JoinNode

The join node joins data from any number of nodes. As each data point is received from a parent node it is paired with the next data points from the other parent nodes with a matching timestamp. Each parent node contributes at most one point to each joined point. A tolerance can be supplied to join points that do not have perfectly aligned timestamps. Any points that fall within the tolerance are joined on the timestamp. If multiple points fall within the same tolerance window than they are joined in the order they arrive.

Aliases are used to prefix all fields from the respective nodes.

The join can be an inner or outer join, see the JoinNode.Fill property.

Example: Joining two measurements

In the example below, the errors and requests streams are joined and transformed to calculate a combined field.

var errors = stream
  |from()
    .measurement('errors')
var requests = stream
  |from()
    .measurement('requests')
// Join the errors and requests streams
errors
  |join(requests)
    // Provide prefix names for the fields of the data points.
    .as('errors', 'requests')
    // points that are within 1 second are considered the same time.
    .tolerance(1s)
    // fill missing values with 0, implies outer join.
    .fill(0.0)
    // name the resulting stream
    .streamName('error_rate')
    // treat a delete from one side of the join as a delete to all sides
    .deleteAll(TRUE)
  // Both the "value" fields from each parent have been prefixed
  // with the respective names 'errors' and 'requests'.
  |eval(lambda: "errors.value" / "requests.value")
    .as('rate')
  ...

Example: Joining three or more measurements

In the example below, the errors, missing_page_errors, and server_errors are joined and transformed to calculate two combined fields: 404_rate and 500_rate.

var errors = stream
|from()
  .measurement('errors')

var missing_page_errors = stream
|from()
  .measurement('errors')
  .where(lambda: "type" == '404')

var server_errors = stream
|from()
  .measurement('errors')
  .where(lambda: "type" == '500')

// Join the errors, missing_page_errors, and server_errors streams
errors
  |join(missing_page_errors, server_errors)
    // Provide prefix names for the fields of the data points.
    .as('errors', '404', '500')
    // points that are within 1 second are considered the same time.
    .tolerance(1s)
    // fill missing values with 0, implies outer join.
    .fill(0.0)
    // name the resulting stream
    .streamName('error_rates')
  // The "value" fields from each parent have been prefixed
  // with the respective names 'errors', 'missing_page_errors', 'and server_errors'.
  // Calculate the percentage of 404 errors
  |eval(lambda: "404.value" / "errors.value")
    .as('404_rate')
    // Calculate the percentage of 500 errors
  |eval(lambda: "500.value" / "errors.value")
    .as('500_rate')
  ...

Constructor

Property Methods

Chaining Methods

Alert, Barrier, Bottom, ChangeDetect, Combine, Count, CumulativeSum, Deadman, Default, Delete, Derivative, Difference, Distinct, Ec2Autoscale, Elapsed, Eval, First, Flatten, GroupBy, HoltWinters, HoltWintersWithFit, HttpOut, HttpPost, InfluxDBOut, Join, K8sAutoscale, KapacitorLoopback, Last, Log, Max, Mean, Median, Min, Mode, MovingAverage, Percentile, Sample, Shift, Sideload, Spread, StateCount, StateDuration, Stats, Stddev, Sum, SwarmAutoscale, Top, Trickle, Union, Where, Window

Properties

Property methods modify state on the calling node. They do not add another node to the pipeline, and always return a reference to the calling node. Property methods are marked using the . operator.

As

Prefix names for all fields from the respective nodes. Each field from the parent nodes will be prefixed with the provided name and a ‘.’. See the example above.

The names cannot have a dot ‘.’ character.

join.as(names ...string)

Delimiter

The delimiter for the field name prefixes. Can be the empty string.

join.delimiter(value string)

DeleteAll

Delete both sides of the join regardless of which side receives the delete message.

join.deleteAll(value bool)

Fill

Fill the data. The fill option implies the type of join: inner or full outer. Options are:

• none - (default) skip rows where a point is missing, inner join.
• null - fill missing points with null, full outer join.
• Any numerical value - fill fields with given value, full outer join.

