Sensu query expressions

Sensu query expressions are based on JavaScript expressions. They provide additional functionality for Sensu usage, like nested parameters and custom functions, so Sensu resources can be directly evaluated. Sensu query expressions should always return true or false.

Syntax quick reference

operator description
=== Identity operator
!== Nonidentity operator
== Equality operator
!= Inequality operator
&& Logical AND
|| Logical OR
< Less than
> Greater than
<= Less than or equal to
>= Greater than or equal to

Sensu query expression specification

Sensu query expressions are valid ECMAScript 5 (JavaScript) expressions that return true or false. Other values are not allowed. If other values are returned, an error is logged and the filter evaluates to false.

Custom functions

  • hour: Returns the hour of a UNIX epoch time. In UTC and 24-hour time notation.
// event.timestamp equals to 1520275913, which is Monday, March 5, 2018 6:51:53 PM UTC
// The following expression returns true
hour(event.timestamp) >= 17
  • weekday: Returns a number that represents the day of the week of a UNIX epoch time. Sunday is 0.
// event.timestamp equals to 1520275913, which is Monday, March 5, 2018 6:51:53 PM UTC
// The following expression returns false
weekday(event.timestamp) == 0

Sensu query expression examples

Evaluate an event attribute

This example returns true if the event’s entity contains a custom attribute named namespace that is equal to production:

event.entity.namespace == 'production'

Evaluate an array

To evaluate an attribute that contains an array of elements, use the .indexOf method. This example returns true if an entity includes the subscription system:

entity.subscriptions.indexOf('system') >= 0

Evaluate the day of the week

The following example returns true if the event occurred on a weekday:

weekday(event.timestamp) >= 1 && weekday(event.timestamp) <= 5

Evaluate office hours

The following example returns true if the event occurred between 9 AM and 5 PM UTC:

hour(event.timestamp) >= 9 && hour(event.timestamp) <= 17