CEL functions and operators

CEL expressions for agent status evaluation support built-in CEL operators and the following function libraries.

Time functions

now()

Returns the current time. Use with last_update to calculate durations or detect stale data.

// True if more than 10 minutes since last heartbeat
now() - last_update > duration('10m')

// True if more than 5 minutes since last heartbeat
now() - last_update > duration('5m')

Math functions

Math functions from the CEL math library are available for numeric calculations.

Commonly used functions

Example

// Warn if either errors or warnings exceed a threshold
math.greatest(log_errors, log_warnings) > 5

String functions

String functions from the CEL strings library are available for string operations. These are useful when checking plugin alias or id fields.

Example

// Check if any input plugin has an alias containing "critical"
inputs.cpu.exists(i, has(i.alias) && i.alias.contains("critical"))

Encoding functions

Encoding functions from the CEL encoder library are available for encoding and decoding values.

Operators

CEL supports standard operators for building expressions.

Comparison operators

Logical operators

Arithmetic operators

Ternary operator

// Conditional expression
log_errors > 10 ? true : false

List operations