mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 07:38:19 +00:00
69b7ce12d2
- Removed default logging. Now a function is available for the new $period_finished filter field to get the same behavior for logging named Metrics::write_log. - Added index rollups for getting multiple metrics result values as the same time.
44 lines
1.9 KiB
Text
44 lines
1.9 KiB
Text
# @TEST-EXEC: bro %INPUT
|
|
# @TEST-EXEC: btest-diff .stdout
|
|
|
|
|
|
redef enum Notice::Type += {
|
|
Test_Notice,
|
|
};
|
|
|
|
event bro_init() &priority=5
|
|
{
|
|
Metrics::add_filter("test.metric",
|
|
[$name="foobar",
|
|
$every=3secs,
|
|
$measure=set(Metrics::SUM),
|
|
$threshold=5,
|
|
$threshold_crossed(index: Metrics::Index, val: Metrics::ResultVal) = {
|
|
print fmt("THRESHOLD: hit a threshold value at %.0f for %s", val$sum, Metrics::index2str(index));
|
|
}]);
|
|
|
|
Metrics::add_filter("test.metric",
|
|
[$name="foobar2",
|
|
$every=3secs,
|
|
$measure=set(Metrics::SUM),
|
|
$threshold_series=vector(3,6,800),
|
|
$threshold_crossed(index: Metrics::Index, val: Metrics::ResultVal) = {
|
|
print fmt("THRESHOLD_SERIES: hit a threshold series value at %.0f for %s", val$sum, Metrics::index2str(index));
|
|
}]);
|
|
Metrics::add_filter("test.metric",
|
|
[$every=3secs,
|
|
$measure=set(Metrics::SUM),
|
|
$threshold_func(index: Metrics::Index, val: Metrics::ResultVal) = {
|
|
# This causes any data added to be cross the threshold.
|
|
return T;
|
|
},
|
|
$threshold_crossed(index: Metrics::Index, val: Metrics::ResultVal) = {
|
|
print fmt("THRESHOLD_FUNC: hit a threshold function value at %.0f for %s", val$sum, Metrics::index2str(index));
|
|
}]);
|
|
|
|
Metrics::add_data("test.metric", [$host=1.2.3.4], [$num=3]);
|
|
Metrics::add_data("test.metric", [$host=6.5.4.3], [$num=2]);
|
|
Metrics::add_data("test.metric", [$host=7.2.1.5], [$num=1]);
|
|
Metrics::add_data("test.metric", [$host=1.2.3.4], [$num=3]);
|
|
Metrics::add_data("test.metric", [$host=7.2.1.5], [$num=1000]);
|
|
}
|