docs-v2/content/kapacitor/v1.4/nodes/alert_node.md

2920 lines
80 KiB
Markdown

---
title: AlertNode (Kapacitor TICKscript node)
description: A Kapacitor AlertNode triggers an event of varying severity levels and passes the event to alert handlers. The criteria for triggering an alert is specified using a lambda expression.
note: Auto generated by tickdoc
menu:
kapacitor_1_4:
name: AlertNode
identifier: alert_node
weight: 10
parent: TICKscript nodes
---
### Constructor
| Chaining method | Description |
|:---------|:---------|
| **[alert](#descr) ( )** | Create an alert node, which can trigger alerts. |
### Property methods
| Setters | description |
|:---|:---|
| **[alerta](#alerta) ( )** | Send the alert to Alerta. |
| **[all](#all) ( )** | Indicates an alert should trigger only if all points in a batch match the criteria. Does not apply to stream alerts. |
| **[crit](#crit) ( `value` `ast.LambdaNode`)** | Filter expression for the CRITICAL alert level. An empty value indicates the level is invalid and is skipped. |
| **[critReset](#critreset) ( `value` `ast.LambdaNode`)** | Filter expression for reseting the CRITICAL alert level to lower level. |
| **[details](#details) ( `value` `string`)** | Template for constructing a detailed HTML message for the alert. The same template data is available as the AlertNode.Message property, in addition to a Message field that contains the rendered Message value. |
| **[durationField](#durationfield) ( `value` `string`)** | Optional field key to add the alert duration to the data. The duration is always in units of nanoseconds. |
| **[email](#email) ( `to` `...string`)** | Email the alert data. |
| **[exec](#exec) ( `executable` `string`, `args` `...string`)** | Execute a command whenever an alert is triggered and pass the alert data over STDIN in JSON format. |
| **[flapping](#flapping) ( `low` `float64`, `high` `float64`)** | Perform flap detection on the alerts. The method used is similar method to Nagios: https://assets.nagios.com/downloads/nagioscore/docs/nagioscore/3/en/flapping.html |
| **[hipChat](#hipchat) ( )** | Send the alert to HipChat. For step-by-step instructions on setting up Kapacitor with HipChat, see the [Event Handler Setup Guide](//kapacitor/v1.4/guides/event-handler-setup/#hipchat-setup). To allow Kapacitor to post to HipChat, go to the URL https://www.hipchat.com/docs/apiv2 for information on how to get your room id and tokens. |
| **[history](#history) ( `value` `int64`)** | Number of previous states to remember when computing flapping levels and checking for state changes. Minimum value is 2 in order to keep track of current and previous states. |
| **[id](#id) ( `value` `string`)** | Template for constructing a unique ID for a given alert. |
| **[idField](#idfield) ( `value` `string`)** | Optional field key to add to the data, containing the alert ID as a string. |
| **[idTag](#idtag) ( `value` `string`)** | Optional tag key to use when tagging the data with the alert ID. |
| **[info](#info) ( `value` `ast.LambdaNode`)** | Filter expression for the INFO alert level. An empty value indicates the level is invalid and is skipped. |
| **[infoReset](#inforeset) ( `value` `ast.LambdaNode`)** | Filter expression for reseting the INFO alert level to lower level. |
| **[levelField](#levelfield) ( `value` `string`)** | Optional field key to add to the data, containing the alert level as a string. |
| **[levelTag](#leveltag) ( `value` `string`)** | Optional tag key to use when tagging the data with the alert level. |
| **[log](#log) ( `filepath` `string`)** | Log JSON alert data to file. One event per line. Must specify the absolute path to the log file. It will be created if it does not exist. Example: stream |alert() .log('/tmp/alert') |
| **[message](#message) ( `value` `string`)** | Template for constructing a meaningful message for the alert. |
| **[messageField](#messagefield) ( `value` `string`)** | Optional field key to add to the data, containing the alert message. |
| **[mqtt](#mqtt) ( `topic` `string`)** | Send alert to an MQTT broker |
| **[noRecoveries](#norecoveries) ( )** | Do not send recovery alerts. |
| **[opsGenie](#opsgenie) ( )** | Send alert to OpsGenie. To use OpsGenie alerting you must first enable the 'Alert Ingestion API' in the 'Integrations' section of OpsGenie. Then place the API key from the URL into the 'opsgenie' section of the Kapacitor configuration. |
| **[pagerDuty](#pagerduty) ( )** | Send the alert to PagerDuty. To use PagerDuty alerting you must first follow the steps to enable a new 'Generic API' service. |
| **[post](#post) ( `urls` `...string`)** | HTTP POST JSON alert data to a specified URL. |
| **[pushover](#pushover) ( )** | Send the alert to Pushover. Register your application with Pushover at https://pushover.net/apps/build to get a Pushover token. |
| **[sensu](#sensu) ( )** | Send the alert to Sensu. |
| **[slack](#slack) ( )** | Send the alert to Slack. To allow Kapacitor to post to Slack, go to the URL https://slack.com/services/new/incoming-webhook and create a new incoming webhook and place the generated URL in the 'slack' configuration section. |
| **[snmpTrap](#snmptrap) ( `trapOid` `string`)** | Send the alert using SNMP traps. To allow Kapacitor to post SNMP traps, |
| **[stateChangesOnly](#statechangesonly) ( `maxInterval` `...time.Duration`)** | Only sends events where the state changed. Each different alert level OK, INFO, WARNING, and CRITICAL are considered different states. |
| **[talk](#talk) ( )** | Send the alert to Talk. To use Talk alerting you must first follow the steps to create a new incoming webhook. |
| **[tcp](#tcp) ( `address` `string`)** | Send JSON alert data to a specified address over TCP. |
| **[telegram](#telegram) ( )** | Send the alert to Telegram. For step-by-step instructions on setting up Kapacitor with Telegram, see the [Event Handler Setup Guide](//kapacitor/v1.4/guides/event-handler-setup/#telegram-setup). To allow Kapacitor to post to Telegram, |
| **[topic](#topic) ( `value` `string`)** | Topic specifies the name of an alert topic to which, alerts will be published. Alert handlers can be configured per topic, see the API documentation. |
