DQL for Anomaly Detector to compare multiple metrics and trigger alert

[p_devulapalli]

I am trying to trigger an alert using anomaly detector by looking at multiple metrics . As an example when dt.host.disk.avail is less than 100GB and dt.host.disk.free is less than 10%  . Both the condition should match to trigger a alert . I know anomaly detectors only support single metric, so  idea was to include a condition and set the threshold based on the condition value . Below is an example DQL

timeseries { availableDiskSpace = avg(dt.host.disk.avail),
diskUsed = avg(dt.host.disk.used),
diskFreePercent = avg(dt.host.disk.free)
},
by: { dt.entity.host, dt.entity.disk }, interval: 1m,

filter: { matchesValue(entityAttr(dt.entity.host, "entity.name"), { "HOST16"}) AND matchesValue(entityAttr(dt.entity.disk, "entity.name"), "X:\\") }

| fieldsAdd condition = if(arrayAvg(diskFreePercent) < 10 AND arrayAvg(availableDiskSpace) < 29770882367488, 1, else: 0)
| fieldsRemove availableDiskSpace, diskUsed, diskFreePercent

But the output is not really in a timeseries format so anomaly detector does not accept . 

I am looking for some ideas on how to best modify the DQL to suite my use case please

[marco_irmer · Accepted solution]

You can use an iterative expression, which uses square bracket notation ('[]'), to form a new timeseries array using conditional logic. The expression will iterate through each datapoint in the 'diskFreePercent' and 'availableDiskSpace' arrays and apply the logic to calculate whether the value of 'condition' should be 0 or 1 at each position. You can then use the 'condition' field in your anomaly detector.

The DQL would look something like this:

timeseries { availableDiskSpace = avg(dt.host.disk.avail),
diskUsed = avg(dt.host.disk.used),
diskFreePercent = avg(dt.host.disk.free)
},
by: { dt.entity.host, dt.entity.disk }, interval: 1m,

filter: { matchesValue(entityAttr(dt.entity.host, "entity.name"), { "HOST16"}) AND matchesValue(entityAttr(dt.entity.disk, "entity.name"), "X:\\") }

| fieldsAdd condition[] = if(diskFreePercent[] < 10 AND availableDiskSpace[] < 29770882367488, 1, else: 0)
| fieldsRemove availableDiskSpace, diskUsed, diskFreePercent

 I hope this helps 🙂

[p_devulapalli]

Thank you for the tip @marco_irmer , that helped