ESPER: How to use EPL statement to detect 2 or more sequential events? - esper

I am so new to this technology and I need to be able to detect events happening in exact sequential order. For example:
a -> b -> c to output an event based on these events
a -> b -> d -> …-> c will not output an event based on these events since a, b, and c event are not in sequential order.
Is that possible with ESPER EPL statement.
Thanks for you help

I think there are two options
Reorder the stream waiting for late-arriving events. Esper can do this for you with time_order.
Use a EPL join instead; in a join the events can arrive in any order

Related

Esper query for A followed by B immediately without any other events in between (no matter which event)

I have to implement the rule, that if A occurs, B hast to occur next without any event in between. Usually I could do this by just using the patter:
A->(B and not ...)
But I have to implement it very dynamical. That means that I don't know all of the possible events in advance. Does anybody know how i could implement this?
I guess I need something like:
A->(B and not any other event)
Thank you for your help. :)
See this other ticket Esper statement to check, if A is followed by B without any other As in between
It explains the match-recognize.
Here are a few path you can go down in respect to many types of events.
Create-schema with inherits plus typeof-function
create schema Parent();
create schema A() inherits Parent;
create schema B() inherits Parent;
// now you can treat all events as Parent events
select * from pattern[p=Parent(typeof(p)='A') -> ...] // or match-recognize
Variant stream
create variant schema AnyEventStream as *; // this stream can hold any type of event
insert into AnyEventStream select * from A;
insert into AnyEventStream select * from B;
select * from pattern[p=AnyEventStream(typeof(p)='A') -> ...] // or match-recognize
Normalize with insert-into
insert into CombinedStream select 'a' as type from A;
insert into CombinedStream select 'b' as type from B;
// now match on CombinedStream
select * from pattern[p=CombinedStream(type='A') -> ...] // or match-recognize
Make each event a column
create schema CombinedStream(col java.lang.Object);
insert into CombinedStream select a as col from A as a;
insert into CombinedStream select b as col from B as b;
select * from pattern[p=CombinedStream(typeof(col)='...') -> ...] // or match-recognize
You can probably combine some of these approaches. You can also use Java interfaces and abstract classes in replacement of "inherits" since the type system recognizes superclasses/interfaces.
Thank you very for your reply. I tried your suggestions and making each event a column seams to work pretty well for me.
My only problem is, that i have to get access to the properties of each event to check some conditions.
For example:
select * from CombinedStream.win:length(1) where typeof(col)='MachineFailureEvent' and id=1;
Until the id-check everything works fine, but the compiler tells me, that the property id is not valid in this stream.. do you have in idea?
Tanke you :)

Count how many times esper receives different inherit events.

I'm new using Esper and I have been able to manage with it until now. There is something that I can't find solution and I have tried to find everywhere with no success.
I have three Classes extending one to other one.
Using Esper Online:
create schema A(symbol string, price double);
create schema B() inherits A;
create schema C() inherits B;
Now I want to count how many of each events in a time window of 2 seconds I have received, using the next EPL statement:
select COALESCE(a.symbol,b.symbol,c.symbol) as symbol, count(a) as total_a, count(b) as total_b, count(c) as total_c from pattern [every a=A or every b=B or every c=C]#time(2 seconds) group by COALESCE(a.symbol,b.symbol,c.symbol);
And I run the next events:
A={symbol='X', price=1}
B={symbol='X', price=1}
C={symbol='X', price=1}
C={symbol='X', price=1}
The problem is when I send a B event, it counts a B event and an A event due to inheritance , and obviously if I send a C event it counts a C a B and also an A event.
I have used the pattern-level annotation #SuppressOverlappingMatches it works with inheritances, but Time Windows doesn't work with it.
Try this.
select count(*, typeof(a)='A') as cnt_a, count(*, typeof(a)='B') as cnt_b,
count(*, typeof(a)='C') as cnt_c from A#time(2 sec) as a