| **[victorOps](#victorops) ( )** | Send alert to VictorOps. To use VictorOps alerting you must first enable the 'Alert Ingestion API' in the 'Integrations' section of VictorOps. Then place the API key from the URL into the 'victorops' section of the Kapacitor configuration. |
| **[warn](#warn) ( `value` `ast.LambdaNode`)** | Filter expression for the WARNING alert level. An empty value indicates the level is invalid and is skipped. |
| **[warnReset](#warnreset) ( `value` `ast.LambdaNode`)** | Filter expression for reseting the WARNING alert level to lower level. |
### Chaining methods
[Alert](/kapacitor/v1.4/nodes/alert_node/#alert), [Barrier](/kapacitor/v1.4/nodes/alert_node/#barrier), [Bottom](/kapacitor/v1.4/nodes/alert_node/#bottom), [Combine](/kapacitor/v1.4/nodes/alert_node/#combine), [Count](/kapacitor/v1.4/nodes/alert_node/#count), [CumulativeSum](/kapacitor/v1.4/nodes/alert_node/#cumulativesum), [Deadman](/kapacitor/v1.4/nodes/alert_node/#deadman), [Default](/kapacitor/v1.4/nodes/alert_node/#default), [Delete](/kapacitor/v1.4/nodes/alert_node/#delete), [Derivative](/kapacitor/v1.4/nodes/alert_node/#derivative), [Difference](/kapacitor/v1.4/nodes/alert_node/#difference), [Distinct](/kapacitor/v1.4/nodes/alert_node/#distinct), [Ec2Autoscale](/kapacitor/v1.4/nodes/alert_node/#ec2autoscale), [Elapsed](/kapacitor/v1.4/nodes/alert_node/#elapsed), [Eval](/kapacitor/v1.4/nodes/alert_node/#eval), [First](/kapacitor/v1.4/nodes/alert_node/#first), [Flatten](/kapacitor/v1.4/nodes/alert_node/#flatten), [GroupBy](/kapacitor/v1.4/nodes/alert_node/#groupby), [HoltWinters](/kapacitor/v1.4/nodes/alert_node/#holtwinters), [HoltWintersWithFit](/kapacitor/v1.4/nodes/alert_node/#holtwinterswithfit), [HttpOut](/kapacitor/v1.4/nodes/alert_node/#httpout), [HttpPost](/kapacitor/v1.4/nodes/alert_node/#httppost), [InfluxDBOut](/kapacitor/v1.4/nodes/alert_node/#influxdbout), [Join](/kapacitor/v1.4/nodes/alert_node/#join), [K8sAutoscale](/kapacitor/v1.4/nodes/alert_node/#k8sautoscale), [KapacitorLoopback](/kapacitor/v1.4/nodes/alert_node/#kapacitorloopback), [Last](/kapacitor/v1.4/nodes/alert_node/#last), [Max](/kapacitor/v1.4/nodes/alert_node/#max), [Mean](/kapacitor/v1.4/nodes/alert_node/#mean), [Median](/kapacitor/v1.4/nodes/alert_node/#median), [Min](/kapacitor/v1.4/nodes/alert_node/#min), [Mode](/kapacitor/v1.4/nodes/alert_node/#mode), [MovingAverage](/kapacitor/v1.4/nodes/alert_node/#movingaverage), [Percentile](/kapacitor/v1.4/nodes/alert_node/#percentile), [Sample](/kapacitor/v1.4/nodes/alert_node/#sample), [Shift](/kapacitor/v1.4/nodes/alert_node/#shift), [Sideload](/kapacitor/v1.4/nodes/alert_node/#sideload), [Spread](/kapacitor/v1.4/nodes/alert_node/#spread), [StateCount](/kapacitor/v1.4/nodes/alert_node/#statecount), [StateDuration](/kapacitor/v1.4/nodes/alert_node/#stateduration), [Stats](/kapacitor/v1.4/nodes/alert_node/#stats), [Stddev](/kapacitor/v1.4/nodes/alert_node/#stddev), [Sum](/kapacitor/v1.4/nodes/alert_node/#sum), [SwarmAutoscale](/kapacitor/v1.4/nodes/alert_node/#swarmautoscale), [Top](/kapacitor/v1.4/nodes/alert_node/#top), [Union](/kapacitor/v1.4/nodes/alert_node/#union), [Where](/kapacitor/v1.4/nodes/alert_node/#where), [Window](/kapacitor/v1.4/nodes/alert_node/#window)
<a id='descr'/><hr/><br/>
### Description
An [AlertNode](/kapacitor/v1.4/nodes/alert_node/) can trigger an event of varying severity levels and pass the event to alert handlers.
The criteria for triggering an alert is specified using a [lambda expression](/kapacitor/v1.4/tick/expr/).
See [AlertNode.Info,](/kapacitor/v1.4/nodes/alert_node/#info) [AlertNode.Warn,](/kapacitor/v1.4/nodes/alert_node/#warn) and [AlertNode.Crit](/kapacitor/v1.4/nodes/alert_node/#crit) below.
Different event handlers can be configured for each [AlertNode.](/kapacitor/v1.4/nodes/alert_node/)
Some handlers like Email, HipChat, Sensu, Slack, OpsGenie, VictorOps, PagerDuty, Telegram and Talk have a configuration
option 'global' that indicates that all alerts implicitly use the handler.
Available event handlers:
* log -- log alert data to file.
* post -- HTTP POST data to a specified URL.
* tcp -- Send data to a specified address via raw TCP.
* email -- Send and email with alert data.
* exec -- Execute a command passing alert data over STDIN.
* HipChat -- Post alert message to HipChat room.
* Alerta -- Post alert message to Alerta.
* Sensu -- Post alert message to Sensu client.
* Slack -- Post alert message to Slack channel.
* SNMPTraps -- Trigger SNMP traps.
* OpsGenie -- Send alert to OpsGenie.
* VictorOps -- Send alert to VictorOps.
* PagerDuty -- Send alert to PagerDuty.
* Pushover -- Send alert to Pushover.
* Talk -- Post alert message to Talk client.
* Telegram -- Post alert message to Telegram client.
* MQTT -- Post alert message to MQTT.
See below for more details on configuring each handler.
Each event that gets sent to a handler contains the following alert data:
* ID -- the ID of the alert, user defined.
* Message -- the alert message, user defined.
* Details -- the alert details, user defined HTML content.
* Time -- the time the alert occurred.
* Duration -- the duration of the alert in nanoseconds.
* Level -- one of OK, INFO, WARNING or CRITICAL.
* Data -- influxql.Result containing the data that triggered the alert.
Events are sent to handlers if the alert is in a state other than 'OK'
or the alert just changed to the 'OK' state from a non 'OK' state (a.k.a. the alert recovered).
Using the [AlertNode.StateChangesOnly](/kapacitor/v1.4/nodes/alert_node/#statechangesonly) property events will only be sent to handlers
if the alert changed state.
It is valid to configure multiple alert handlers, even with the same type.
Example:
```javascript
stream
.groupBy('service')
|alert()
.id('kapacitor/{{ index .Tags "service" }}')
.message('{{ .ID }} is {{ .Level }} value:{{ index .Fields "value" }}')
.info(lambda: "value" > 10)
.warn(lambda: "value" > 20)
.crit(lambda: "value" > 30)
.post("http://example.com/api/alert")
.post("http://another.example.com/api/alert")
.tcp("exampleendpoint.com:5678")
.email('oncall@example.com')
```
Each expression maintains its own state.
The order of execution for the expressions is not considered to be deterministic.
For each point an expression may or may not be evaluated.
