measure

Replaces the input with metrics describing the input.

measure [real_time=bool, cumulative=bool]

Description

The measure operator yields metrics for each received batch of events or bytes using the following schema, respectively:

Events Metrics

type tenzir.metrics.events = record{
  timestamp: time,
  schema: string,
  schema_id: string,
  events: uint64,
}

Bytes Metrics

type tenzir.metrics.bytes = record{
  timestamp: time,
  bytes: uint64,
}

real_time = bool (optional)

Whether to emit metrics immediately with every batch, rather than buffering until the upstream operator stalls, i.e., is idle or waiting for further input.

The is especially useful when measure should emit data without latency.

cumulative = bool (optional)

Whether to emit running totals for the events and bytes fields rather than per-batch statistics.

Examples

Get the number of bytes read incrementally for a file:

load_file "input.json"
measure
―――――――――――――――――――――――――――――――――――――――――――――――――――――
{timestamp: 2023-04-28T10:22:10.192322, bytes: 16384}
{timestamp: 2023-04-28T10:22:10.223612, bytes: 16384}
{timestamp: 2023-04-28T10:22:10.297169, bytes: 16384}
{timestamp: 2023-04-28T10:22:10.387172, bytes: 16384}
{timestamp: 2023-04-28T10:22:10.408171, bytes: 8232}

Get the number of events read incrementally from a file:

load_file "eve.json"
read_suricata
measure
――――――――――――――――――――――――――――――――――――――――
{
  timestamp: 2023-04-28T10:26:45.159885,
  events: 65536,
  schema: "suricata.dns",
  schema_id: "d49102998baae44a"
}
{
  timestamp: 2023-04-28T10:26:45.812321,
  events: 412,
  schema: "suricata.dns",
  schema_id: "d49102998baae44a"
}

Get the total number of events in a file, grouped by schema:

load_file "eve.json"
read_suricata
measure
summarize schema, events=sum(events)
―――――――――――――――――――――――――――――――――――――――
{schema: "suricata.dns", events: 65948}