Best way to create complex alert logic based on data history. | Archive

Cody_Herzog · 2019-07-03T23:10:26Z

Hello. We're in the process of migrating some complex alerts from Zabbix to LogicMonitor, and I'd like to be sure we're on the right track. Here's an example of some complex alert logic using the builtin Zabbix expressions and operators: ( {-MyTemplate:MyDataItem.last()} >= 10 ) or ( ( {-MyTemplate:MyDataItem.last()} > {-MyTemplate:MyDataItem.prev()} ) and ( {-MyTemplate:MyDataItem.delta(3600)} >= 3 ) and ( {-MyTemplate:MyDataItem.delta(1800,1800)} >= 1 ) and ( {-MyTemplate:MyDataItem.last()} = {-MyTemplate:MyDataItem.max(3600)} ) ) At a high level, this is analyzing various metrics across the recent history of a certain data point. My understanding is that the best way to achieve this in LM is to create a custom scripted data source that uses the REST API to access the raw data for the desired time window, and then have the custom script process the data as desired. Is that correct? If so, what type of scripting is recommended for this? Groovy, PowerShell, or external? Most of the REST API examples I've come across use Python, so is that recommended? If not, are there any examples of using Groovy or PowerShell to access the REST API? Regarding the best API endpoint(s) to use, I suspect it would be one of these:https://www.logicmonitor.com/support/rest-api-developers-guide/v1/data/get-data/ I started playing around with those, and the one thing that's not obvious to me is the best way to deal with the device data source ID. I know that it can be obtained through the following API: https://www.logicmonitor.com/support/rest-api-developers-guide/v1/datasources/get-datasources-associated-with-a-device/ However, I was expecting to be able to pass the device data source ID in to my script as a parameter, or to have it available as a builtin variable within a groovy script, similar to ##system.deviceId##. Is that not possible? If not, then would I have to make two REST API calls in my script. The first one to get the device data source ID, and the second one to get the actual data? I assume there is no dedicated REST API data source collection mechanism which would take care of all the authentication and other boilerplate stuff. Is it correct that there's no way for a scripted data item which uses the REST API to implicitly inherit the authentication context from which the script is being called? Thanks very much.

Discussions

Best way to create complex alert logic based on data history. | Archive | LogicMonitor Community