If no expression is true then the alert is considered to be in the OK state.
Kapacitor supports alert reset expressions.
This way when an alert enters a state, it can only be lowered in severity if its reset expression evaluates to true.
Example:
```javascript
stream
|from()
.measurement('cpu')
.where(lambda: "host" == 'serverA')
.groupBy('host')
|alert()
.info(lambda: "value" > 60)
.infoReset(lambda: "value" < 50)
.warn(lambda: "value" > 70)
.warnReset(lambda: "value" < 60)
.crit(lambda: "value" > 80)
.critReset(lambda: "value" < 70)
```
For example given the following values:
61 73 64 85 62 56 47
The corresponding alert states are:
INFO WARNING WARNING CRITICAL INFO INFO OK
Available Statistics:
* alerts_triggered -- Total number of alerts triggered
* oks_triggered -- Number of OK alerts triggered
* infos_triggered -- Number of Info alerts triggered
* warns_triggered -- Number of Warn alerts triggered
* crits_triggered -- Number of Crit alerts triggered
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
Properties
----------
Property methods modify state on the calling node.
They do not add another node to the pipeline, and always return a reference to the calling node.
Property methods are marked using the `.` operator.
### Alerta
Send the alert to Alerta.
Example:
```javascript
[alerta]
enabled = true
url = "https://alerta.yourdomain"
token = "9hiWoDOZ9IbmHsOTeST123ABciWTIqXQVFDo63h9"
environment = "Production"
origin = "Kapacitor"
```
In order to not post a message every alert interval
use [AlertNode.StateChangesOnly](/kapacitor/v1.4/nodes/alert_node/#statechangesonly) so that only events
where the alert changed state are sent to Alerta.
Send alerts to Alerta. The resource and event properties are required.
Example:
```javascript
stream
|alert()
.alerta()
.resource('Hostname or service')
.event('Something went wrong')
```
Alerta also accepts optional alert information.
Example:
```javascript
stream
|alert()
.alerta()
.resource('Hostname or service')
.event('Something went wrong')
.environment('Development')
.group('Dev. Servers')
.timeout(5m)
```
NOTE: Alerta cannot be configured globally because of its required properties.
```javascript
alert.alerta()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Environment
Alerta environment.
Can be a template and has access to the same data as the [AlertNode.Details](/kapacitor/v1.4/nodes/alert_node/#details) property.
Defaut is set from the configuration.
```javascript
alert.alerta()
.environment(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Event
Alerta event.
Can be a template and has access to the same data as the idInfo property.
Default: {{ .ID }}
```javascript
alert.alerta()
.event(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Group
Alerta group.
Can be a template and has access to the same data as the [AlertNode.Details](/kapacitor/v1.4/nodes/alert_node/#details) property.
Default: {{ .Group }}
```javascript
alert.alerta()
.group(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Origin
Alerta origin.
If empty uses the origin from the configuration.
```javascript
alert.alerta()
.origin(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Resource
Alerta resource.
Can be a template and has access to the same data as the [AlertNode.Details](/kapacitor/v1.4/nodes/alert_node/#details) property.
Default: {{ .Name }}
```javascript
alert.alerta()
.resource(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Services
List of effected services.
If not specified defaults to the Name of the stream.
```javascript
alert.alerta()
.services(service ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Timeout
Alerta timeout.
Default: 24h
```javascript
alert.alerta()
.timeout(value time.Duration)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Token
Alerta authentication token.
If empty uses the token from the configuration.
```javascript
alert.alerta()
.token(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Alerta Value
Alerta value.
Can be a template and has access to the same data as the [AlertNode.Details](/kapacitor/v1.4/nodes/alert_node/#details) property.
Default is an empty string.
```javascript
alert.alerta()
.value(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### All
Indicates an alert should trigger only if all points in a batch match the criteria.
Does not apply to stream alerts.
```javascript
alert.all()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Crit
Filter expression for the CRITICAL alert level.
An empty value indicates the level is invalid and is skipped.
```javascript
alert.crit(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### CritReset
Filter expression for reseting the CRITICAL alert level to lower level.
```javascript
alert.critReset(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Details
Template for constructing a detailed HTML message for the alert.
The same template data is available as the [AlertNode.Message](/kapacitor/v1.4/nodes/alert_node/#message) property,
in addition to a Message field that contains the rendered Message value.
The intent is that the Message property be a single line summary while the
Details property is a more detailed message possibly spanning multiple lines,
and containing HTML formatting.
This template is rendered using the html/template package in Go so that
safe and valid HTML can be generated.
The `json` method is available within the template to convert any variable to a valid
JSON string.
Example:
```javascript
|alert()
.id('{{ .Name }}')
.details('''
<h1>{{ .ID }}</h1>
<b>{{ .Message }}</b>
Value: {{ index .Fields "value" }}
''')
.email()
```
Default: {{ json . }}
```javascript
alert.details(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### DurationField
Optional field key to add the alert duration to the data.
The duration is always in units of nanoseconds.
```javascript
alert.durationField(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Email
Email the alert data.
If the To list is empty, the To addresses from the configuration are used.
The email subject is the [AlertNode.Message](/kapacitor/v1.4/nodes/alert_node/#message) property.
The email body is the [AlertNode.Details](/kapacitor/v1.4/nodes/alert_node/#details) property.
The emails are sent as HTML emails and so the body can contain html markup.
If the 'smtp' section in the configuration has the option: global = true
then all alerts are sent via email without the need to explicitly state it
in the TICKscript.
Example:
```javascript
|alert()
.id('{{ .Name }}')
// Email subject
.message('{{ .ID }}:{{ .Level }}')
//Email body as HTML
.details('''
<h1>{{ .ID }}</h1>
<b>{{ .Message }}</b>
Value: {{ index .Fields "value" }}
''')
.email()
```
Send an email with custom subject and body.
Example:
```javascript
[smtp]
enabled = true
host = "localhost"
port = 25
username = ""
password = ""
from = "kapacitor@example.com"
to = ["oncall@example.com"]
# Set global to true so all alert trigger emails.
global = true
state-changes-only = true
```
Example:
```javascript
stream
|alert()
```
Send email to 'oncall@example.com' from 'kapacitor@example.com'
```javascript
alert.email(to ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Email To
Define the To addresses for the email alert.
Multiple calls append to the existing list of addresses.
If empty uses the addresses from the configuration.
Example:
```javascript
|alert()
.id('{{ .Name }}')
// Email subject
.message('{{ .ID }}:{{ .Level }}')
//Email body as HTML
.details('''
<h1>{{ .ID }}</h1>
<b>{{ .Message }}</b>
Value: {{ index .Fields "value" }}
''')
.email('admin@example.com')
.to('oncall@example.com')
.to('support@example.com')
```
All three email addresses will receive the alert message.
Passing addresses to the `email` property directly or using the `email.to` property is the same.