When using a numerical or null fill, the fields names are determined by copying the field names from another point. This doesn’t work well when different sources have different field names. Use the DefaultNode and DeleteNode to finalize the fill operation if necessary.

join.fill(value interface{})

Example:

    var maintlock = stream
        |from()
            .measurement('maintlock')
            .groupBy('service')
    var requests = stream
        |from()
            .measurement('requests')
            .groupBy('service')
    // Join the maintlock and requests streams
    // The intent it to drop any points in maintenance mode.
    maintlock
        |join(requests)
            // Provide prefix names for the fields of the data points.
            .as('maintlock', 'requests')
            // points that are within 1 second are considered the same time.
            .tolerance(1s)
            // fill missing fields with null, implies outer join.
            // a better default per field will be set later.
            .fill('null')
            // name the resulting stream.
            .streamName('requests')
        |default()
            // default maintenance mode to false, overwriting the null value if present.
            .field('maintlock.mode', false)
            // default the requests to 0, again overwriting the null value if present.
            .field('requests.value', 0.0)
        // drop any points that are in maintenance mode.
        |where(lambda: "maintlock.mode")
        |...

Handling null fill values in outer joins

When using Kapacitor to perform an outer join, it’s important to set default values for null fields resulting from the join and fill operations. This is done using the DefaultNode, which replaces null values for a specific field key with a specified default value. Not doing so may result in invalid line protocol (as null isn’t an appropriate value for all field types) causing the join to fail.

source1
  |join(source2)
    .as('source1', 'source2')
    .fill('null')
  |default()
    // .field('field-key', default-value)

    // Define a default for an integer field type
    .field('source1.rounded', 0)
    // Define a default for a float field type
    .field('source1.value', 0.0)
    // Define a default for a string field type
    .field('source2.location', '')
    // Define a default for a boolean field type
    .field('source2.maintenance', false)

When using this method, you must know all fields and field types resulting from the join and provide the appropriate default values.

You can also use the DeleteNode to remove unnecessary fields or tags resulting from the join.

source1
  |join(source2)
    .as('source1', 'source2')
    .fill('null')
  |default()
    .field('source1.mode', false)
    .field('source2.value', 0.0)
  |delete()
    .field('source1.anon')
    .tag('host')

On

Join on a subset of the group by dimensions. This is a special case where you want a single point from one parent to join with multiple points from a different parent.

For example given two measurements:

1. building_power (a single value): tagged by building, value is the total power consumed by the building.
2. floor_power (multiple values): tagged by building and floor, values are the total power consumed by each floor.

You want to calculate the percentage of the total building power consumed by each floor. Since you only have one point per building you need it to join multiple times with the points from each floor. By defining the on dimensions as building we are saying that we want points that only have the building tag to be joined with more specific points that more tags, in this case the floor tag. In other words while we have points with tags building and floor we only want to join on the building tag.

Example:

    var building = stream
        |from()
            .measurement('building_power')
            .groupBy('building')
    var floor = stream
        |from()
            .measurement('floor_power')
            .groupBy('building', 'floor')
    building
        |join(floor)
            .as('building', 'floor')
            .on('building')
        |eval(lambda: "floor.value" / "building.value")
            ... // Values here are grouped by 'building' and 'floor'

join.on(dims ...string)

Quiet

Suppress all error logging events from this node.

join.quiet()

StreamName

The name of this new joined data stream. If empty the name of the left parent is used.

join.streamName(value string)

Tolerance

The maximum duration of time that two incoming points can be apart and still be considered to be equal in time. The joined data point’s time will be rounded to the nearest multiple of the tolerance duration.

join.tolerance(value time.Duration)

Chaining Methods

Chaining methods create a new node in the pipeline as a child of the calling node. They do not modify the calling node. Chaining methods are marked using the | operator.

Alert

Create an alert node, which can trigger alerts.

join|alert()

Returns: AlertNode

Barrier

Create a new Barrier node that emits a BarrierMessage periodically.

