Usage

​

Filter: Filter expression (JS) that selects data to feed through the Function. Defaults to true, meaning it evaluates all events.

Description: Optional description of this Function’s purpose in this Pipeline. Defaults to empty.

Final: If toggled to Yes, stops feeding data to the downstream Functions. Defaults to No.

Dimensions: List of data dimensions across which to perform rollups. Supports wildcards. Defaults to * wildcard, meaning all original dimensions.

Time window: The time span over which to roll up (aggregate) metrics. Must be a valid time string (e.g., 10s). Must match pattern: \d+[sm]$.

With high-cardinality data, beware of setting long time windows. Doing can cause high memory consumption and/or lost data, because memory is flushed upon restarts and redeployments.

Gauge update: The operation to use when rolling up gauge metrics. Defaults to Last; other options are Maximum, Minimum, or Average.

Examples

​

Scenario A:

​

Assume that you have metrics coming in at a rate that is too high. For example, Cribl Stream’s internal metrics come in at a 2s interval.

To roll up these metrics to 1-minute granularity, you would set up the Rollup Metrics Function with a Time Window value of 60s.

Scenario B:

​

Assume that you have metrics coming up with multiple dimensions – e.g. host, source, data_center, and application. You want to aggregate these metrics to eliminate some dimensions.

Here, you would configure Rollup Metrics Function with a Time Window value that matches the metrics’ generation – e.g., 10s. In the Dimensions field, you would remove the default * wildcard, and would specify only the dimensions you want to keep – e.g.: host, data_center.