This process allows you to pass on only those JSON records that breach a user-defined numeric threshold. You can delay sending continual threshold breaches for a number of seconds by setting an optional parameter to a value greater than zero.
If a JSON record without the delay option breaches the threshold described in these parameters, it is passed to the next node in the pipeline. If not, it is not passed on.
If a JSON record with the delay option breaches the threshold described in these parameters it is passed to the next node in the pipeline after that delay time, if the threshold is breached. Further breaches are passed on immediately until the threshold is no longer breached. If a value does not breach the threshold, it is not passed on.
If a JSON record does not contain the key set in PropertyName, the record will not be passed on. A warning will be written to the user log file.
When ProcessType is set to JsonThresholdEvaluator, a parent field named JsonThresholdEvaluatorConfiguration must be populated with sets of fields as shown below.
The pipeline will not start if the file content is not valid JSON, or if the existing validation of values fail. But some values, that would be considered invalid based on the information in the documentation, will not prevent the pipeline from starting. For example, if the TimeInSecondsToIgnoreShortTermPeaks value is greater than 3600, then the pipeline will still start.
|
{
"Name": "H_AvgPercentCPUUsedThreshold",
"Id": "2ace599c-6983-4afc-b1d1-fb0900545273",
"JsonThresholdEvaluatorConfiguration": {
"PropertyName": "AvgPercentCPUUsed",
"ThresholdValue": 80,
"ComparisonOperator": "GreaterThanOrEqualTo"
},
"ProcessType": "JsonThresholdEvaluator"
}{
"Name": "H_AvgPercentCPUUsedThreshold",
"Id": "7ace599d-6983-4afc-b1d1-fb0900545273",
"JsonThresholdEvaluatorConfiguration": {
"PropertyName": "CPU_busy",
"ThresholdValue": 80,
"ComparisonOperator": "GreaterThanOrEqualTo",
"TimeInSecondsToIgnoreShortTermPeaks": 300
},
"ProcessType": "JsonThresholdEvaluator"
}| Time | CPU_busy | HostName | Threshold breached? | Record passed? |
| 09:00 | 17 43 |
HostA HostB |
N N |
N N |
| 09:01 | 85 56 |
HostA HostB |
Y - timer started N |
N N |
| 09:02 | 86 82 |
HostA HostB |
Y - minute 1 Y - timer started |
N N |
| 09:03 | 84 87 |
HostA HostB |
Y - minute 2 Y - minute 1 |
N N |
| 09:04 | 89 96 |
HostA HostB |
Y - minute 3 Y - minute 2 |
N N |
| 09:05 | 92 83 |
HostA HostB |
Y - minute 4 Y - minute 3 |
N N |
| 09:06 | 82 87 |
HostA HostB |
Y - minute 5 Y - minute 4 |
Y N |
| 09:07 | 78 91 |
HostA HostB |
N - timer reset Y - minute 5 |
N Y |
| 09:08 | 38 95 |
HostA HostB |
N Y - still over threshold |
N Y |
| 09:09 | 90 88 |
HostA HostB |
Y - timer started N - still over threshold |
N Y |
| 09:10 | 87 89 |
HostA HostB |
Y - minute 1 N - still over threshold |
N Y |
A record is passed on for HostA at 09:06 as the value has breached the threshold for more than 300 seconds (5 minutes). At 09:08 the value no longer breaches the threshold so the timer is reset. At 09:09 the value breaches the threshold again and the timer is started, and if this continues will pass on the record at 09:14.
Alerts are first generated for HostB at 09:07 as the value has breached the threshold for more than 300 seconds (5 minutes) and again at each minute from 09:08 onwards as the value is still breaching the threshold.