openTSDB/Bosun报警语法 介绍/学习笔记

openTSDB表达式概述

/api/query, 内含rate options, filters

m=sum:rate{counter,,1000}:if.octets.in

Name	Data Type	Required	Description	Default	Example
counter	Boolean	Optional	Whether or not the underlying data is a monotonically increasing counter that may roll over	false	true
counterMax	Integer	Optional	A positive integer representing the maximum value for the counter.	Java Long.MaxValue	65535
resetValue	Integer	Optional	An optional value that, when exceeded, will cause the aggregator to return a 0 instead of the calculated rate. Useful when data sources are frequently reset to avoid spurious spikes.	0	65000
dropResets	Boolean	Optional	Whether or not to simply drop rolled-over or reset data points.	false	true

Filters

Whether or not results are grouped depends on which curly bracket the filter is in. Two curly braces are now supported per metric query. The first set is the group by filter and the second is a non group by filter, e.g. {host=wildcard(web*)}{colo=regexp(sjc.*)}. This specifies any metrics where the colo matches the regex expression "sjc.*" and the host tag value starts with "web" and the results are grouped by host. If you only want to filter without grouping then the first curly set must be empty, e.g. {}{host=wildcard(web*),colo=regexp(sjc.*)}.

Metric Query String Format

m=<aggregator>:[rate[{counter[,<counter_max>[,<reset_value>]]]}:][<down_sampler>:][percentiles\[<p1>, <pn>\]:][explicit_tags:]<metric_name>[{<tag_name1>=<grouping filter>[,...<tag_nameN>=<grouping_filter>]}][{<tag_name1>=<non grouping filter>[,...<tag_nameN>=<non_grouping_filter>]}]

openTSDB中文版

Bosun表达式 - 英文

运算优先级

1. Filtering
2. Grouping
3. Downsampling
4. Interpolation
5. Aggregation
6. Rate Conversion
7. Functions
8. Expressions

Bosun查询举例

avg(q("sum:sys.cpu{host=ny-*}", "5m", "")) > 0.8

Bosun常用函数

q(query string, startDuration string, endDuration string) seriesSet *
band(query string, duration string, period string, num scalar) seriesSet *
over(query string, duration string, period string, num scalar) seriesSet *
change(query string, startDuration string, endDuration string) numberSet *
count(query string, startDuration string, endDuration string) scalar *
window(query string, duration string, period string, num scalar, funcName string) seriesSet *
avg(seriesSet) numberSet
取数据集的平均值
sum(seriesSet) numberSet
求和
cCount(seriesSet) numberSet
数据集的变化程度，根据每个数据与它前一个数据的比较得出。例如，数据集cCount([0,1,0,1])返回3
dev(seriesSet) numberSet
标准差
diff(seriesSet) numberSet
最后一个数减去第一个数的差值
first(seriesSet) numberSet
数据集的第一个数据
last(seriesSet) numberSet
数据集的最后一个数据
len(seriesSet) numberSet
数据集的长度
max(seriesSet) numberSet
最大值
median(seriesSet) numberSet
中间值
min(seriesSet) numberSet
最小值
percentile(seriesSet, p numberSet|scalar) numberSet
返回数据集前百分比为p的数据，例如最大值max相当于p>=1, 中间值相当于p==0.5
since(seriesSet) numberSet
Returns the number of seconds since the most recent data point in each series.
streak(seriesSet) numberSet
连续非零数据的最大长度
t(numberSet, group string) seriesSet
Transposes N series of length 1 to 1 series of length N. If the group parameter is not the empty string, the number of series returned is equal to the number of tagks passed. This is useful for performing scalar aggregation across multiple results from a query. For example, to get the total memory used on the web tier: sum(t(avg(q("avg:os.mem.used{host=-web}", "5m", "")), "")).
alert(name string, key string) numberSet *
abs(numberSet) numberSet
返回数据集中每个元素的绝对值
d(string) scalar
返回一个时间段的秒数，例如d("1h")返回60
tod(scalar) string
Returns an OpenTSDB duration string that represents the given number of seconds. This lets you do math on durations and then pass it to the duration arguments in functions like q()
des(series, alpha scalar, beta scalar) series
Returns series smoothed using Holt-Winters double exponential smoothing. Alpha (scalar) is the data smoothing factor. Beta (scalar) is the trend smoothing factor.
dropg(seriesSet, threshold numberSet|scalar) seriesSet
移除数据集中大于指定阀值的元素
dropge(seriesSet, threshold numberSet|scalar) seriesSet
移除数据集中大于等于指定阀值的元素
dropl(seriesSet, threshold numberSet|scalar) seriesSet
移除数据集中小于等于指定阀值的元素
drople(seriesSet, threshold numberSet|scalar) seriesSet
移除数据集中小于等于指定阀值的元素
dropna(seriesSet) seriesSet
移除数据集中类型是NaN是Inf的元素
dropbool(seriesSet, seriesSet) seriesSet
epoch() scalar
返回当前的Unix时间戳
filter(seriesSet, numberSet) seriesSet
limit(numberSet, count scalar) numberSet
lookup(table string, key string) numberSet
shift(seriesSet, dur string) seriesSet
merge(SeriesSet…) seriesSet
nv(numberSet, scalar) numberSet