One BarrierMessage will be emitted every period duration.

join|barrier()

Returns: BarrierNode

Bottom

Select the bottom num points for field and sort by any extra tags or fields.

join|bottom(num int64, field string, fieldsAndTags ...string)

Returns: InfluxQLNode

ChangeDetect

Create a new node that only emits new points if different from the previous point..

join|changeDetect(field string)

Returns: ChangeDetectNode

Combine

Combine this node with itself. The data is combined on timestamp.

join|combine(expressions ...ast.LambdaNode)

Returns: CombineNode

Count

Count the number of points.

join|count(field string)

Returns: InfluxQLNode

CumulativeSum

Compute a cumulative sum of each point that is received. A point is emitted for every point collected.

join|cumulativeSum(field string)

Returns: InfluxQLNode

Deadman

Helper function for creating an alert on low throughput, a.k.a. deadman’s switch.

• Threshold: trigger alert if throughput drops below threshold in points/interval.
• Interval: how often to check the throughput.
• Expressions: optional list of expressions to also evaluate. Useful for time of day alerting.

Example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |deadman(100.0, 10s)
    //Do normal processing of data
    data...

The above is equivalent to this example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |stats(10s)
            .align()
        |derivative('emitted')
            .unit(10s)
            .nonNegative()
        |alert()
            .id('node \'stream0\' in task \'{{ .TaskName }}\'')
            .message('{{ .ID }} is {{ if eq .Level "OK" }}alive{{ else }}dead{{ end }}: {{ index .Fields "emitted" | printf "%0.3f" }} points/10s.')
            .crit(lambda: "emitted" <= 100.0)
    //Do normal processing of data
    data...

The id and message alert properties can be configured globally via the ‘deadman’ configuration section.

Since the AlertNode is the last piece it can be further modified as usual. Example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |deadman(100.0, 10s)
            .slack()
            .channel('#dead_tasks')
    //Do normal processing of data
    data...

You can specify additional lambda expressions to further constrain when the deadman’s switch is triggered. Example:

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    // Only trigger the alert if the time of day is between 8am-5pm.
    data
        |deadman(100.0, 10s, lambda: hour("time") >= 8 AND hour("time") <= 17)
    //Do normal processing of data
    data...

join|deadman(threshold float64, interval time.Duration, expr ...ast.LambdaNode)

Returns: AlertNode

Default

Create a node that can set defaults for missing tags or fields.

join|default()

Returns: DefaultNode

Delete

Create a node that can delete tags or fields.

join|delete()

Returns: DeleteNode

Derivative

Create a new node that computes the derivative of adjacent points.

join|derivative(field string)

Returns: DerivativeNode

Difference

Compute the difference between points independent of elapsed time.

join|difference(field string)

Returns: InfluxQLNode

Distinct

Produce batch of only the distinct points.

join|distinct(field string)

Returns: InfluxQLNode

Ec2Autoscale

Create a node that can trigger autoscale events for a ec2 autoscalegroup.

join|ec2Autoscale()

Returns: Ec2AutoscaleNode

Elapsed

Compute the elapsed time between points.

join|elapsed(field string, unit time.Duration)

Returns: InfluxQLNode

Eval

Create an eval node that will evaluate the given transformation function to each data point. A list of expressions may be provided and will be evaluated in the order they are given. The results are available to later expressions.

join|eval(expressions ...ast.LambdaNode)

Returns: EvalNode

First

Select the first point.

join|first(field string)

Returns: InfluxQLNode

Flatten

Flatten points with similar times into a single point.

join|flatten()

Returns: FlattenNode

GroupBy

Group the data by a set of tags.

Can pass literal * to group by all dimensions. Example:

    |groupBy(*)

join|groupBy(tag ...interface{})

Returns: GroupByNode

HoltWinters

Compute the Holt-Winters (/influxdb/v1/query_language/functions/#holt-winters) forecast of a data set.

join|holtWinters(field string, h int64, m int64, interval time.Duration)

Returns: InfluxQLNode

HoltWintersWithFit

Compute the Holt-Winters (/influxdb/v1/query_language/functions/#holt-winters) forecast of a data set. This method also outputs all the points used to fit the data in addition to the forecasted data.

join|holtWintersWithFit(field string, h int64, m int64, interval time.Duration)

