Kapacitor

Stream processing + alerting engine for TICK stack.

Port: 9092 (conflicts with Kafka)

Stream Pipeline

Option 1:

Telegraf -> InfluxDB -> Kapacitor

Option 2:

Telegraf -> Kapacitor

Clustering HA
alert dedupe
auth using InfluxDB meta nodes
no authz yet (as of 1.4)
subscribes to InfluxDB to forward all data to it (influx> SHOW SUBSCRIPTIONS)
TICKscript - DSL language for how to process data (script.tick)
task
stream
batch (InfluxDB query)
send Telegraf to localhost:9092, use Kapacitor as drop in replacement for InfluxDB protocol endpoint

kapacitord config > kapacitor.conf

/etc/kapacitor/kapacitor.conf
/var/log/kapacitor/kapacitor.log

export KAPACITOR_URL=http://kapacitor:9092

kapacitor

TICKscript can create running average + alert if CPU drops below 3 std deviations:

crit(lambda: sigma("field") > 3)

See docs for code contents:

kapacitor define cpu_alert -tick cpu_alert.tick

kapacitor list tasks

kapacitor show cpu_alert

take a sample to test with:

kapacitor record stream -task cpu_alert -duration 60s

rid=xxxxxx-xxxxx...

kapacitor list recordings $rid

kapacitor replay_recordings $rid

kapacitor enable cpu_alert

kapacitor show cpu_alert

Partial port from private Knowledge Base page 2018+