InfluxDB comparison between 1w and 2w back for outage monitoring

pctOutage.flux

import "experimental"
import "math"
import "system"


/* Compares a value with 1w and 2w back. If the percentage diff is large
   (positive or negative), it means that we have some outage or other anomaly. */

subQuery = (start, stop, myField, label, timeShiftDuration) =>
  from(bucket: "my-bucket")
  |> range(start: start, stop: stop)
  |> filter(fn: (r) => r._measurement == "event")
  |> filter(fn: (r) => r._field == "value")
  |> filter(fn: (r) => r.environment == "prod")
  |> filter(fn: (r) => r.site == "eu-west-1")
  |> filter(fn: (r) => r.short_name == "trev")
  |> filter(fn: (r) => r.operation == "write")
  |> filter(fn: (r) => r.sub_tag == myField)
  |> group(columns: ["sub_tag"])
  |> aggregateWindow(every: 1m, fn: sum)
  |> drop(columns:["_start","_stop"])
  |> set(key: "sub_tag", value: myField+" "+label)
  |> timeShift(duration: timeShiftDuration, columns: ["_start", "_stop", "_time"])
  |> movingAverage(n: 10)


start7d = experimental.subDuration(from: v.timeRangeStart, d: 7d)
stop7d = experimental.subDuration(from: v.timeRangeStop, d: 7d)
start14d = experimental.subDuration(from: v.timeRangeStart, d: 14d)
stop14d = experimental.subDuration(from: v.timeRangeStop, d: 14d)

smallestPct = (a, b, c, label) => {

    s0 = join(tables: {s0: a, s1: b}, on: ["_time"])
      |> map(fn: (r) => ({_time: r._time, _value: r._value_s0 / r._value_s1}))

    s1 = join(tables: {s0: a, s1: c}, on: ["_time"])
      |> map(fn: (r) => ({_time: r._time, _value: r._value_s0 / r._value_s1}))

    normalizeX = (x, tables=<-) => tables
      |> map(fn: (r) => ({r with _value: r._value + x}))

    absX = (tables=<-) => tables
      |> map(fn: (r) => ({r with _value: math.abs(x: r._value)}))

    s2 = s0
      |> normalizeX(x: -1.0)
      |> absX()

    s3 = s1
      |> normalizeX(x: -1.0)
      |> absX()

    s4 = join(tables: {s2: s2, s3: s3}, on: ["_time"])
      |> map(fn: (r) => ({_time: r._time, _value: math.mMin(x: r._value_s2, y: r._value_s3)}))
      |> rename(columns: {_value: label})

    return s4
}

fetchJoin = (myField) => {
  t0 = subQuery(start: v.timeRangeStart, stop: v.timeRangeStop, myField: myField, label: "now", timeShiftDuration: 0s)
  t1 = subQuery(start: start7d, stop: stop7d, myField: myField, label: "1w", timeShiftDuration: 7d)
  t2 = subQuery(start: start14d, stop: stop14d, myField: myField, label: "2w", timeShiftDuration: 14d)

  return smallestPct(a: t0, b: t1, c: t2, label: myField)
}

f0 = fetchJoin(myField: "THINGIE_1")
f1 = fetchJoin(myField: "THINGIE_2")
f2 = fetchJoin(myField: "OTHER_STUFF")

union(tables: [f0, f1, f2])