Sudden Increase in Source Volume

// Receives the current event, metadata and an accumulator object. Logic can be performed

// on the event properties and added to the accumulator object for later analysis.

// The accumulator is persisted, and will become the emitted event when

// conditions are true, OR if the time window naturally expires. Those same conditions

// will also be evaluated against the emitted event to determine if the alert should

// be triggered.

​

function alertAggregation(accum, event, metadata) {

  let new_accum = accum

  if (!new_accum.message.log_volume) {

    const accum_str = JSON.stringify(accum)

    const accum_length = accum_str.length

    new_accum = {message: {log_volume: accum_length}}

  }

  const event_str = JSON.stringify(event)

  const event_length = event_str.length

  new_accum.message.log_volume = new_accum.message.log_volume + event_length

  return new_accum

}