WhereNode

var sums = stream
  |from()
    .groupBy('service', 'host')
  |sum('value')
//Watch particular host for issues.
sums
  |where(lambda: "host" == 'h001.example.com')
  |alert()
    .crit(lambda: TRUE)
    .email().to('user@example.com')

where.quiet()

where|alert()

where|barrier()

where|bottom(num int64, field string, fieldsAndTags ...string)

where|changeDetect(field string)

where|combine(expressions ...ast.LambdaNode)

where|count(field string)

where|cumulativeSum(field string)

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |deadman(100.0, 10s)
    //Do normal processing of data
    data...

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |stats(10s)
            .align()
        |derivative('emitted')
            .unit(10s)
            .nonNegative()
        |alert()
            .id('node \'stream0\' in task \'{{ .TaskName }}\'')
            .message('{{ .ID }} is {{ if eq .Level "OK" }}alive{{ else }}dead{{ end }}: {{ index .Fields "emitted" | printf "%0.3f" }} points/10s.')
            .crit(lambda: "emitted" <= 100.0)
    //Do normal processing of data
    data...

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    data
        |deadman(100.0, 10s)
            .slack()
            .channel('#dead_tasks')
    //Do normal processing of data
    data...

    var data = stream
        |from()...
    // Trigger critical alert if the throughput drops below 100 points per 10s and checked every 10s.
    // Only trigger the alert if the time of day is between 8am-5pm.
    data
        |deadman(100.0, 10s, lambda: hour("time") >= 8 AND hour("time") <= 17)
    //Do normal processing of data
    data...

where|deadman(threshold float64, interval time.Duration, expr ...ast.LambdaNode)

where|default()

where|delete()

where|derivative(field string)

where|difference(field string)

where|distinct(field string)

where|ec2Autoscale()

where|elapsed(field string, unit time.Duration)

where|eval(expressions ...ast.LambdaNode)

where|first(field string)

where|flatten()

    |groupBy(*)

where|groupBy(tag ...interface{})

where|holtWinters(field string, h int64, m int64, interval time.Duration)

where|holtWintersWithFit(field string, h int64, m int64, interval time.Duration)

where|httpOut(endpoint string)

where|httpPost(url ...string)

where|influxDBOut()

where|join(others ...Node)

where|k8sAutoscale()

where|kapacitorLoopback()

where|last(field string)

where|log()

where|max(field string)

where|mean(field string)

where|median(field string)

where|min(field string)

where|mode(field string)

where|movingAverage(field string, window int64)

where|percentile(field string, percentile float64)

where|sample(rate interface{})

where|shift(shift time.Duration)

where|sideload()

where|spread(field string)

where|stateCount(expression ast.LambdaNode)

where|stateDuration(expression ast.LambdaNode)

where|stats(interval time.Duration)

where|stddev(field string)

where|sum(field string)

where|swarmAutoscale()

where|top(num int64, field string, fieldsAndTags ...string)

where|trickle()

where|union(node ...Node)

where|where(expression ast.LambdaNode)

where|window()