Returns: InfluxQLNode

HttpOut

Create an HTTP output node that caches the most recent data it has received. The cached data is available at the given endpoint. The endpoint is the relative path from the API endpoint of the running task. For example, if the task endpoint is at /kapacitor/v1/tasks/<task_id> and endpoint is top10, then the data can be requested from /kapacitor/v1/tasks/<task_id>/top10.

join|httpOut(endpoint string)

Returns: HTTPOutNode

HttpPost

Creates an HTTP Post node that POSTS received data to the provided HTTP endpoint. HttpPost expects 0 or 1 arguments. If 0 arguments are provided, you must specify an endpoint property method.

join|httpPost(url ...string)

Returns: HTTPPostNode

InfluxDBOut

Create an influxdb output node that will store the incoming data into InfluxDB.

join|influxDBOut()

Returns: InfluxDBOutNode

Join

Join this node with other nodes. The data is joined on timestamp.

join|join(others ...Node)

Returns: JoinNode

K8sAutoscale

Create a node that can trigger autoscale events for a kubernetes cluster.

join|k8sAutoscale()

Returns: K8sAutoscaleNode

KapacitorLoopback

Create an kapacitor loopback node that will send data back into Kapacitor as a stream.

join|kapacitorLoopback()

Returns: KapacitorLoopbackNode

Last

Select the last point.

join|last(field string)

Returns: InfluxQLNode

Log

Create a node that logs all data it receives.

join|log()

Returns: LogNode

Max

Select the maximum point.

join|max(field string)

Returns: InfluxQLNode

Mean

Compute the mean of the data.

join|mean(field string)

Returns: InfluxQLNode

Median

Compute the median of the data.

Note: This method is not a selector. If you want the median point, use .percentile(field, 50.0).

join|median(field string)

Returns: InfluxQLNode

Min

Select the minimum point.

join|min(field string)

Returns: InfluxQLNode

Mode

Compute the mode of the data.

join|mode(field string)

Returns: InfluxQLNode

MovingAverage

Compute a moving average of the last window points. No points are emitted until the window is full.

join|movingAverage(field string, window int64)

Returns: InfluxQLNode

Percentile

Select a point at the given percentile. This is a selector function, no interpolation between points is performed.

join|percentile(field string, percentile float64)

Returns: InfluxQLNode

Sample

Create a new node that samples the incoming points or batches.

One point will be emitted every count or duration specified.

join|sample(rate interface{})

Returns: SampleNode

Shift

Create a new node that shifts the incoming points or batches in time.

join|shift(shift time.Duration)

Returns: ShiftNode

Sideload

Create a node that can load data from external sources.

join|sideload()

Returns: SideloadNode

Spread

Compute the difference between min and max points.

join|spread(field string)

Returns: InfluxQLNode

StateCount

Create a node that tracks number of consecutive points in a given state.

join|stateCount(expression ast.LambdaNode)

Returns: StateCountNode

StateDuration

Create a node that tracks duration in a given state.

join|stateDuration(expression ast.LambdaNode)

Returns: StateDurationNode

Stats

Create a new stream of data that contains the internal statistics of the node. The interval represents how often to emit the statistics based on real time. This means the interval time is independent of the times of the data points the source node is receiving.

join|stats(interval time.Duration)

Returns: StatsNode

Stddev

Compute the standard deviation.

join|stddev(field string)

Returns: InfluxQLNode

Sum

Compute the sum of all values.

join|sum(field string)

Returns: InfluxQLNode

SwarmAutoscale

Create a node that can trigger autoscale events for a Docker swarm cluster.

join|swarmAutoscale()

Returns: SwarmAutoscaleNode

Top

Select the top num points for field and sort by any extra tags or fields.

join|top(num int64, field string, fieldsAndTags ...string)

Returns: InfluxQLNode

Trickle

Create a new node that converts batch data to stream data.

join|trickle()

Returns: TrickleNode

Union

Perform the union of this node and all other given nodes.

join|union(node ...Node)

Returns: UnionNode

Where

Create a new node that filters the data stream by a given expression.

join|where(expression ast.LambdaNode)

Returns: WhereNode

Window

Create a new node that windows the stream by time.

NOTE: Window can only be applied to stream edges.

join|window()

Returns: WindowNode