Statsd Parsing Trigger

triggers

#1

Here is a trigger that will parse statsd.

Event: UDP_PAYLOAD
Advanced config: Server port min/max 8125 (assumes default statsd port).

/*

This is a simple, version 1 parser for statsd.

Send a statsd stat like: "matt:123|g" and this will automatically 
convert it into the appropriate extrahop data structure and 
commit it to the data store.

ASSUMPTIONS:

1) The server in question is a proper 'device' on ExtraHop.
2) This server is sending statsd info to a reciever (doesn't matter 
where - we care about the sending server (statsd client) for this exercise).
3) It's over UDP. Can add TCP support if there's a need. 

DETAILS:

For now, we'll support counts, sets, and gauges, which are essentially snapshots
and counts in ExtraHop parlance.

~~~~~~~~~~~ NOTES ~~~~~~~~~~~~~

- Gauge data: for now we'll not support adding or subtracting in
guage data types, e.g. foo:+10|g or foo:-10|g.
We can do this via the session store but I'm not sure how common that fromat is.

- Floating point numbers & zero values. We'll use toFixed() to round the 
  float up or down before committing to the data store. The EH store doesn't support
  floats for now. Zero value metrics will be silently discarded.

- Timers: we'll parse timers, but (for now) without sampling semantics, e.g. 
  matt:440|ms will work but matt:440:ms|@0.1 won't.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/

var payload, 
    stat_array, 
    stat_name,
    stat_type,
    num;

payload = Flow.client.payload.toString();

stat_array = payload.split(":");
stat_name = stat_array[0];
stat_val = stat_array[1].split("|")[0];
stat_type = stat_array[1].split("|")[1];

num = new Number(stat_val);

if (num < 1){ return; } // bail if we're not 1 or more.

switch (stat_type){
    case "s":
    case "c":
        Device.metricAddCount(stat_name, parseInt(num.toFixed()));
        break;
    case "g":
        Device.metricAddSnap(stat_name, parseInt(num.toFixed()));
        break;
    case "ms":
        // a timer, in ms.
        Device.metricAddDataset(stat_name, parseInt(num.toFixed()));
        break;
    default:
        break;
    }

Hope it’s useful!