provide streams like runs but on duration

[mcorbin]

I think it may be useful to have streams like (runs) but on duration instead of moving-event-window.

For example, i want to be alerted if :metric is > to a threshold (600 for example) during 5 minutes. It would be nice to have :

(above 600 300 children)

If an event arrives at time 0 with :metric = 700, and a second event arrives at time 301 with :metric = 750, above passes on the last event.

Another example with a test case :

(test-stream (above 10 5) [{:time 0
                            :metric 2}  ;; metric < 10
                           {:time 6
                            :metric 11} ;; metric > 10, valid event
                           {:time 12 ;; metric > 10, 12 - 6 > 5 => send to children
                            :metric 11}] [{:time 12
                                           :metric 11}])

More generally, we could have a stream called cond-dt taking a function of events, a duration, and children, and use it to creates for example the above stream :

(defn above
  [threshold dt & children]
  (apply cond-dt (fn [event] (> (:metric event) threshold)) dt children))

I am working on it actually (i will do a PR tomorrow), do you think it can be useful to integrate it into Riemann ?

[mcorbin]

cf #789 and https://github.com/mcorbin/riemann-cond-dt-plugin ;)