Add built-in occurrences filter extension

[portertech]

Closes #10

[agoddard]

<3

[cwjohnston]

My understanding is that this is testing an event should not match the filter with refresh of 12, do we need a positive match case for refresh as well?

[fessyfoo]

I'm curious if this filter intended to solve the problems that the sensu-plugins occurrence filter had:

• Exit codes >1 hide RESOLVEs sensu#1067 (comment)
• Need some advice on setting up occurrences. sensu#1092

As it stands now I think it replicates the same issue. I assume that's expected?

If it's not expected, consider this sequence of events:

event.occurrences >check.occurrences event not filtered, handler handles create:

{
  "check": {
    "occurrences": 2,
    "status": 2,
    "history": [ 0, 0, 2, 2, 2]
  },
  "occurrences": 3,
  "action": "create"
}

next the status changes state from crit to warn and event.occurrences is reset to 1. The event is filtered. maybe that's ok.

{
  "check": {
    "occurrences": 2,
    "status": 1,
    "history": [ 0, 2, 2, 2, 1]
  },
  "occurrences": 1,
  "action": "create"
}

next comes the resolution event. status is 0, and has stored event so event.occurrences has not incremented, and it's still below the check.occurrences threshold so it is filtered leading to confusing situation where on call personnel may have received create notification but not resolve notification. That's at least a significant part of the confusion in the above mentioned bugs.

{
  "check": {
    "occurrences": 2,
    "status": 0,
    "history": [ 2, 2, 2, 1, 0]
  },
  "occurrences": 1,
  "action": "resolve"
}

Hope that helps make the subtle issue clear to anyone who didn't see that bit already.

related comment: sensu-plugins/sensu-plugin#134 (comment)

I'm curious why the proposed built in occurrences filter or even regular sensu filters would be in any better position to solve those issues.

[cwjohnston]

I've replied to the above question in sensu-plugins/sensu-plugin#134 (comment)

[fessyfoo]

noting that as of #12 built in extensions have moved out of this repo to individual repos under the sensu-extensions github project.

in particular the occurrences filter has moved to https://github.com/sensu-extensions/sensu-extensions-occurrences and now includes a fix for the filtered resolves issue described above.