```javascript
alert.email(to ...string)
.to(to ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Exec
Execute a command whenever an alert is triggered and pass the alert data over STDIN in JSON format.
```javascript
alert.exec(executable string, args ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Flapping
Perform flap detection on the alerts.
The method used is similar method to Nagios:
https://assets.nagios.com/downloads/nagioscore/docs/nagioscore/3/en/flapping.html
Each different alerting level is considered a different state.
The low and high thresholds are inverted thresholds of a percentage of state changes.
Meaning that if the percentage of state changes goes above the `high`
threshold, the alert enters a flapping state. The alert remains in the flapping state
until the percentage of state changes goes below the `low` threshold.
Typical values are low: 0.25 and high: 0.5. The percentage values represent the number state changes
over the total possible number of state changes. A percentage change of 0.5 means that the alert changed
state in half of the recorded history, and remained the same in the other half of the history.
```javascript
alert.flapping(low float64, high float64)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HipChat
Send the alert to HipChat.
For step-by-step instructions on setting up Kapacitor with HipChat, see the [Event Handler Setup Guide](//kapacitor/v1.4/guides/event-handler-setup/#hipchat-setup).
To allow Kapacitor to post to HipChat,
go to the URL https://www.hipchat.com/docs/apiv2 for
information on how to get your room id and tokens.
Example:
```javascript
[hipchat]
enabled = true
url = "https://orgname.hipchat.com/v2/room"
room = "4189212"
token = "9hiWoDOZ9IbmHsOTeST123ABciWTIqXQVFDo63h9"
```
In order to not post a message every alert interval
use [AlertNode.StateChangesOnly](/kapacitor/v1.4/nodes/alert_node/#statechangesonly) so that only events
where the alert changed state are posted to the room.
Example:
```javascript
stream
|alert()
.hipChat()
```
Send alerts to HipChat room in the configuration file.
Example:
```javascript
stream
|alert()
.hipChat()
.room('Kapacitor')
```
Send alerts to HipChat room 'Kapacitor'
If the 'hipchat' section in the configuration has the option: global = true
then all alerts are sent to HipChat without the need to explicitly state it
in the TICKscript.
Example:
```javascript
[hipchat]
enabled = true
url = "https://orgname.hipchat.com/v2/room"
room = "Test Room"
token = "9hiWoDOZ9IbmHsOTeST123ABciWTIqXQVFDo63h9"
global = true
state-changes-only = true
```
Example:
```javascript
stream
|alert()
```
Send alert to HipChat using default room 'Test Room'.
```javascript
alert.hipChat()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### HipChat Room
HipChat room in which to post messages.
If empty uses the channel from the configuration.
```javascript
alert.hipChat()
.room(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### HipChat Token
HipChat authentication token.
If empty uses the token from the configuration.
```javascript
alert.hipChat()
.token(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### History
Number of previous states to remember when computing flapping levels and
checking for state changes.
Minimum value is 2 in order to keep track of current and previous states.
Default: 21
```javascript
alert.history(value int64)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Id
Template for constructing a unique ID for a given alert.
Available template data:
* Name -- Measurement name.
* TaskName -- The name of the task
* Group -- Concatenation of all group-by tags of the form [key=value,]+.
If no groupBy is performed equal to literal 'nil'.
* Tags -- Map of tags. Use '{{ index .Tags "key" }}' to get a specific tag value.
* ServerInfo -- Information about the running server. Available nested fields are:
Hostname, ClusterID and ServerID.
Example:
```javascript
stream
|from()
.measurement('cpu')
.groupBy('cpu')
|alert()
.id('kapacitor/{{ .Name }}/{{ .Group }}')
```
ID: kapacitor/cpu/cpu=cpu0,
Example:
```javascript
stream
|from()
.measurement('cpu')
.groupBy('service')
|alert()
.id('kapacitor/{{ index .Tags "service" }}')
```
ID: kapacitor/authentication
Example:
```javascript
stream
|from()
.measurement('cpu')
.groupBy('service', 'host')
|alert()
.id('kapacitor/{{ index .Tags "service" }}/{{ index .Tags "host" }}')
```
ID: kapacitor/authentication/auth001.example.com
Default: {{ .Name }}:{{ .Group }}
```javascript
alert.id(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### IdField
Optional field key to add to the data, containing the alert ID as a string.
```javascript
alert.idField(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### IdTag
Optional tag key to use when tagging the data with the alert ID.
```javascript
alert.idTag(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Info
Filter expression for the INFO alert level.
An empty value indicates the level is invalid and is skipped.
```javascript
alert.info(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### InfoReset
Filter expression for reseting the INFO alert level to lower level.
```javascript
alert.infoReset(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### LevelField
Optional field key to add to the data, containing the alert level as a string.
```javascript
alert.levelField(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### LevelTag
Optional tag key to use when tagging the data with the alert level.
```javascript
alert.levelTag(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Log
Log JSON alert data to file. One event per line.
Must specify the absolute path to the log file.
It will be created if it does not exist.
Example:
```javascript
stream
|alert()
.log('/tmp/alert')
```
Example:
```javascript
stream
|alert()
.log('/tmp/alert')
.mode(0644)
```
```javascript
alert.log(filepath string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Log Mode
File's mode and permissions, default is 0600
NOTE: The leading 0 is required to interpret the value as an octal integer.
```javascript
alert.log(filepath string)
.mode(value int64)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Message
Template for constructing a meaningful message for the alert.
Available template data:
* ID -- The ID of the alert.
* Name -- Measurement name.
* TaskName -- The name of the task
* Group -- Concatenation of all group-by tags of the form [key=value,]+.
If no groupBy is performed equal to literal 'nil'.
* Tags -- Map of tags. Use '{{ index .Tags "key" }}' to get a specific tag value.
* Level -- Alert Level, one of: INFO, WARNING, CRITICAL.
* Fields -- Map of fields. Use '{{ index .Fields "key" }}' to get a specific field value.
* Time -- The time of the point that triggered the event.
* Duration -- The duration of the alert.
Example:
```javascript
stream
|from()
.measurement('cpu')
.groupBy('service', 'host')
|alert()
.id('{{ index .Tags "service" }}/{{ index .Tags "host" }}')
.message('{{ .ID }} is {{ .Level}} value: {{ index .Fields "value" }}')
```
Message: authentication/auth001.example.com is CRITICAL value:42
Default: {{ .ID }} is {{ .Level }}
```javascript
alert.message(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### MessageField
Optional field key to add to the data, containing the alert message.
