bosun config to read a single field (string)

Question

I am unable to read comma separated string field by bosun elastic search operation, however it works fine for numeric field. I want to read a field has comma separated strings, then I want to put it in template subject and notify to slack channel.

Below how I read numeric value but same not working string, I want to read a field called "tags" that has comma separated values of string like "test,poc,custa,maria"

$q = esstat(esls("metrics-xxx"), "host", esquery("metric", "disk"), "used_percent", "avg", "1m", "7m", "") $val = avg($q)

Anyone worked on that?

Answer 1

I'm not sure I'm entirely clear on question. Few things to keep in mind:

1. Elastic monitoring in Bosun is really intended for alerting on Logs, not metrics stored in elastic. You might be able to do it, but not a scenario that has been explored by any of the Bosun authors.
2. Return types in Bosun's expression language or typed, the only type currently returned by elastic queries is a seriesSet (see http://bosun.org/expressions#elastic-query-functions)
3. Are you sure you have a CSV string value, often in elastic you would map that to an array and have the analyzer split on commas.

That being said if all you want to do is display it in the template, you can use either .ESQuery or .ESQueryAll to get the raw rows, and you display the .Tag field of some sample rows from your query (or maybe just the first row). See usage of these template functions in the docs.