In addition to evaluating the attributes of the most recent check event, Sensu filters can also examine the history of check results for a given entity. This feature provides an additional layer of flexibility in event processing, allowing you to create filters based on trends or changes over time. In a Sensu filter expression, event.check.history.length refers to the total number of check results stored in the history for a specific event:
This expression leverages JavaScript array indexing to access the second-to-last check result in the history. Let's break it down:
event.check.history: The history array containing a sequence of check results.
event.check.history.length - 2: Accessing the second-to-last check result in the history. Remember, arrays in JavaScript use 0-based indexing. We can access the second-to-last element by finding the array's length and subtracting 2.
.status: Accessing the status field of the check result. This field represents the result of the check: 0 for "OK", 1 for "WARNING", 2 for "CRITICAL", and so on.
!=0: Checking if the status is not equal to 0. If the second-to-last check's status was not "OK", the expression will be evaluated as true.
Description
Category
This is an issue with:
Affected pages
https://docs.sensu.io/sensu-go/latest/observability-pipeline/observe-filter/sensu-query-expressions/#examples
Proposed Addition
Evaluate check history status
In addition to evaluating the attributes of the most recent check event, Sensu filters can also examine the history of check results for a given entity. This feature provides an additional layer of flexibility in event processing, allowing you to create filters based on trends or changes over time. In a Sensu filter expression,
event.check.history.lengthrefers to the total number of check results stored in the history for a specific event:event.check.history[event.check.history.length - 2].status != 0This expression leverages JavaScript array indexing to access the second-to-last check result in the history. Let's break it down:
event.check.history: The history array containing a sequence of check results.event.check.history.length - 2: Accessing the second-to-last check result in the history. Remember, arrays in JavaScript use 0-based indexing. We can access the second-to-last element by finding the array's length and subtracting 2..status: Accessing the status field of the check result. This field represents the result of the check: 0 for "OK", 1 for "WARNING", 2 for "CRITICAL", and so on.!=0: Checking if the status is not equal to 0. If the second-to-last check's status was not "OK", the expression will be evaluated astrue.