Add Examining Check History Status to Sensu Query Expressions examples

Description

Affected pages

https://docs.sensu.io/sensu-go/latest/observability-pipeline/observe-filter/sensu-query-expressions/#examples

Proposed Addition

Evaluate check history status

In addition to evaluating the attributes of the most recent check event, Sensu filters can also examine the history of check results for a given entity. This feature provides an additional layer of flexibility in event processing, allowing you to create filters based on trends or changes over time. In a Sensu filter expression, event.check.history.length refers to the total number of check results stored in the history for a specific event:

event.check.history[event.check.history.length - 2].status != 0

This expression leverages JavaScript array indexing to access the second-to-last check result in the history. Let's break it down:

event.check.history: The history array containing a sequence of check results.

event.check.history.length - 2: Accessing the second-to-last check result in the history. Remember, arrays in JavaScript use 0-based indexing. We can access the second-to-last element by finding the array's length and subtracting 2.

.status: Accessing the status field of the check result. This field represents the result of the check: 0 for "OK", 1 for "WARNING", 2 for "CRITICAL", and so on.

!=0: Checking if the status is not equal to 0. If the second-to-last check's status was not "OK", the expression will be evaluated as true.

sensu / sensu-docs