```javascript
alert.messageField(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Mqtt
Send alert to an MQTT broker
Enable the MQTT broker in the configuration file:
```javascript
# MQTT client configuration.
# Mutliple different clients may be configured by
# repeating [[mqtt]] sections.
[[mqtt]]
enabled = true
# Unique name for this broker configuration
name = "localhost"
# Whether this broker configuration is the default
default = true
# URL of the MQTT broker.
# Possible protocols include:
# tcp - Raw TCP network connection
# ssl - TLS protected TCP network connection
# ws - Websocket network connection
url = "tcp://localhost:1883"
# TLS/SSL configuration
# A CA can be provided without a key/cert pair
# ssl-ca = "/etc/kapacitor/ca.pem"
# Absolutes paths to pem encoded key and cert files.
# ssl-cert = "/etc/kapacitor/cert.pem"
# ssl-key = "/etc/kapacitor/key.pem"
# Unique ID for this MQTT client.
# If empty used the value of "name"
client-id = "kapacitor"
# Username
username = ""
# Password
password = ""
```
```javascript
alert.mqtt(topic string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Mqtt BrokerName
BrokerName is the name of the configured MQTT broker to use when publishing the alert.
If empty defaults to the configured default broker.
```javascript
alert.mqtt(topic string)
.brokerName(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Mqtt Qos
The Qos that will be used to deliver the alerts
Valid values are:
* 0 - At most once delivery
* 1 - At least once delivery
* 2 - Exactly once delivery
```javascript
alert.mqtt(topic string)
.qos(value int64)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Mqtt Retained
Retained indicates whether this alert should be delivered to
clients that were not connected to the broker at the time of the alert.
```javascript
alert.mqtt(topic string)
.retained(value bool)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Mqtt Topic
The topic where alerts will be dispatched to
```javascript
alert.mqtt(topic string)
.topic(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Mqtt Message
The message sent to the MQTT broker will be in the `message` field of the alert.
```javascript
var message = '{{ index .Fields "value" }}'
```
### NoRecoveries
Do not send recovery alerts.
```javascript
alert.noRecoveries()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### OpsGenie
Send alert to OpsGenie.
To use OpsGenie alerting you must first enable the 'Alert Ingestion API'
in the 'Integrations' section of OpsGenie.
Then place the API key from the URL into the 'opsgenie' section of the Kapacitor configuration.
Example:
```javascript
[opsgenie]
enabled = true
api-key = "xxxxx"
teams = ["everyone"]
recipients = ["jim", "bob"]
```
With the correct configuration you can now use OpsGenie in TICKscripts.
Example:
```javascript
stream
|alert()
.opsGenie()
```
Send alerts to OpsGenie using the teams and recipients in the configuration file.
Example:
```javascript
stream
|alert()
.opsGenie()
.teams('team_rocket','team_test')
```
Send alerts to OpsGenie with team set to 'team_rocket' and 'team_test'
If the 'opsgenie' section in the configuration has the option: global = true
then all alerts are sent to OpsGenie without the need to explicitly state it
in the TICKscript.
Example:
```javascript
[opsgenie]
enabled = true
api-key = "xxxxx"
recipients = ["johndoe"]
global = true
```
Example:
```javascript
stream
|alert()
```
Send alert to OpsGenie using the default recipients, found in the configuration.
```javascript
alert.opsGenie()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### OpsGenie Recipients
The list of recipients to be alerted. If empty defaults to the recipients from the configuration.
```javascript
alert.opsGenie()
.recipients(recipients ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### OpsGenie Teams
The list of teams to be alerted. If empty defaults to the teams from the configuration.
```javascript
alert.opsGenie()
.teams(teams ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### PagerDuty
Send the alert to PagerDuty.
To use PagerDuty alerting you must first follow the steps to enable a new 'Generic API' service.
From https://developer.pagerduty.com/documentation/integration/events
1. In your account, under the Services tab, click "Add New Service".
2. Enter a name for the service and select an escalation policy. Then, select "Generic API" for the Service Type.
3. Click the "Add Service" button.
4. Once the service is created, you'll be taken to the service page. On this page, you'll see the "Service key", which is needed to access the API
Place the 'service key' into the 'pagerduty' section of the Kapacitor configuration as the option 'service-key'.
Example:
```javascript
[pagerduty]
enabled = true
service-key = "xxxxxxxxx"
```
With the correct configuration you can now use PagerDuty in TICKscripts.
Example:
```javascript
stream
|alert()
.pagerDuty()
```
If the 'pagerduty' section in the configuration has the option: global = true
then all alerts are sent to PagerDuty without the need to explicitly state it
in the TICKscript.
Example:
```javascript
[pagerduty]
enabled = true
service-key = "xxxxxxxxx"
global = true
```
Example:
```javascript
stream
|alert()
```
Send alert to PagerDuty.
```javascript
alert.pagerDuty()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### PagerDuty ServiceKey
The service key to use for the alert.
Defaults to the value in the configuration if empty.
```javascript
alert.pagerDuty()
.serviceKey(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Post
HTTP POST JSON alert data to a specified URL.
Example:
```javascript
stream
|alert()
.post()
.endpoint('example')
```
Example:
```javascript
stream
|alert()
.post('http://example.com')
```
```javascript
alert.post(urls ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Post CaptureResponse
CaptureResponse indicates that the HTTP response should be read and logged if
the status code was not an 2xx code.
```javascript
alert.post(urls ...string)
.captureResponse()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Post Endpoint
Name of the endpoint to be used, as is defined in the configuration file
```javascript
alert.post(urls ...string)
.endpoint(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Post Header
Set a header key and value on the post request.
Setting the Authenticate header is not allowed from within TICKscript,
please use the configuration file to specify sensitive headers.
Example:
```javascript
stream
|alert()
.post()
.endpoint('example')
.header('a','b')
```
```javascript
alert.post(urls ...string)
.header(k string, v string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Post Timeout
Timeout for HTTP Post
```javascript
alert.post(urls ...string)
.timeout(value time.Duration)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Pushover
Send the alert to Pushover.
Register your application with Pushover at
https://pushover.net/apps/build to get a
Pushover token.
Alert Level Mapping:
OK - Sends a -2 priority level.
Info - Sends a -1 priority level.
Warning - Sends a 0 priority level.
Critical - Sends a 1 priority level.
Example:
```javascript
[pushover]
enabled = true
token = "9hiWoDOZ9IbmHsOTeST123ABciWTIqXQVFDo63h9"
user_key = "Pushover"
```
Example:
```javascript
stream
|alert()
.pushover()
.sound('siren')
.user_key('other user')
.device('mydev')
.title('mytitle')
.URL('myurl')
.URLTitle('mytitle')
```
Send alerts to Pushover.
```javascript
alert.pushover()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Pushover Device
Users device name to send message directly to that device,
rather than all of a user's devices (multiple device names may
be separated by a comma)
```javascript
alert.pushover()
.device(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Pushover Sound
The name of one of the sounds supported by the device clients to override
the user's default sound choice
```javascript
alert.pushover()
.sound(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Pushover Title
Your message's title, otherwise your apps name is used
```javascript
alert.pushover()
.title(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Pushover URL
A supplementary URL to show with your message
```javascript
alert.pushover()
.uRL(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Pushover URLTitle
A title for your supplementary URL, otherwise just URL is shown
```javascript
alert.pushover()
.uRLTitle(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Pushover UserKey
User/Group key of your user (or you), viewable when logged
into the Pushover dashboard. Often referred to as USER_KEY
in the Pushover documentation.
