Kapacitor is an open source, MIT-licensed framework written in Go for processing, monitoring, and alerting on time series data, built for operators and platform engineers who store metrics in InfluxDB and need rule-based stream and batch processing on top of them.

What it is

Kapacitor is a daemon plus a command-line client. The README names two binaries: kapacitor, a CLI for calling the Kapacitor API, and kapacitord, the server daemon that does the work. Tasks are written in a domain-specific language called TICKscript, which chains stream or batch operations into pipelines that transform data and fire alerts when conditions are met.

The concrete problem it solves is the alerting and processing layer that a time series database does not provide on its own. InfluxDB stores and queries measurements, and Telegraf collects them, but neither defines threshold logic, windows, or notification routing. Kapacitor fills that gap, replacing hand-rolled cron jobs and ad-hoc query polling with declared tasks. It lives in the InfluxData ecosystem alongside Telegraf, whose plugin data the repository ships example scripts for under examples/telegraf, and InfluxDB, which supplies the databases and retention policies a task reads from.

Key capabilities

• TICKscript DSL for defining tasks, as in a CPU alert that reads stream |from() .measurement('cpu_usage_idle') .groupBy('host'), then applies |window() .period(1m) .every(1m) |mean('value') before evaluating a lambda.
• Threshold alerting with separate warning and critical expressions, shown as .warn(lambda: "used" > 70.0) and .crit(lambda: "used" > 85.0).
• Templated alert messages that interpolate tags and fields, for example '{{ .Level}}: {{ .Name}}/{{ index .Tags "host" }} has high cpu usage: {{ index .Fields "used" }}'.
• Alert handlers for Slack via .slack() .channel('#alerts'), VictorOps via .victorOps() .routingKey('team_rocket'), and PagerDuty via .pagerDuty().
• CLI task lifecycle management, demonstrated with kapacitor define cpu_alert -type stream -dbrp telegraf.default -tick ./cpu_alert.tick followed by kapacitor enable cpu_alert.
• A documented configuration file at etc/kapacitor/kapacitor.conf, plus a generated example produced by running kapacitord config.
• Multiple distribution channels: direct binaries from the downloads page, go get github.com/influxdata/kapacitor/cmd/kapacitor and the matching kapacitord path, and the official Docker Hub image.

Who uses it and how

• Teams already running InfluxDB with Telegraf-collected metrics, defining stream tasks against a telegraf.default database and retention policy over measurements such as cpu_usage_idle.
• Operations and on-call groups that route alerts into Slack channels such as #alerts, per-team VictorOps routing keys, or PagerDuty.
• Container-based deployments that pull the official Docker image and run the daemon beside InfluxDB rather than installing binaries on a host.
• Go developers who build the two commands from source and contribute through the CircleCI-tested repository.

Getting started

Install the binaries from the downloads page or with go get github.com/influxdata/kapacitor/cmd/kapacitor and go get github.com/influxdata/kapacitor/cmd/kapacitord, or run the published Docker image. Start kapacitord, generate a starting configuration with kapacitord config, and then follow the getting started guide to define and enable a first task.

How it compares

The facts provided list no paid products that Kapacitor replaces, so no licence, cost-model, or data-ownership comparison can be made here. Within its own ecosystem it sits next to Telegraf for collection and InfluxDB for storage, both named in the README, and the registry lists no comparable peer tool beside it, so it stands alone in this registry.

When to use it — and when not to

A self-hoster must operate the kapacitord daemon, maintain the kapacitor.conf configuration, keep working connections to InfluxDB databases and retention policies, and hold credentials for whichever alert handlers are enabled, such as Slack, VictorOps, or PagerDuty. Teams that want alerting bundled with a managed monitoring service, or that lack a Go toolchain or container runtime, should look elsewhere. One caveat worth weighing is repository health: 834 open issues against 2,377 stars, with the getting started guide, TICKscript reference, and Docker usage hosted on docs.influxdata.com rather than in the README itself.

go get github.com/influxdata/kapacitor/cmd/kapacitor
go get github.com/influxdata/kapacitor/cmd/kapacitord

kapacitord config

stream
    |from()
        .measurement('cpu_usage_idle')
        .groupBy('host')
    |window()
        .period(1m)
        .every(1m)
    |mean('value')
    |eval(lambda: 100.0 - "mean")
        .as('used')
    |alert()
        .message('{{ .Level}}: {{ .Name }}/{{ index .Tags "host" }} has high cpu usage: {{ index .Fields "used" }}')
        .warn(lambda: "used" > 70.0)
        .crit(lambda: "used" > 85.0)

        // Send alert to hander of choice.

        // Slack
        .slack()
        .channel('#alerts')

        // VictorOps
        .victorOps()
        .routingKey('team_rocket')

        // PagerDuty
        .pagerDuty()

# Define the task (assumes cpu data is in db 'telegraf')
kapacitor define \
    cpu_alert \
    -type stream \
    -dbrp telegraf.default \
    -tick ./cpu_alert.tick
# Start the task
kapacitor enable cpu_alert