Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
absent_over_time_events_received
required_capability: ts_command_v0
required_capability: absent_over_time

TS k8s
| WHERE cluster == "prod" AND pod == "two"
Expand All @@ -23,7 +22,6 @@ false | two | 2024-05-10T00:22:00.000Z

absent_over_time_of_long
required_capability: ts_command_v0
required_capability: absent_over_time
TS k8s | STATS is_present = max(absent_over_time(network.bytes_in)) BY cluster, time_bucket = tbucket(10minute) | SORT cluster, time_bucket | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -40,8 +38,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_boolean
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | STATS is_present = max(absent_over_time(network.eth0.up)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -58,8 +54,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_date_nanos
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | STATS is_present = max(absent_over_time(network.eth0.last_up)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -76,8 +70,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_date
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | STATS is_present = max(absent_over_time(to_datetime(network.eth0.last_up))) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -94,8 +86,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_version
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | STATS is_present = max(absent_over_time(network.eth0.firmware_version)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -112,8 +102,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_integer
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | STATS is_present = max(absent_over_time(network.eth0.currently_connected_clients)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -130,7 +118,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_text
required_capability: ts_command_v0
required_capability: absent_over_time
TS k8s | STATS is_present = max(absent_over_time(event_log)) BY cluster, time_bucket = tbucket(10minute) | SORT cluster, time_bucket | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -147,8 +134,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_keyword
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | STATS is_present = max(absent_over_time(network.eth0.tx)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand Down Expand Up @@ -182,8 +167,6 @@ false | staging | 2024-05-09T23:50:00.000Z

absent_over_time_of_geopoint
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_datasets_geospatial_fields
TS k8s | STATS is_present = max(absent_over_time(event_city)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -200,8 +183,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_geoshape
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_datasets_geospatial_fields
TS k8s | STATS is_present = max(absent_over_time(event_city_boundary)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -218,8 +199,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_shape
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_datasets_geospatial_fields
TS k8s | STATS is_present = max(absent_over_time(event_shape)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -236,8 +215,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_of_point
required_capability: ts_command_v0
required_capability: absent_over_time
required_capability: k8s_datasets_geospatial_fields
TS k8s | STATS is_present = max(absent_over_time(event_location)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand All @@ -254,7 +231,6 @@ false | staging | 2024-05-10T00:20:00.000Z

absent_over_time_with_filtering
required_capability: ts_command_v0
required_capability: absent_over_time
TS k8s | WHERE pod != "three" | STATS is_present = max(absent_over_time(network.bytes_in)) BY cluster, time_bucket = tbucket(10 minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand Down Expand Up @@ -284,7 +260,6 @@ false | three | 2024-05-09T23:40:00.000Z

eval_on_absent_over_time
required_capability: ts_command_v0
required_capability: absent_over_time
TS k8s | STATS is_present = max(absent_over_time(network.bytes_in)) BY pod, time_bucket = tbucket(10 minute) | EVAL int = to_integer(is_present) | LIMIT 10 | SORT time_bucket, pod;

is_present:boolean | pod:keyword | time_bucket:datetime | int:integer
Expand All @@ -301,7 +276,6 @@ false | two | 2024-05-10T00:20:00.000Z | 0

absent_over_time_events_received_as_integer
required_capability: ts_command_v0
required_capability: absent_over_time

TS k8s
| WHERE cluster == "prod" AND pod == "two"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ cost:double | time_bucket:datetime

avg_over_time_of_integer
required_capability: ts_command_v0
required_capability: k8s_dataset_additional_fields
TS k8s | STATS clients = avg(avg_over_time(network.eth0.currently_connected_clients)) BY time_bucket = bucket(@timestamp,1minute) | SORT time_bucket | LIMIT 10;

clients:double | time_bucket:datetime
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -191,8 +191,6 @@ bytes:long | pod:keyword | time_bucket:datetime | kb:double

count_distinct_over_time_multi_values
required_capability: ts_command_v0
required_capability: count_distinct_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | WHERE @timestamp < "2024-05-10T00:10:00.000Z" | STATS events = avg(count_distinct_over_time(events_received)) by pod, time_bucket = bucket(@timestamp, 10minute) | SORT time_bucket, pod | LIMIT 10;

