Currently trigger functions are bound to one host:item but aggregated items are slow, provide very restricted set of group and item functions and can be used only one at a time. Situation can be improved by introducing a few new concepts.

Group based trigger functions

In addition to existing host:item.func(params) (in triggers), func(host:item,params) and func(item,params) (in calculated items) syntax trigger functions should support host arrays and host group arrays like aggregated items:

{[host_1,host_2,host_3]:item.func(params)}
{group::item.func(params)}
{[group_1,group_2,group_3]::item.func(params)}

func([host_1,host_2,host_3]:item,params)
func(group::item,params)
func([group_1,group_2,group_3]::item,params)

When used with array of hosts, host group or array of groups function will produce arrays of values, each value being function result for a single host:item. Then such arrays can be converted to a single value using...

Standalone trigger functions

These should include functions for converting arrays of values into single value in different ways. Suggested functions and syntax:

Standalone functions can also implement advanced mathematical functions like exp(), log(), sin(), cos(), sqrt(), etc. (Requested in ZBXNEXT-552.) Functions like timeofday(), dayofweek() and dayofmonth() can be made standalone too.

Under the hood standalone functions are basically unary operators with right-to-left associativity (like not and unary minus) acting on arrays of values. Arrays are composed of individual values using "append value" operator ; with left-to-right associativity.

Example

With new functionality it will be possible to substitute aggregated item like

grpavg["MySQL Servers",mysql.qps,avg,5m]

with a calculated item

arr_avg(avg(MySQL Servers::mysql.qps,5m))

or use it directly in a trigger

arr_avg({MySQL Servers::mysql.qps.avg(5m)})

Such aggregation will use value cache and offer more flexibility in the form of all additional parameters supported by conventional trigger functions. Here is an example of a trigger firing when amount of error messages on Web and SQL servers exceeds 100 for the past hour:

arr_sum({[Web Servers,SQL Servers]::log[/path/to/file,error].count(1h)})>100

Equivalent calculated item to demonstrate "functional" syntax:

arr_sum(count("[Web Servers,SQL Servers]::log[/path/to/file,error]",1h))>100

Probably, such array based technique can be applied to the aggregation of items created from item prototypes (ZBXNEXT-1420):

arr_sum({host:net.if.in[{#IFNAME}].avg(1h)})>{$LIMIT}

Equivalent calculated item to demonstrate "functional" syntax:

arr_sum(avg(host:net.if.in[{#IFNAME}],1h))>{$LIMIT}