Example of Riemann index lookup a la Nagios Herald

riemann.config

(require 'riemann.common)
(require 'clojure.pprint)

(let [host "0.0.0.0"]
  (graphite-server :host host
                   :port 5559)
  (tcp-server      :host host)
  (udp-server      :host host
              :max-size 65000)
  (repl-server     :host host)
  (ws-server       :host host))

; Expire old events from the index every 1 minute
; NB changing this value dramatically alters Riemann's memory requirements
; use :keep-keys to pass tags onto expired events as well
(periodically-expire 60 {:keep-keys [:host :service :tags]})

(defn round
  "Round numbers to 2 decimal places"
  [metric]
  (clojure.pprint/cl-format nil "~,2f" metric)
)

(defn lookup
  "Lookup events in the index"
  [host service]
  (riemann.index/lookup (:index @riemann.config/core) host service)
)

(defn search
  "Search events in the index"
  [host]
  (->> '(= host host)
       (riemann.index/search (:index @riemann.config/core)))
)

(defn print-context
  "Print the event content"
  [events]
  (clojure.string/join "\n"
    (map
      (fn [event]
        (str
          "Service: " (:service event) " with metric: " (round (:metric event))))
    events))
)

(defn format-body
  "Format the email body"
  [events]
  (clojure.string/join "\n\n\n"
        (map
          (fn [event]
            (str
              "Time: " (riemann.common/time-at (:time event)) "\n"
              "Host: " (:host event) "\n"
              "Service: " (:service event) "\n"
              "State: " (:state event) "\n"
              "Metric: " (if (ratio? (:metric event))
                (double (:metric event))
                (round (:metric event))) "\n"
              "\n"
              "Additional context for host: " (:host event) "\n\n"
              (print-context (search (:host event)))
              "\n\n"))
          events)))

(def email (mailer {:from "reimann@example.com"
                    :body (fn [events] (format-body events))
                    }))

(let [index (index)]

  (streams
    (default :ttl 60
      ; Index all events immediately.
      index

      (where (and (service #"^df-(.*)/percent_bytes-used") (<= metric 90.0))
        (email "james@example.com")
      )
)))