events:double | pod:keyword | time_bucket:datetime
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@ null | 2024-05-10T00:01:00.000Z
delta_of_integer
required_capability: ts_command_v0
required_capability: delta_ts_agg
required_capability: k8s_dataset_additional_fields
TS k8s | STATS clients = avg(delta(network.eth0.currently_connected_clients)) BY time_bucket = bucket(@timestamp,1minute) | SORT time_bucket | LIMIT 10;

clients:double | time_bucket:datetime
Expand All @@ -46,7 +45,6 @@ null | 2024-05-10T00:01:00.000Z
delta_of_integer_grouping
required_capability: ts_command_v0
required_capability: delta_ts_agg
required_capability: k8s_dataset_additional_fields
TS k8s | STATS clients = avg(delta(network.eth0.currently_connected_clients)) BY cluster, time_bucket = bucket(@timestamp,1minute) | SORT time_bucket, cluster | LIMIT 10;

clients:double | cluster:keyword | time_bucket:datetime
Expand Down Expand Up @@ -126,7 +124,6 @@ avg_bytes:double | cluster:keyword | time_bucket:datetime | kb_minus_offs
delta_multi_values
required_capability: ts_command_v0
required_capability: delta_ts_agg
required_capability: k8s_dataset_additional_fields
TS k8s | WHERE @timestamp < "2024-05-10T00:10:00.000Z" | STATS events = sum(delta(events_received)) by pod, time_bucket = bucket(@timestamp, 1minute) | SORT events desc, pod, time_bucket | LIMIT 10;

events:double | pod:keyword | time_bucket:datetime
Expand All @@ -146,7 +143,6 @@ null | two | 2024-05-10T00:07:00.000Z
delta_null_values
required_capability: ts_command_v0
required_capability: delta_ts_agg
required_capability: k8s_dataset_additional_fields
TS k8s | WHERE @timestamp > "2024-05-10T00:10:00.000Z" and @timestamp < "2024-05-10T00:15:00.000Z" | STATS events = sum(delta(events_received)) by pod, time_bucket = bucket(@timestamp, 1minute) | SORT events desc, pod, time_bucket | LIMIT 10;

events:double | pod:keyword | time_bucket:datetime
Expand All @@ -167,7 +163,6 @@ null | two | 2024-05-10T00:13:00.000Z
delta_all_value_types
required_capability: ts_command_v0
required_capability: delta_ts_agg
required_capability: k8s_dataset_additional_fields
TS k8s | STATS events = sum(delta(events_received)) by pod, time_bucket = bucket(@timestamp, 10minute) | SORT events desc, pod, time_bucket | LIMIT 10 ;

events:double | pod:keyword | time_bucket:datetime
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,6 @@ avg_bytes:double | cluster:keyword | time_bucket:datetime | kb_minus_offs

idelta_multi_values
required_capability: ts_command_v0
required_capability: k8s_dataset_additional_fields
TS k8s | WHERE @timestamp < "2024-05-10T00:10:00.000Z" | STATS events = sum(idelta(events_received)) by pod, time_bucket = bucket(@timestamp, 1minute) | SORT events desc, pod, time_bucket | LIMIT 10;

events:double | pod:keyword | time_bucket:datetime
Expand All @@ -132,7 +131,6 @@ null | two | 2024-05-10T00:07:00.000Z

idelta_null_values
required_capability: ts_command_v0
required_capability: k8s_dataset_additional_fields
TS k8s | WHERE @timestamp > "2024-05-10T00:10:00.000Z" and @timestamp < "2024-05-10T00:15:00.000Z" | STATS events = sum(idelta(events_received)) by pod, time_bucket = bucket(@timestamp, 1minute) | SORT events desc, pod, time_bucket | LIMIT 10;

events:double | pod:keyword | time_bucket:datetime
Expand All @@ -152,7 +150,6 @@ null | two | 2024-05-10T00:13:00.000Z

idelta_all_value_types
required_capability: ts_command_v0
required_capability: k8s_dataset_additional_fields
// tag::idelta[]
TS k8s
| STATS events = sum(idelta(events_received)) by pod, time_bucket = bucket(@timestamp, 10minute)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -375,7 +375,6 @@ events:long | pod:keyword | time_bucket:datetime

min_over_time_null_values
required_capability: ts_command_v0
required_capability: k8s_dataset_additional_fields
TS k8s | WHERE @timestamp > "2024-05-10T00:10:00.000Z" and @timestamp < "2024-05-10T00:15:00.000Z" | STATS events = sum(min_over_time(events_received)) by pod, time_bucket = bucket(@timestamp, 1minute) | SORT events NULLS FIRST, time_bucket | LIMIT 10;

events:long | pod:keyword | time_bucket:datetime
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
present_over_time_events_received
required_capability: ts_command_v0
required_capability: present_over_time

