Processor: Traffic Monitor

One or more queries on graph specified as strings, or a list of such queries. (String will be deprecated in a future release.) Multiple queries should provide all the named nodes referenced by the expression fields (including additional_properties). Graph query is executed on the "operation" graph. Results of the queries can be accessed using the "query_result" variable with the appropriate index. For example, if querying property set nodes under name "ps", the result will be available as "query_result[0]["ps"]".

In collector processors (*_collector, if_counter) it is used to choose a set of nodes for further processing (for example, all leaf devices, or all interfaces between leaf and spine devices)

In other processors it is used for general parameterization and it is only supported as a list of queries.

graph_query: "node("system", role="leaf", name="system").
              out("hosted_interfaces").
              node("interface", name="iface").out("link").
              node("link", role="spine_leaf")"

graph_query: ["node("system", role="leaf", name="system")",
              "node("system", role="spine", name="system")"]

List (of strings) of node and relationship names used in the graph query to group query results by. Each element in this list represents a named node or relationship matcher in the graph_query field.It is not an expression to be consistent with existing group_by field in grouping processors. Non-expression is simple and more intuitive.

When grouping is active (query_group_by is not null), query results are d by the specified list of names, where one output item is created per each group. In this case, the expressions can only access matcher names specified in query_group_by and the query results for each group are accessed using a new group_items variable. The group_items variable is a list of query results, where each result has named nodes/relationships, not present in query_group_by.

The following list describes the behavior for various values of this field:

• Value of query_group_by field - Semantics
• Omitted or provided as json null (ala None in Python) - No grouping is done. This is equivalent to current behavior of extensible_data_collector. Using ‘group_items’ in this case is not permitted and results in probe error state.
• Empty list ([]) - Produces one group containing all the query results.
• One or more matcher names - The query results are grouped by the specified nodes or relationships. If this list covers all available matchers in the query, the number of groups is equal to the number of query results.