On This Page

Home / Stream/ Functions/Rollup Metrics

Rollup Metrics

The Rollup Metrics Function merges frequently generated incoming metrics into more manageable time windows.

Each Worker Process executes this Function independently on its share of events. For details, see Functions and Shared-Nothing Architecture.

Usage
​

Filter: Filter expression (JavaScript) that selects data to feed through the Function. Defaults to true, meaning it evaluates all events.

Description: Optional description of this Function’s purpose in this Pipeline. Defaults to empty.

Final: Toggle on to stop feeding data to the downstream Functions. Default is toggled off.

Dimensions: List of data dimensions across which to perform rollups. Supports wildcards. Defaults to * wildcard, meaning all original dimensions.

Time window: The time span over which to roll up (aggregate) metrics. Must be a valid time string (such as 10s). Must match pattern: \d+[sm]$.

With high-cardinality data, beware of setting long time windows. Doing can cause high memory consumption and/or lost data, because memory is flushed upon restarts and redeployments.

Gauge update: The operation to use when rolling up gauge metrics. Defaults to Last; other options are Maximum, Minimum, or Average.

Examples
​

Scenario A:
​

Assume that you have metrics coming in at a rate that is too high. For example, Cribl Stream’s internal metrics come in at a 2s interval.

To roll up these metrics to 1-minute granularity, you would set up the Rollup Metrics Function with a Time Window value of 60s.

Scenario B:
​

Assume that you have metrics coming up with multiple dimensions – such as host, source, data_center, and application. You want to aggregate these metrics to eliminate some dimensions.

Here, you would configure Rollup Metrics Function with a Time Window value that matches the metrics’ generation – such as 10s. In the Dimensions field, you would remove the default * wildcard, and would specify only the dimensions you want to keep – such as host, data_center.