If empty uses the user from the configuration.
```javascript
alert.pushover()
.userKey(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sensu
Send the alert to Sensu.
Example:
```javascript
[sensu]
enabled = true
url = "http://sensu:3030"
source = "Kapacitor"
handlers = ["sns","slack"]
```
Example:
```javascript
stream
|alert()
.sensu()
```
Send alerts to Sensu client.
Example:
```javascript
stream
|alert()
.sensu()
.handlers('sns','slack')
```
Send alerts to Sensu specifying the handlers
```javascript
alert.sensu()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Sensu Handlers
List of effected services.
If not specified defaults to the Name of the stream.
```javascript
alert.sensu()
.handlers(handlers ...string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Sensu Source
Sensu source in which to post messages.
If empty uses the Source from the configuration.
```javascript
alert.sensu()
.source(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Slack
Send the alert to Slack.
To allow Kapacitor to post to Slack,
go to the URL https://slack.com/services/new/incoming-webhook
and create a new incoming webhook and place the generated URL
in the 'slack' configuration section.
Example:
```javascript
[slack]
enabled = true
url = "https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx"
channel = "#general"
```
In order to not post a message every alert interval
use [AlertNode.StateChangesOnly](/kapacitor/v1.4/nodes/alert_node/#statechangesonly) so that only events
where the alert changed state are posted to the channel.
Example:
```javascript
stream
|alert()
.slack()
```
Send alerts to Slack channel in the configuration file.
Example:
```javascript
stream
|alert()
.slack()
.channel('#alerts')
```
Send alerts to Slack channel '#alerts'
Example:
```javascript
stream
|alert()
.slack()
.channel('@jsmith')
```
Send alert to user '@jsmith'
If the 'slack' section in the configuration has the option: global = true
then all alerts are sent to Slack without the need to explicitly state it
in the TICKscript.
Example:
```javascript
[slack]
enabled = true
url = "https://hooks.slack.com/services/xxxxxxxxx/xxxxxxxxx/xxxxxxxxxxxxxxxxxxxxxxxx"
channel = "#general"
global = true
state-changes-only = true
```
Example:
```javascript
stream
|alert()
```
Send alert to Slack using default channel '#general'.
```javascript
alert.slack()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Slack Channel
Slack channel in which to post messages.
If empty uses the channel from the configuration.
```javascript
alert.slack()
.channel(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Slack IconEmoji
IconEmoji is an emoji name surrounded in ':' characters.
The emoji image will replace the normal user icon for the slack bot.
```javascript
alert.slack()
.iconEmoji(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Slack Username
Username of the Slack bot.
If empty uses the username from the configuration.
```javascript
alert.slack()
.username(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### SnmpTrap
Send the alert using SNMP traps.
To allow Kapacitor to post SNMP traps,
Example:
```javascript
[snmptrap]
enabled = true
addr = "127.0.0.1:9162"
community = "public"
```
Example:
```javascript
stream
|alert()
.snmpTrap('1.1.1.1')
.data('1.3.6.1.2.1.1.7', 'i', '{{ index .Field "value" }}')
```
Send alerts to `target-ip:target-port` on OID '1.3.6.1.2.1.1.7'
```javascript
alert.snmpTrap(trapOid string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### SnmpTrap Data
Define Data for SNMP Trap alert.
Multiple calls append to the existing list of data.
Available types:
| Abbreviation | Datatype |
| ------------ | -------- |
| c | Counter |
| i | Integer |
| n | Null |
| s | String |
| t | Time ticks |
Example:
```javascript
|alert()
.message('{{ .ID }}:{{ .Level }}')
.snmpTrap('1.3.6.1.4.1.1')
.data('1.3.6.1.4.1.1.5', 's', '{{ .Level }}' )
.data('1.3.6.1.4.1.1.6', 'i', '50' )
.data('1.3.6.1.4.1.1.7', 'c', '{{ index .Fields "num_requests" }}' )
.data('1.3.6.1.4.1.1.8', 's', '{{ .Message }}' )
```
```javascript
alert.snmpTrap(trapOid string)
.data(oid string, typ string, value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### StateChangesOnly
Only sends events where the state changed.
Each different alert level OK, INFO, WARNING, and CRITICAL
are considered different states.
Example:
```javascript
stream
|from()
.measurement('cpu')
|window()
.period(10s)
.every(10s)
|alert()
.crit(lambda: "value" > 10)
.stateChangesOnly()
.slack()
```
If the "value" is greater than 10 for a total of 60s, then
only two events will be sent. First, when the value crosses
the threshold, and second, when it falls back into an OK state.
Without stateChangesOnly, the alert would have triggered 7 times:
6 times for each 10s period where the condition was met and once more
for the recovery.
An optional maximum interval duration can be provided.
An event will not be ignored (aka trigger an alert) if more than the maximum interval has elapsed
since the last alert.
Example:
```javascript
stream
|from()
.measurement('cpu')
|window()
.period(10s)
.every(10s)
|alert()
.crit(lambda: "value" > 10)
.stateChangesOnly(10m)
.slack()
```
The above usage will only trigger alerts to slack on state changes or at least every 10 minutes.
```javascript
alert.stateChangesOnly(maxInterval ...time.Duration)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Talk
Send the alert to Talk.
To use Talk alerting you must first follow the steps to create a new incoming webhook.
1. Go to the URL https:/account.jianliao.com/signin.
2. Sign in with you account. under the Team tab, click "Integrations".
3. Select "Customize service", click incoming Webhook "Add" button.
4. After choose the topic to connect with "xxx", click "Confirm Add" button.
5. Once the service is created, you'll see the "Generate Webhook url".
Place the 'Generate Webhook url' into the 'Talk' section of the Kapacitor configuration as the option 'url'.
Example:
```javascript
[talk]
enabled = true
url = "https://jianliao.com/v2/services/webhook/uuid"
author_name = "Kapacitor"
```
Example:
```javascript
stream
|alert()
.talk()
```
Send alerts to Talk client.
```javascript
alert.talk()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Tcp
Send JSON alert data to a specified address over TCP.
```javascript
alert.tcp(address string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Tcp Address
The endpoint address.
```javascript
alert.tcp(address string)
.address(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Telegram
Send the alert to Telegram.
For step-by-step instructions on setting up Kapacitor with Telegram, see the [Event Handler Setup Guide](//kapacitor/v1.4/guides/event-handler-setup/#telegram-setup).
To allow Kapacitor to post to Telegram,
Example:
```javascript
[telegram]
enabled = true
token = "123456789:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
chat-id = "xxxxxxxxx"
parse-mode = "Markdown"
disable-web-page-preview = true
disable-notification = false
```
In order to not post a message every alert interval
use [AlertNode.StateChangesOnly](/kapacitor/v1.4/nodes/alert_node/#statechangesonly) so that only events
where the alert changed state are posted to the chat-id.