TS k8s
| WHERE cluster == "prod" AND pod == "two"
Expand Down Expand Up @@ -135,8 +134,6 @@ true | staging | 2024-05-10T00:20:00.000Z

present_over_time_of_keyword
required_capability: ts_command_v0
required_capability: present_over_time
required_capability: k8s_dataset_additional_fields
TS k8s | STATS is_present = max(present_over_time(network.eth0.up)) BY cluster, time_bucket = tbucket(10minute) | SORT time_bucket, cluster | LIMIT 10;

is_present:boolean | cluster:keyword | time_bucket:datetime
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,6 @@ max_cost: double

maxRateAndBytes
required_capability: ts_command_v0
required_capability: implicit_last_over_time
TS k8s | STATS max(60 * rate(network.total_bytes_in)), max(network.bytes_in);

max(60 * rate(network.total_bytes_in)): double | max(network.bytes_in): long
Expand Down Expand Up @@ -239,7 +238,6 @@ null | three | 2024-05-10T00:01:00.000

max_over_time
required_capability: ts_command_v0
required_capability: max_over_time
// tag::max_over_time[]
TS k8s
| STATS cost=sum(max_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
Expand All @@ -263,7 +261,6 @@ cost:double | cluster:keyword | time_bucket:datetime

min_over_time
required_capability: ts_command_v0
required_capability: min_over_time
// tag::min_over_time[]
TS k8s
| STATS cost=sum(min_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
Expand All @@ -287,7 +284,6 @@ cost:double | cluster:keyword | time_bucket:datetime

max_of_avg_over_time
required_capability: ts_command_v0
required_capability: avg_over_time
// tag::avg_over_time[]
TS k8s
| STATS max_cost=max(avg_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
Expand All @@ -311,7 +307,6 @@ max_cost:double | cluster:keyword | time_bucket:datetime

avg_of_avg_over_time
required_capability: ts_command_v0
required_capability: avg_over_time
TS k8s | STATS avg_cost=avg(avg_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute) | SORT avg_cost DESC, time_bucket DESC, cluster | LIMIT 10;

avg_cost:double | cluster:keyword | time_bucket:datetime
Expand All @@ -330,7 +325,6 @@ avg_cost:double | cluster:keyword | time_bucket:datetime

max_of_last_over_time
required_capability: ts_command_v0
required_capability: last_over_time
// tag::last_over_time[]
TS k8s
| STATS max_cost=max(last_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
Expand All @@ -354,7 +348,6 @@ max_cost:double | cluster:keyword | time_bucket:datetime

max_of_first_over_time
required_capability: ts_command_v0
required_capability: first_over_time
// tag::first_over_time[]
TS k8s
| STATS max_cost=max(first_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute)
Expand All @@ -378,7 +371,6 @@ max_cost:double | cluster:keyword | time_bucket:datetime

sum_over_time
required_capability: ts_command_v0
required_capability: sum_over_time

// tag::sum_over_time[]
TS k8s
Expand All @@ -405,7 +397,6 @@ sum_cost:double | cluster:keyword | time_bucket:datetime

count_over_time
required_capability: ts_command_v0
required_capability: count_over_time

// tag::count_over_time[]
TS k8s
Expand All @@ -432,7 +423,6 @@ count:long | cluster:keyword | time_bucket:datetime
;
count_distinct_over_time
required_capability: ts_command_v0
required_capability: count_distinct_over_time

// tag::count_distinct_over_time[]
TS k8s
Expand Down Expand Up @@ -474,7 +464,6 @@ cost_per_mb:double | cluster:keyword | time_bucket:datetime

present_over_time
required_capability: ts_command_v0
required_capability: present_over_time

// tag::present_over_time[]
TS k8s
Expand All @@ -501,7 +490,6 @@ true | two | 2024-05-10T00:22:00.000Z

absent_over_time
required_capability: ts_command_v0
required_capability: absent_over_time

// tag::absent_over_time[]
TS k8s
Expand Down
Loading