Zabbix 5.4 has introduced a new unified syntax for trigger expressions and calculated items (including aggregate calculations). Discover what has changed and why the new syntax is better.
Trigger expressions in Zabbix are used to define problem thresholds. An example of the old syntax:
{<host>:<key>.<function>(<parameter>)}<operator><constant>
Since Zabbix 5.4 the syntax of the trigger formula has changed to:
function(/host/key,parameter)<operator><constant>
This is how an expression to analyze minimum received traffic value over the last five minutes and alert if the value is over 100K would look like now:
min(/Zabbix server/net.if.in[eth0,bytes],5m)>100K
The changes don’t stop at just the syntax. Main improvements which provide additional flexibility include:
- A unified syntax for all expressions – trigger expressions, calculations and aggregations
- 62 new functions for triggers and calculated items, including kurtosis, pi, truncate, cos, and many others
- Functions are now grouped and easier to select
- One item type for all calculations and aggregations – Calculated items
- Aggregate functions now support complex scenarios for filtering items
- Other expressions can now be used as function parameters
Check out the video below to get familiar with this new functionality:
Let’s create an item to track the average CPU load only on specific hosts.
- Open the item configuration form
- Change the Item type to Calculated
- Enter an Item name and key
- In the Formula field enter the expression for aggregate calculation
- avg function calculates the average value for an array of values returned by the 2nd function.
- last_foreach function is used as a parameter for avg function; returns an array of the last received values from the matching items
- Item filter uses the following format: /host/item key?[optional additional filters)].
- * symbol is used instead of a host name, which will match any host, that has a system.cpu.load item and matches the filtering criteria
- Fill the remaining item parameters and save the configuration
Tips and best practices:
- If you change the item key of a referenced item, you have to manually update any formulas using that key
- In Calculated items, User macros in the formula will be expanded only if used to reference a function parameter or a constant
- If you need to reference data from a specific period in the past, use the time shift parameter.
- not, and, and or expression operators are case-sensitive and must be in lowercase. They also must be surrounded by spaces or parentheses
- If the aggregate results in a float value and the aggregated item type of information is Numeric (unsigned), the result will be trimmed to an integer