Example:
```javascript
stream
|alert()
.telegram()
```
Send alerts to Telegram chat-id in the configuration file.
Example:
```javascript
stream
|alert()
.telegram()
.chatId('xxxxxxx')
```
Send alerts to Telegram user/group 'xxxxxx'
If the 'telegram' section in the configuration has the option: global = true
then all alerts are sent to Telegram without the need to explicitly state it
in the TICKscript.
Example:
```javascript
[telegram]
enabled = true
token = "123456789:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
chat-id = "xxxxxxxxx"
global = true
state-changes-only = true
```
Example:
```javascript
stream
|alert()
```
Send alert to Telegram using default chat-id 'xxxxxxxx'.
```javascript
alert.telegram()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Telegram ChatId
Telegram user/group ID to post messages to.
If empty uses the chati-d from the configuration.
```javascript
alert.telegram()
.chatId(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Telegram DisableNotification
Disables the Notification. If empty defaults to the configuration.
```javascript
alert.telegram()
.disableNotification()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Telegram DisableWebPagePreview
Disables the WebPagePreview. If empty defaults to the configuration.
```javascript
alert.telegram()
.disableWebPagePreview()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### Telegram ParseMode
Parse node, defaults to Mardown
If empty uses the parse-mode from the configuration.
```javascript
alert.telegram()
.parseMode(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Topic
Topic specifies the name of an alert topic to which,
alerts will be published.
Alert handlers can be configured per topic, see the API documentation.
```javascript
alert.topic(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### VictorOps
Send alert to VictorOps.
To use VictorOps alerting you must first enable the 'Alert Ingestion API'
in the 'Integrations' section of VictorOps.
Then place the API key from the URL into the 'victorops' section of the Kapacitor configuration.
Example:
```javascript
[victorops]
enabled = true
api-key = "xxxxx"
routing-key = "everyone"
```
With the correct configuration you can now use VictorOps in TICKscripts.
Example:
```javascript
stream
|alert()
.victorOps()
```
Send alerts to VictorOps using the routing key in the configuration file.
Example:
```javascript
stream
|alert()
.victorOps()
.routingKey('team_rocket')
```
Send alerts to VictorOps with routing key 'team_rocket'
If the 'victorops' section in the configuration has the option: global = true
then all alerts are sent to VictorOps without the need to explicitly state it
in the TICKscript.
Example:
```javascript
[victorops]
enabled = true
api-key = "xxxxx"
routing-key = "everyone"
global = true
```
Example:
```javascript
stream
|alert()
```
Send alert to VictorOps using the default routing key, found in the configuration.
```javascript
alert.victorOps()
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
#### VictorOps RoutingKey
The routing key to use for the alert.
Defaults to the value in the configuration if empty.
```javascript
alert.victorOps()
.routingKey(value string)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Warn
Filter expression for the WARNING alert level.
An empty value indicates the level is invalid and is skipped.
```javascript
alert.warn(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### WarnReset
Filter expression for reseting the WARNING alert level to lower level.
```javascript
alert.warnReset(value ast.LambdaNode)
```
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
Chaining Methods
----------------
Chaining methods create a new node in the pipeline as a child of the calling node.
They do not modify the calling node.
Chaining methods are marked using the `|` operator.
### Alert
Create an alert node, which can trigger alerts.
```javascript
alert|alert()
```
Returns: [AlertNode](/kapacitor/v1.4/nodes/alert_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Barrier
Create a new Barrier node that emits a BarrierMessage periodically
One BarrierMessage will be emitted every period duration
```javascript
alert|barrier()
```
Returns: [BarrierNode](/kapacitor/v1.4/nodes/barrier_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Bottom
Select the bottom `num` points for `field` and sort by any extra tags or fields.
```javascript
alert|bottom(num int64, field string, fieldsAndTags ...string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Combine
Combine this node with itself. The data is combined on timestamp.
```javascript
alert|combine(expressions ...ast.LambdaNode)
```
Returns: [CombineNode](/kapacitor/v1.4/nodes/combine_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Count
Count the number of points.
```javascript
alert|count(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### CumulativeSum
Compute a cumulative sum of each point that is received.
A point is emitted for every point collected.
```javascript
alert|cumulativeSum(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Deadman
Helper function for creating an alert on low throughput, a.k.a. deadman's switch.
- Threshold -- trigger alert if throughput drops below threshold in points/interval.
- Interval -- how often to check the throughput.
- Expressions -- optional list of expressions to also evaluate. Useful for time of day alerting.
Example:
```javascript
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|deadman(100.0, 10s)
//Do normal processing of data
data...
```
The above is equivalent to this
Example:
```javascript
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|stats(10s)
.align()
|derivative('emitted')
.unit(10s)
.nonNegative()
|alert()
.id('node \'stream0\' in task \'{{ .TaskName }}\'')
.message('{{ .ID }} is {{ if eq .Level "OK" }}alive{{ else }}dead{{ end }}: {{ index .Fields "emitted" | printf "%0.3f" }} points/10s.')
.crit(lambda: "emitted" <= 100.0)
//Do normal processing of data
data...
```
The `id` and `message` alert properties can be configured globally via the 'deadman' configuration section.
Since the [AlertNode](/kapacitor/v1.4/nodes/alert_node/) is the last piece it can be further modified as usual.
Example:
```javascript
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|deadman(100.0, 10s)
.slack()
.channel('#dead_tasks')
//Do normal processing of data
data...
```
You can specify additional lambda expressions to further constrain when the deadman's switch is triggered.
Example:
```javascript
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
// Only trigger the alert if the time of day is between 8am-5pm.
data
|deadman(100.0, 10s, lambda: hour("time") >= 8 AND hour("time") <= 17)
//Do normal processing of data
data...
```
```javascript
alert|deadman(threshold float64, interval time.Duration, expr ...ast.LambdaNode)
```
Returns: [AlertNode](/kapacitor/v1.4/nodes/alert_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Default
Create a node that can set defaults for missing tags or fields.
```javascript
alert|default()
```
Returns: [DefaultNode](/kapacitor/v1.4/nodes/default_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Delete
Create a node that can delete tags or fields.
```javascript
alert|delete()
```
Returns: [DeleteNode](/kapacitor/v1.4/nodes/delete_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Derivative
Create a new node that computes the derivative of adjacent points.
```javascript
alert|derivative(field string)
```
Returns: [DerivativeNode](/kapacitor/v1.4/nodes/derivative_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Difference
Compute the difference between points independent of elapsed time.
```javascript
alert|difference(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Distinct
Produce batch of only the distinct points.
```javascript
alert|distinct(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Ec2Autoscale
Create a node that can trigger autoscale events for a ec2 autoscalegroup.
