**Warning!**This page documents an earlier version of Kapacitor, which is no longer actively developed. Kapacitor v1.5 is the most recent stable version of Kapacitor.

The WhereNode filters the data stream by a given expression.

Example:

```
var sums = stream
|from()
.groupBy('service', 'host')
|sum('value')
//Watch particular host for issues.
sums
|where(lambda: "host" == 'h001.example.com')
|alert()
.crit(lambda: TRUE)
.email().to('user@example.com')
```

## Index

### Properties

### Chaining Methods

- Alert
- Bottom
- Count
- Deadman
- Derivative
- Distinct
- Eval
- First
- GroupBy
- HttpOut
- InfluxDBOut
- Join
- Last
- Log
- Max
- Mean
- Median
- Min
- Percentile
- Sample
- Shift
- Spread
- Stats
- Stddev
- Sum
- Top
- Union
- Where
- Window

## Chaining Methods

Chaining methods create a new node in the pipeline as a child of the calling node.
They do not modify the calling node.
Chaining methods are marked using the `|`

operator.

### Alert

Create an alert node, which can trigger alerts.

```
node|alert()
```

Returns: AlertNode

### Bottom

Select the bottom `num`

points for `field`

and sort by any extra tags or fields.

```
node|bottom(num int64, field string, fieldsAndTags ...string)
```

Returns: InfluxQLNode

### Count

Count the number of points.

```
node|count(field string)
```

Returns: InfluxQLNode

### Deadman

Helper function for creating an alert on low throughput, aka deadman's switch.

- Threshold – trigger alert if throughput drops below threshold in points/interval.
- Interval – how often to check the throughput.
- Expressions – optional list of expressions to also evaluate. Useful for time of day alerting.

Example:

```
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|deadman(100.0, 10s)
//Do normal processing of data
data...
```

The above is equivalent to this Example:

```
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
data
|stats(10s)
|derivative('emitted')
.unit(10s)
.nonNegative()
|alert()
.id('node \'stream0\' in task \'{{ .TaskName }}\'')
.message('{{ .ID }} is {{ if eq .Level "OK" }}alive{{ else }}dead{{ end }}: {{ index .Fields "emitted" | printf "%0.3f" }} points/10s.')
.crit(lamdba: "emitted" <= 100.0)
//Do normal processing of data
data...
```

The `id`

and `message`

alert properties can be configured globally via the 'deadman' configuration section.

Since the AlertNode is the last piece it can be further modified as normal. Example:

```
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 1s and checked every 10s.
data
|deadman(100.0, 10s)
.slack()
.channel('#dead_tasks')
//Do normal processing of data
data...
```

You can specify additional lambda expressions to further constrain when the deadman's switch is triggered. Example:

```
var data = stream
|from()...
// Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
// Only trigger the alert if the time of day is between 8am-5pm.
data
|deadman(100.0, 10s, lambda: hour("time") >= 8 AND hour("time") <= 17)
//Do normal processing of data
data...
```

```
node|deadman(threshold float64, interval time.Duration, expr ...tick.Node)
```

Returns: AlertNode

### Derivative

Create a new node that computes the derivative of adjacent points.

```
node|derivative(field string)
```

Returns: DerivativeNode

### Distinct

Produce batch of only the distinct points.

```
node|distinct(field string)
```

Returns: InfluxQLNode

### Eval

Create an eval node that will evaluate the given transformation function to each data point. A list of expressions may be provided and will be evaluated in the order they are given and results of previous expressions are made available to later expressions.

```
node|eval(expressions ...tick.Node)
```

Returns: EvalNode

### First

Select the first point.

```
node|first(field string)
```

Returns: InfluxQLNode

### GroupBy

Group the data by a set of tags.

Can pass literal * to group by all dimensions. Example:

```
|groupBy(*)
```

```
node|groupBy(tag ...interface{})
```

Returns: GroupByNode

### HttpOut

Create an http output node that caches the most recent data it has received. The cached data is available at the given endpoint. The endpoint is the relative path from the API endpoint of the running task. For example if the task endpoint is at "/api/v1/task/<task_name>" and endpoint is "top10", then the data can be requested from "/api/v1/task/<task_name>/top10".

```
node|httpOut(endpoint string)
```

Returns: HTTPOutNode

### InfluxDBOut

Create an influxdb output node that will store the incoming data into InfluxDB.

```
node|influxDBOut()
```

Returns: InfluxDBOutNode

### Join

Join this node with other nodes. The data is joined on timestamp.

```
node|join(others ...Node)
```

Returns: JoinNode

### Last

Select the last point.

```
node|last(field string)
```

Returns: InfluxQLNode

### Log

Create a node that logs all data it receives.

```
node|log()
```

Returns: LogNode

### Max

Select the maximum point.

```
node|max(field string)
```

Returns: InfluxQLNode

### Mean

Compute the mean of the data.

```
node|mean(field string)
```

Returns: InfluxQLNode

### Median

Compute the median of the data. Note, this method is not a selector, if you want the median point use .percentile(field, 50.0).

```
node|median(field string)
```

Returns: InfluxQLNode

### Min

Select the minimum point.

```
node|min(field string)
```

Returns: InfluxQLNode

### Percentile

Select a point at the given percentile. This is a selector function, no interpolation between points is performed.

```
node|percentile(field string, percentile float64)
```

Returns: InfluxQLNode

### Sample

Create a new node that samples the incoming points or batches.

One point will be emitted every count or duration specified.

```
node|sample(rate interface{})
```

Returns: SampleNode

### Shift

Create a new node that shifts the incoming points or batches in time.

```
node|shift(shift time.Duration)
```

Returns: ShiftNode

### Spread

Compute the difference between min and max points.

```
node|spread(field string)
```

Returns: InfluxQLNode

### Stats

Create a new stream of data that contains the internal statistics of the node. The interval represents how often to emit the statistics based on real time. This means the interval time is independent of the times of the data points the source node is receiving.

```
node|stats(interval time.Duration)
```

Returns: StatsNode

### Stddev

Compute the standard deviation.

```
node|stddev(field string)
```

Returns: InfluxQLNode

### Sum

Compute the sum of all values.

```
node|sum(field string)
```

Returns: InfluxQLNode

### Top

Select the top `num`

points for `field`

and sort by any extra tags or fields.

```
node|top(num int64, field string, fieldsAndTags ...string)
```

Returns: InfluxQLNode

### Union

Perform the union of this node and all other given nodes.

```
node|union(node ...Node)
```

Returns: UnionNode

### Where

And another expression onto the existing expression.

```
node|where(expression tick.Node)
```

Returns: WhereNode

### Window

Create a new node that windows the stream by time.

NOTE: Window can only be applied to stream edges.

```
node|window()
```

Returns: WindowNode