(num int64, field string, fieldsAndTags ...string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### ChangeDetect
Create a new node that only emits new points if different from the previous point.
```js
alert|changeDetect(field string)
```
Returns: [ChangeDetectNode](/kapacitor/v1.5/nodes/change_detect_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Combine
Combine this node with itself. The data is combined on timestamp.
```js
alert|combine(expressions ...ast.LambdaNode)
```
Returns: [CombineNode](/kapacitor/v1.5/nodes/combine_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Count
Count the number of points.
```js
alert|count(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### CumulativeSum
Compute a cumulative sum of each point that is received.
A point is emitted for every point collected.
```js
alert|cumulativeSum(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Deadman
Helper function for creating an alert on low throughput, a.k.a. deadman's switch.
- Threshold: trigger alert if throughput drops below threshold in points/interval.
- Interval: how often to check the throughput.
- Expressions: optional list of expressions to also evaluate. Useful for time of day alerting.
Example:
```js
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|deadman(100.0, 10s)
//Do normal processing of data
data...
```
The above is equivalent to this example:
```js
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|stats(10s)
.align()
|derivative('emitted')
.unit(10s)
.nonNegative()
|alert()
.id('node \'stream0\' in task \'{{ .TaskName }}\'')
.message('{{ .ID }} is {{ if eq .Level "OK" }}alive{{ else }}dead{{ end }}: {{ index .Fields "emitted" | printf "%0.3f" }} points/10s.')
.crit(lambda: "emitted" <= 100.0)
//Do normal processing of data
data...
```
The `id` and `message` alert properties can be configured globally via the 'deadman' configuration section.
Since the [AlertNode](/kapacitor/v1.5/nodes/alert_node/) is the last piece it can be further modified as usual.
Example:
```js
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|deadman(100.0, 10s)
.slack()
.channel('#dead_tasks')
//Do normal processing of data
data...
```
You can specify additional lambda expressions to further constrain when the deadman's switch is triggered.
Example:
```js
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
// Only trigger the alert if the time of day is between 8am-5pm.
data
|deadman(100.0, 10s, lambda: hour("time") >= 8 AND hour("time") <= 17)
//Do normal processing of data
data...
```
```js
alert|deadman(threshold float64, interval time.Duration, expr ...ast.LambdaNode)
```
Returns: [AlertNode](/kapacitor/v1.5/nodes/alert_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Default
Create a node that can set defaults for missing tags or fields.
```js
alert|default()
```
Returns: [DefaultNode](/kapacitor/v1.5/nodes/default_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Delete
Create a node that can delete tags or fields.
```js
alert|delete()
```
Returns: [DeleteNode](/kapacitor/v1.5/nodes/delete_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Derivative
Create a new node that computes the derivative of adjacent points.
```js
alert|derivative(field string)
```
Returns: [DerivativeNode](/kapacitor/v1.5/nodes/derivative_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Difference
Compute the difference between points independent of elapsed time.
```js
alert|difference(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Distinct
Produce batch of only the distinct points.
```js
alert|distinct(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Ec2Autoscale
Create a node that can trigger autoscale events for a ec2 autoscalegroup.
```js
alert|ec2Autoscale()
```
Returns: [Ec2AutoscaleNode](/kapacitor/v1.5/nodes/ec2_autoscale_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Elapsed
Compute the elapsed time between points.
```js
alert|elapsed(field string, unit time.Duration)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Eval
Create an eval node that will evaluate the given transformation function to each data point.
A list of expressions may be provided and will be evaluated in the order they are given.
The results are available to later expressions.
```js
alert|eval(expressions ...ast.LambdaNode)
```
Returns: [EvalNode](/kapacitor/v1.5/nodes/eval_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### First
Select the first point.
```js
alert|first(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Flatten
Flatten points with similar times into a single point.
```js
alert|flatten()
```
Returns: [FlattenNode](/kapacitor/v1.5/nodes/flatten_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### GroupBy
Group the data by a set of tags.
Can pass literal * to group by all dimensions.
Example:
```js
|groupBy(*)
```
```js
alert|groupBy(tag ...interface{})
```
Returns: [GroupByNode](/kapacitor/v1.5/nodes/group_by_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HoltWinters
Compute the Holt-Winters (/{{< latest "influxdb" "v1" >}}/query_language/functions/#holt-winters) forecast of a data set.
```js
alert|holtWinters(field string, h int64, m int64, interval time.Duration)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HoltWintersWithFit
Compute the Holt-Winters (/{{< latest "influxdb" "v1" >}}/query_language/functions/#holt-winters) forecast of a data set.
This method also outputs all the points used to fit the data in addition to the forecasted data.
```js
alert|holtWintersWithFit(field string, h int64, m int64, interval time.Duration)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HttpOut
Create an HTTP output node that caches the most recent data it has received.
The cached data is available at the given endpoint.
