Suppose we need to count log messages containing "," on hosts of group ",", then count log messages containing "]" on hosts of group "]", and finally calculate the ratio of these two numbers.
On host group "," we have:
- agent item: log.count[/path/to/file,","]
- aggregated item: grpsum[",","log.count[/path/to/file,\",\"]",last]
On host group "]" we have:
- agent item: log.count[/path/to/file,"]"]
- aggregated item: grpsum["]","log.count[/path/to/file,\"]\"]",last]
And we also need a calculated item:
last("grpsum[\",\",\"log.count[/path/to/file,\\",\\"]\",last]") /
last("grpsum[\"]\",\"log.count[/path/to/file,\\"]\\"]\",last]")
Note how quickly expressions get populated with double quotes and backslashes. That's because Zabbix treats any comma as parameter delimiter. To pass a parameter containing "," or "]" one needs to quote whole parameter. And then escape all double quotes with backslashes inside this parameter. Manually...
I think we can do better. There is a precedent when Zabbix processes parameters wisely. For example, no quoting and escaping needed to pass an array of host groups to aggregated item:
grpavg[["Servers A","Servers B","Servers C"],system.cpu.load,last]
This saves 8 characters in quotes and backslashes compared to this syntax:
grpavg["[\"Servers A\",\"Servers B\",\"Servers C\"]",system.cpu.load,last]
I think, Zabbix can be clever enough to treat unquoted item keys as a single parameter:
item.key[parameter_1,valid.item.key[valid,"item",params],parameter_3]
^ ^ ^ ^ ^ ^
| | | | | |
'----1----' '----------------2----------------' '----3----'
If one wants Zabbix to treat this as 5 parameters one can always put some quoting and escaping (but I assume this situation is less frequent):
item.key[parameter_1,"valid.item.key[valid","\"item\"","params]",parameter_3]
With such new feature my example would look like so.
On host group "," we have:
- agent item: log.count[/path/to/file,","]
- aggregated item: grpsum[",",log.count[/path/to/file,","],last]
On host group "]" we have:
- agent item: log.count[/path/to/file,"]"]
- aggregated item: grpsum["]",log.count[/path/to/file,"]"],last]
And we also need a calculated item:
last(grpsum[",",log.count[/path/to/file,","],last]) / last(grpsum["]",log.count[/path/to/file,"]"],last])
Note that I simply copy-pasted item keys and we saved 24
characters in redundant quotes and backslashes in calculated item formula.
P.S. Same approach is applicable to context-based user macros with undesirable characters in the context used in item key and trigger function parameters. Currently one needs to write them like dummy.echo["{$MACRO:\",}\"}"]. Simplified dummy.echo[{$MACRO:",}"}] notation would save 4 characters. To force parameter separation one would need to add two extra characters dummy.echo["{$MACRO:\",}\"}"]. Assuming the former meaning is at least twice as frequent as the latter we will be using less characters with new syntax.