Is it possible to multiply 2 arrays

[AndersB]

I‘m trying to build a timeseries which can be used to trigger an alert if too many emails are bouncing.

I’m able to create both a bounce rate timeseries, and also a timeseries with number of mails delivered – based on 15 minutes intervals.

But as I don’t want the alert to go off for a single bounced email – so I need a “weighted” value to alert on - eg

Interval a) 15% bounced mails – 100 mails send = weight = 15

Interval b) 100% bounced mails – 1 mail send = weight = 1

Interval 3) 2% bounced mails – 1000 mails send = weight = 20

So in principle “just” a way to multiple the two timeseries.

timeseries  `Bounce Rate`= avg(log. EmailBounced),`Count`= count(log. EmailBounced), filter:Incoming == false, interval:15m

| fieldsAdd Weight=`Bounce Rate`*Count (is failing because it’s not allowed to multiple arrays)

Is this possible at all – or do I need to look in a different direction?

[tracegazer · Accepted solution]

Hi! By any chance, have you tried it this way?

| fieldsAdd Weight = `Bounce Rate`[] * rate[]

[AndersB]

This actually also worked - so I think I will prefer this solution, as I then can keep working with my metric 🙂

[t_pawlak · Accepted solution]

Hi,
In DQL, timeseries and makeTimeseries produce array-like series, so multiplying two series directly (BounceRate * Count) isn’t supported – that’s why you see the “not allowed to multiply arrays” error.

But for this use case IMO you don’t really need to multiply two series. If EmailBounced is 1 for a bounced email and 0 otherwise, then:

• BounceRate = bounced / sent
• Count = sent
• Weight = BounceRate * Count = bounced.

You can compute everything with a simple summarize over 15-minute buckets, for example:

fetch logs
| filter Incoming == false
| summarize
    Sent    = count(),
    Bounced = sum(log.EmailBounced),
  by: { interval_start = bin(timestamp, 15m) }
| fieldsAdd
    BounceRate = Bounced * 1.0 / Sent,   
    Weight     = Bounced 
| sort interval_start asc

This gives you one row per 15-minute interval with Sent, Bounced, BounceRate, and your “weighted” value (Weight). You can then base your alert on Weight (for example, fire only if the number of bounced emails in a 15-minute interval exceeds a certain threshold

[AndersB]

Thanks for the help on this - I was focused on using the metric for it - but it makes sense to use the log entries instead!

(and just for the record - the Weight variable should IMHO be calculated like this - but that's just a minor detail)
Weight = BounceRate * Sent /100