Sensu query expressions
How do Sensu query expressions work?
Sensu query expressions specification
hour: returns the hour, in UTC and in the 24-hour time notation, of a UNIX Epoch time.
// event.timestamp equals to 1520275913, which is Monday, March 5, 2018 6:51:53 PM UTC // The following expression returns true hour(event.timestamp) >= 17
weekday: returns a number representing the day of the week, where Sunday equals
0, of a UNIX Epoch time.
// event.timestamp equals to 1520275913, which is Monday, March 5, 2018 6:51:53 PM UTC // The following expression returns false weekday(event.timestamp) == 0
Sensu query expressions examples
Simple evaluation of an event attribute
The following example returns true if the event’s entity contains a custom
Namespace that is equal to
event.Entity.Namespace == 'production'
Evaluating the day of the week
The following example returns true if the event occurred on a weekday.
weekday(event.timestamp) >= 1 && weekday(event.timestamp) <= 5
Evaluating office hours
The following example returns true if the event occurred between 9 AM and 5 PM UTC.
hour(event.timestamp) >= 9 && hour(event.timestamp) <= 17