```javascript
alert|ec2Autoscale()
```
Returns: [Ec2AutoscaleNode](/kapacitor/v1.4/nodes/ec2_autoscale_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Elapsed
Compute the elapsed time between points
```javascript
alert|elapsed(field string, unit time.Duration)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Eval
Create an eval node that will evaluate the given transformation function to each data point.
A list of expressions may be provided and will be evaluated in the order they are given.
The results are available to later expressions.
```javascript
alert|eval(expressions ...ast.LambdaNode)
```
Returns: [EvalNode](/kapacitor/v1.4/nodes/eval_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### First
Select the first point.
```javascript
alert|first(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Flatten
Flatten points with similar times into a single point.
```javascript
alert|flatten()
```
Returns: [FlattenNode](/kapacitor/v1.4/nodes/flatten_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### GroupBy
Group the data by a set of tags.
Can pass literal * to group by all dimensions.
Example:
```javascript
|groupBy(*)
```
```javascript
alert|groupBy(tag ...interface{})
```
Returns: [GroupByNode](/kapacitor/v1.4/nodes/group_by_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HoltWinters
Compute the holt-winters (/{{< latest "influxdb" "v1" >}}/query_language/functions/#holt-winters) forecast of a data set.
```javascript
alert|holtWinters(field string, h int64, m int64, interval time.Duration)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HoltWintersWithFit
Compute the holt-winters (/{{< latest "influxdb" "v1" >}}/query_language/functions/#holt-winters) forecast of a data set.
This method also outputs all the points used to fit the data in addition to the forecasted data.
```javascript
alert|holtWintersWithFit(field string, h int64, m int64, interval time.Duration)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HttpOut
Create an HTTP output node that caches the most recent data it has received.
The cached data is available at the given endpoint.
The endpoint is the relative path from the API endpoint of the running task.
For example, if the task endpoint is at `/kapacitor/v1/tasks/<task_id>` and endpoint is
`top10`, then the data can be requested from `/kapacitor/v1/tasks/<task_id>/top10`.
```javascript
alert|httpOut(endpoint string)
```
Returns: [HTTPOutNode](/kapacitor/v1.4/nodes/http_out_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### HttpPost
Creates an HTTP Post node that POSTS received data to the provided HTTP endpoint.
HttpPost expects 0 or 1 arguments. If 0 arguments are provided, you must specify an
endpoint property method.
```javascript
alert|httpPost(url ...string)
```
Returns: [HTTPPostNode](/kapacitor/v1.4/nodes/http_post_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### InfluxDBOut
Create an influxdb output node that will store the incoming data into InfluxDB.
```javascript
alert|influxDBOut()
```
Returns: [InfluxDBOutNode](/kapacitor/v1.4/nodes/influx_d_b_out_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Join
Join this node with other nodes. The data is joined on timestamp.
```javascript
alert|join(others ...Node)
```
Returns: [JoinNode](/kapacitor/v1.4/nodes/join_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### K8sAutoscale
Create a node that can trigger autoscale events for a kubernetes cluster.
```javascript
alert|k8sAutoscale()
```
Returns: [K8sAutoscaleNode](/kapacitor/v1.4/nodes/k8s_autoscale_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### KapacitorLoopback
Create an kapacitor loopback node that will send data back into Kapacitor as a stream.
```javascript
alert|kapacitorLoopback()
```
Returns: [KapacitorLoopbackNode](/kapacitor/v1.4/nodes/kapacitor_loopback_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Last
Select the last point.
```javascript
alert|last(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Max
Select the maximum point.
```javascript
alert|max(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Mean
Compute the mean of the data.
```javascript
alert|mean(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Median
Compute the median of the data. Note, this method is not a selector,
if you want the median point use `.percentile(field, 50.0)`.
```javascript
alert|median(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Min
Select the minimum point.
```javascript
alert|min(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Mode
Compute the mode of the data.
```javascript
alert|mode(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### MovingAverage
Compute a moving average of the last window points.
No points are emitted until the window is full.
```javascript
alert|movingAverage(field string, window int64)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Percentile
Select a point at the given percentile. This is a selector function, no interpolation between points is performed.
```javascript
alert|percentile(field string, percentile float64)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sample
Create a new node that samples the incoming points or batches.
One point will be emitted every count or duration specified.
```javascript
alert|sample(rate interface{})
```
Returns: [SampleNode](/kapacitor/v1.4/nodes/sample_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Shift
Create a new node that shifts the incoming points or batches in time.
```javascript
alert|shift(shift time.Duration)
```
Returns: [ShiftNode](/kapacitor/v1.4/nodes/shift_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sideload
Create a node that can load data from external sources
```javascript
alert|sideload()
```
Returns: [SideloadNode](/kapacitor/v1.4/nodes/sideload_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Spread
Compute the difference between `min` and `max` points.
```javascript
alert|spread(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### StateCount
Create a node that tracks number of consecutive points in a given state.
```javascript
alert|stateCount(expression ast.LambdaNode)
```
Returns: [StateCountNode](/kapacitor/v1.4/nodes/state_count_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### StateDuration
Create a node that tracks duration in a given state.
```javascript
alert|stateDuration(expression ast.LambdaNode)
```
Returns: [StateDurationNode](/kapacitor/v1.4/nodes/state_duration_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Stats
Create a new stream of data that contains the internal statistics of the node.
The interval represents how often to emit the statistics based on real time.
This means the interval time is independent of the times of the data points the source node is receiving.
```javascript
alert|stats(interval time.Duration)
```
Returns: [StatsNode](/kapacitor/v1.4/nodes/stats_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Stddev
Compute the standard deviation.
```javascript
alert|stddev(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Sum
Compute the sum of all values.
```javascript
alert|sum(field string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### SwarmAutoscale
Create a node that can trigger autoscale events for a docker swarm cluster.
```javascript
alert|swarmAutoscale()
```
Returns: [SwarmAutoscaleNode](/kapacitor/v1.4/nodes/swarm_autoscale_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Top
Select the top `num` points for `field` and sort by any extra tags or fields.
```javascript
alert|top(num int64, field string, fieldsAndTags ...string)
```
Returns: [InfluxQLNode](/kapacitor/v1.4/nodes/influx_q_l_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Union
Perform the union of this node and all other given nodes.
```javascript
alert|union(node ...Node)
```
Returns: [UnionNode](/kapacitor/v1.4/nodes/union_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Where
Create a new node that filters the data stream by a given expression.
```javascript
alert|where(expression ast.LambdaNode)
```
Returns: [WhereNode](/kapacitor/v1.4/nodes/where_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>
### Window
Create a new node that windows the stream by time.
NOTE: Window can only be applied to stream edges.
```javascript
alert|window()
```
Returns: [WindowNode](/kapacitor/v1.4/nodes/window_node/)
<a class="top" href="javascript:document.getElementsByClassName('article-heading')[0].scrollIntoView();" title="top"><span class="icon arrow-up"></span></a>