thruk_state_diff
Compare monitoring state between two past points in time by replaying log data. Detect changes in host/service status, with optional filters by hostgroup or custom variable.
Instructions
List what changed between two past instants t1 → t2 (replayed from /logs).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| t1 | No | First instant (required). Thruk relative ("-2h") or absolute ("2026-06-16 15:45:00", UTC). Order is normalised to earlier→later. | |
| t2 | No | Second instant (required, same formats as t1). | |
| filter | No | Structured filter tree supporting AND/OR nesting. Two node types: leaf: {"type":"leaf", "field":"...", "op":"...", "value":...} group: {"type":"group", "operator":"and"|"or", "conditions":[...]} Available fields: custom_var, host, hostgroup, service Operators: eq, gte, in, lte, neq, regex Examples: # Objects in HG_AGILE: {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"} # In HG_AGILE OR with KERNEL=windows: {"type":"group","operator":"or","conditions":[ {"type":"leaf","field":"hostgroup","op":"eq","value":"HG_AGILE"}, {"type":"leaf","field":"custom_var","op":"eq","value":{"var":"KERNEL","val":"windows"}} ]} | |
| backends | No | Comma-separated backend names (sites). Omit for all backends. |