How to fire pattern on partial match in Esper CEP

I'm trying to solve route-violation problem. User defines a route as series of location sequences (in exact order) that some item needs to be seen on. So lets say that correct route is (this is defined by user)
A -> B -> C
I'm trying to write Esper EPL which will fire on all route violations. A is a starting point, which needs to start a pattern (a valid location).
A -> !B -> !C
This will fire when there are all 3 types of events found in ESPER.
But what I want is also to fire when there is only partial combination like
A -> !B
or
!B -> !C
or
B -> !C
because if route is missed on B then I'll probably never come to C and will not be notified of route violation.
Is this even possible with patterns in Esper?
I can see a few options.
Register a separate statement with a pattern or match-recognize for each
Connect each with "or" i.e. "every (..) or every (..) or every (..)
Insert the result of a partial match into a stream for another pattern to continue matching
I think match-recognize has some resumption options around "skip"

Esper: find earliest event within time after a trigger event arrives

My event stream generally contains an open event followed by a close event. Let's call them O and C, correspndingly. However, there are two particulars:
O may be followed by one or more O before C arrives
C may be missing completely (see below)
It is assumed that C should arrive not later than within time T after some O. Otherwise, C is considered missing. When a C eventually arrives, all open Os arrived earlier than T from this C are considered orphans and are of no interest.
I want esper to fire each pair of O followed by C, where earliest O not farther then T from C is selected. Any Os in between as well as before selected O are skipped.
For example,
O1 O2 O3 ... C
should select (O1,C) if datediff(O1, C) < T
should select (O2,C) if above is false and datediff(O2, C) < T
etc.
A lost my temper in approaching this problem. Looks like my mind is not compatible with esper. Your help is very appritiated.
This could be something like below, the idea is that when Event arrives we want to look at the last 1 minute of events and find the first one that matches the time diff. Have a second statement filter out those without matches, if that is desired.
insert into Pair
select , (select window().firstOf(v => v.time - e2.time < T) from Event.win:time(1 min) as e1) as matched
from Event as e2
select * from Pair where matched is not null

Esper EPL leftouter join forwarding to other stream

I have implemented ESPER for my application need of CEP. While using EPL I encountered a specific scenario which is as follows:
I have combined two events with left outer join to make sure each event from first can trigger the statement and only those from second stream which contains specific property can come along. I have created a view to store unique data based on some fields. My EPLs are
#Name ('StmtCombinedEvent')
Insert into CombinedEvent
Select S as T1,
L as T2,
From pattern[every S= bussinessObject.Type1].std:unique(S.Id) as S
left outer join
bussinessObject.Type2.std:unique(name) as L
on S.name = L.name;
#Name ('StmtGroupingEvent')
Insert into Position
Select
G.T1 as T1
G.T2 as T2
From CombinedEvent.std:unique(T1.Id) as G;
I am using java.util.Map type for CombinedEvent dataType in configuration file
Now consider test scenario
Two events of type T1 having different Id but having same name has been entered into system
One event of type T2 is entered into system
Because of the view specification both event of type T1 resides into view and when event of type T2 enters into system, NewData parameter of type Event Bean contains both event of T1 (if I was using event listener in code), but as first EPL statement specifies it to insert into second statement it finds an error of mismatched type, as it was expecting event of type T2 for 'StmtGroupingEvent' but found Event Bean instead.
So I need to handle array type of data in EPL which would be cumbersome.
On the other hand if scenario is as follows:
Only one event of type T1 is entered into system.
One event of type T2 is entered into system.
This scenario doesn’t produce any error as Event Bean was successfully type casted to type T2.
So please suggest me any alternate way of doing this.
Thanks
What does "it finds an error of mismatched type" mean? If there was an exception logged please post it and post a small test class alongside to reproduce. Also make sure you are using the latest version of Esper, if there is a bug it has likely been fixed in a newer version.
Also, use "from bussinessObject.Type1.std:unique(S.Id)" instead of
pattern[every S= bussinessObject.Type1].std:unique(S.Id)", since the latter is a straight every it is the same.

Resources