eval_load.tick

var warn_load1  = 2
var warn_load5  = 1
var warn_load15 = 0.5

var crit_load1  = 4
var crit_load5  = 1.5
var crit_load15 = 1

var period = 1m
var every = 1m

var suppress = 5m

var data = batch
  |query('''SELECT max(load1),max(load5),max(load15),last(n_cpus) FROM "telegraf"."default"."system"''')
    .period(period)
    .every(every)
    .groupBy('host')
  |eval(lambda: float(warn_load1) * float("last") )
    .as('warn_load1_thresh')
    .keep()
  |eval(lambda: float(warn_load5) * float("last") )
    .as('warn_load5_thresh')
    .keep()
  |eval(lambda: float(warn_load15) * float("last") )
    .as('warn_load15_thresh')
    .keep()
  |eval(lambda: float(crit_load1) * float("last") )
    .as('crit_load1_thresh')
    .keep()
  |eval(lambda: float(crit_load5) * float("last") )
    .as('crit_load5_thresh')
    .keep()
  |eval(lambda: float(crit_load15) * float("last") )
    .as('crit_load15_thresh')
    .keep()
  |log()

var alert = data
  |alert()
    .id('[kapacitor] {{ index .Tags "host"}}')
    .message('{{ .ID }} LOAD is {{ .Level }} load1:{{ index .Fields "max" }} load5:{{ index .Fields "max_1" }} load15:{{ index .Fields "max_2" }} }}')
    .warn(lambda: "max" > "warn_load1_thresh" OR "max_1" > "warn_load5_thresh" OR "max_2" > "warn_load15_thresh")
    .crit(lambda: "max" > "crit_load1_thresh" OR "max_1" > "crit_load5_thresh" OR "max_2" > "crit_load15_thresh")

alert
  .stateChangesOnly(suppress)
  .flapping(0.25, 0.5)
  .slack()
  .email()

alert
  .alerta()
    .value('{{ index .Fields "max" }}')
    .resource('{{ index .Tags "host"}}')