cancel
Showing results for 
Search instead for 
Did you mean: 

question on the ON clause of ESP pattern

0 Kudos

Dear Colleague,

I want to define a pattern, which says, in the same session, if a customer did event1, but afterwards not event2 and not event3, then I want to raise alert.

CREATE INPUT STREAM rawStream SCHEMA (

  eventType   string,

  sessionId   string,

  userId string,

  productId   string

);

/**@SIMPLEQUERY=FILTER*/

CREATE OUTPUT STREAM event1 AS

  SELECT A.sessionId ,

  A.userId ,

  A.productId

  FROM rawStream A

  WHERE

  A.eventType = '1' ;

  /**@SIMPLEQUERY=FILTER*/

CREATE OUTPUT STREAM event2 AS

  SELECT A.sessionId ,

  A.userId ,

  A.productId

  FROM rawStream A

  WHERE

  A.eventType = '2' ;

/**@SIMPLEQUERY=FILTER*/

CREATE OUTPUT STREAM event3 AS

  SELECT A.sessionId ,

  A.userId ,

  A.productId

  FROM rawStream A

  WHERE

  A.eventType = '3' ;

/**@SIMPLEQUERY=PATTERN*/

CREATE OUTPUT STREAM alerts AS

SELECT  event1.sessionId sessionId ,

               event1.userId userId

FROM event1 event1,

           event2 event2 ,

           event3 event3

MATCHING [ 30 SECONDS : event1 , !event2 , !event3 ]

ON event1.sessionId = event2.sessionId

AND event1.sessionId = event3.session

;

This leads to compiler error: event1.sessionId has been specified multiple times in the ON clause of alerts.

Did I do it wrong? How shall I express 'in the same session' in this case?

another question is: can I leave out the INTERVAL?

Thanks and regards,

Tao

Accepted Solutions (1)

Accepted Solutions (1)

JWootton
Advisor
Advisor
0 Kudos

Change your ON clause to this:

ON event1.sessionId = event2.sessionId = event3.sessionId;

But you can also further simplify the whole model.  You can eliminate the 3 separate filter streams and just do this:

CREATE OUTPUT STREAM alerts

AS SELECT

        E1.sessionId sessionId ,

        E1.userId userId

FROM rawStream E1, rawStream E2, rawStream E3

MATCHING [ 30 SECONDS : E1 , !E2 , !E3 ]

ON E1.eventType =  '1' AND E2.eventType = '2' AND E3.eventType = '3';

And no, you can't eliminate the interval.

0 Kudos

Thanks.

Tao

Answers (0)