The endpoint is the relative path from the API endpoint of the running task.
For example, if the task endpoint is at `/kapacitor/v1/tasks/<task_id>` and endpoint is
`top10`, then the data can be requested from `/kapacitor/v1/tasks/<task_id>/top10`.
```js
alert|httpOut(endpoint string)
```
Returns: [HTTPOutNode](/kapacitor/v1.5/nodes/http_out_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HttpPost
Creates an HTTP Post node that POSTS received data to the provided HTTP endpoint.
HttpPost expects 0 or 1 arguments. If 0 arguments are provided, you must specify an
endpoint property method.
```js
alert|httpPost(url ...string)
```
Returns: [HTTPPostNode](/kapacitor/v1.5/nodes/http_post_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### InfluxDBOut
Create an influxdb output node that will store the incoming data into InfluxDB.
```js
alert|influxDBOut()
```
Returns: [InfluxDBOutNode](/kapacitor/v1.5/nodes/influx_d_b_out_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Join
Join this node with other nodes. The data is joined on timestamp.
```js
alert|join(others ...Node)
```
Returns: [JoinNode](/kapacitor/v1.5/nodes/join_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### K8sAutoscale
Create a node that can trigger autoscale events for a kubernetes cluster.
```js
alert|k8sAutoscale()
```
Returns: [K8sAutoscaleNode](/kapacitor/v1.5/nodes/k8s_autoscale_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### KapacitorLoopback
Create an kapacitor loopback node that will send data back into Kapacitor as a stream.
```js
alert|kapacitorLoopback()
```
Returns: [KapacitorLoopbackNode](/kapacitor/v1.5/nodes/kapacitor_loopback_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Last
Select the last point.
```js
alert|last(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Max
Select the maximum point.
```js
alert|max(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Mean
Compute the mean of the data.
```js
alert|mean(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Median
Compute the median of the data.
> **Note:** This method is not a selector.
If you want the median point, use `.percentile(field, 50.0)`.
```js
alert|median(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Min
Select the minimum point.
```js
alert|min(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Mode
Compute the mode of the data.
```js
alert|mode(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### MovingAverage
Compute a moving average of the last window points.
No points are emitted until the window is full.
```js
alert|movingAverage(field string, window int64)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Percentile
Select a point at the given percentile. This is a selector function, no interpolation between points is performed.
```js
alert|percentile(field string, percentile float64)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sample
Create a new node that samples the incoming points or batches.
One point will be emitted every count or duration specified.
```js
alert|sample(rate interface{})
```
Returns: [SampleNode](/kapacitor/v1.5/nodes/sample_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Shift
Create a new node that shifts the incoming points or batches in time.
```js
alert|shift(shift time.Duration)
```
Returns: [ShiftNode](/kapacitor/v1.5/nodes/shift_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sideload
Create a node that can load data from external sources.
```js
alert|sideload()
```
Returns: [SideloadNode](/kapacitor/v1.5/nodes/sideload_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Spread
Compute the difference between `min` and `max` points.
```js
alert|spread(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### StateCount
Create a node that tracks number of consecutive points in a given state.
```js
alert|stateCount(expression ast.LambdaNode)
```
Returns: [StateCountNode](/kapacitor/v1.5/nodes/state_count_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### StateDuration
Create a node that tracks duration in a given state.
```js
alert|stateDuration(expression ast.LambdaNode)
```
Returns: [StateDurationNode](/kapacitor/v1.5/nodes/state_duration_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Stats
Create a new stream of data that contains the internal statistics of the node.
The interval represents how often to emit the statistics based on real time.
This means the interval time is independent of the times of the data points the source node is receiving.
```js
alert|stats(interval time.Duration)
```
Returns: [StatsNode](/kapacitor/v1.5/nodes/stats_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Stddev
Compute the standard deviation.
```js
alert|stddev(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sum
Compute the sum of all values.
```js
alert|sum(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### SwarmAutoscale
Create a node that can trigger autoscale events for a Docker swarm cluster.
```js
alert|swarmAutoscale()
```
Returns: [SwarmAutoscaleNode](/kapacitor/v1.5/nodes/swarm_autoscale_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Top
Select the top `num` points for `field` and sort by any extra tags or fields.
```js
alert|top(num int64, field string, fieldsAndTags ...string)
```
Returns: [InfluxQLNode](/kapacitor/v1.5/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Union
Perform the union of this node and all other given nodes.
```js
alert|union(node ...Node)
```
Returns: [UnionNode](/kapacitor/v1.5/nodes/union_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Where
Create a new node that filters the data stream by a given expression.
```js
alert|where(expression ast.LambdaNode)
```
Returns: [WhereNode](/kapacitor/v1.5/nodes/where_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Window
Create a new node that windows the stream by time.
NOTE: Window can only be applied to stream edges.
```js
alert|window()
```
Returns: [WindowNode](/kapacitor/v1.5/nodes/window_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>