Event correlation question

[peter.kroepfl]

Hi everybody,

I am trying to detect if one event with a special uid did not follow another event with the same id within 3 seconds like this:

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
->
(timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK", print.udfs.udf[0].value=sendmail.udfs.udf[0].value))]


Strangely if I use a static value to do the correlation, the statement seems to work fine:

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK", sendmail.udfs.udf[0].value="zettner_d"))]

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK", print.udfs.udf[0].value="zettner_d"))]


Thanks in advance,
Peter Kroepfl

[Hank Kniight]

I'm not sure whether it's the problem or not...but I would write
print=XMLEvent(code="PrintingOK", udfs.udf[0].value=sendmail.udfs.udf[0].value))
instead of
print=XMLEvent(code="PrintingOK", print.udfs.udf[0].value=sendmail.udfs.udf[0].value))
I'm not sure whether within the "print" event you can already use the "print" variable (and anyway, it's useless).

Cheers,
  Hank

[peter.kroepfl]

Thanks, for the reply,
Unfortunately it makes no difference.

Best regards,
Peter

Hank Kniight wrote:

I'm not sure whether it's the problem or not...but I would write
print=XMLEvent(code="PrintingOK",
udfs.udf[0].value=sendmail.udfs.udf[0].value))
instead of
print=XMLEvent(code="PrintingOK", *print.*
udfs.udf[0].value=sendmail.udfs.udf[0].value))
I'm not sure whether within the "print" event you can already use the
"print" variable (and anyway, it's useless).

Cheers,
  Hank

[Thomas Bernhardt]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Hi Peter,

can you please describe the problem? Does the statement not compile? Does the value not get returned?

Best regards,
Tom

---

From: peter.kroepfl <peter.kroepfl@...>
To: user@...
Sent: Friday, September 4, 2009 5:32:25 AM
Subject: [esper-user] Event correlation question


Hi everybody,

I am trying to detect if one event with a special uid did not follow another
event with the same id within 3 seconds like this:

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
->
(timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
print.udfs.udf[0].value=sendmail.udfs.udf[0].value))]


Strangely if I use a static value to do the correlation, the statement seems
to work fine:

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
sendmail.udfs.udf[0].value="zettner_d"))]

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
print.udfs.udf[0].value="zettner_d"))]


Thanks in advance,
Peter Kroepfl
--
View this message in context: http://www.nabble.com/Event-correlation-question-tp25291216p25291216.html
Sent from the Esper User list mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email

[peter.kroepfl]

Hi Bernhardt,

All three statements do compile without any problems.

I send the first event (SendingMailOK) and a second later I send another event (PrintingOK).
Event1:
<Event xmlns="http://www.company.com/bla">
    <context>
        <deployedComponentCode>EmployeeDataService</deployedComponentCode>
        <deploymentLocation>ERP</deploymentLocation>
    </context>
    <code>AddNewEmployeeOK</code>
    <dateOfOccurrence>${__time(yyyy-MM-dd'T'HH:mm:ss.S)}+02:00</dateOfOccurrence>
    <level>INFO</level>
    <machineOfOrigin>ERP-node1</machineOfOrigin>
    <message>Add new employee Daniela Zettner, userID: zettner_d to ERP.</message>
    <udfs>
        <udf>
            <key>userID</key>
            <value>zettner_d</value>
            <type>string</type>
        </udf>
    </udfs>
</Event>

Event 2:
<Event xmlns="http://www.company.com/bla">
    <context>
        <deployedComponentCode>IdCardPrinter</deployedComponentCode>
        <deploymentLocation>IDPrinter in HR</deploymentLocation>
    </context>
    <code>PrintingOK</code>
    <dateOfOccurrence>${__time(yyyy-MM-dd'T'HH:mm:ss.S)}+02:00</dateOfOccurrence>
    <level>INFO</level>
    <machineOfOrigin>HP-50x2</machineOfOrigin>
    <message>Printing OK. IDCard for: zettner_d</message>
    <udfs>
        <udf>
            <key>userID</key>
            <value>zettner_d</value>
            <type>string</type>
        </udf>
    </udfs>
</Event>


Statement 1
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
sendmail.udfs.udf[0].value="zettner_d"))]

Statement 2
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
print.udfs.udf[0].value="zettner_d"))]

Statement 3
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
        -> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK", udfs.udf[0].value=sendmail.udfs.udf[0].value))]


PROBLEM:
Statement 1 and 2 work as expected and do not return anything, however Statement 3 detects an Event.

Thanks for you help.

Best Regards,
Peter

Thomas Bernhardt wrote:

Hi Peter,

can you please describe the problem? Does the statement not compile? Does the value not get returned?

Best regards,
Tom


________________________________
From: peter.kroepfl <[e-mail]>
To: [e-mail]
Sent: Friday, September 4, 2009 5:32:25 AM
Subject: [esper-user] Event correlation question


Hi everybody,

I am trying to detect if one event with a special uid did not follow another
event with the same id within 3 seconds like this:

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
->
(timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
print.udfs.udf[0].value=sendmail.udfs.udf[0].value))]


Strangely if I use a static value to do the correlation, the statement seems
to work fine:

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
sendmail.udfs.udf[0].value="zettner_d"))]

select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
print.udfs.udf[0].value="zettner_d"))]


Thanks in advance,
Peter Kroepfl
--
View this message in context: http://www.nabble.com/Event-correlation-question-tp25291216p25291216.html
Sent from the Esper User list mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email


     

[peter.kroepfl]

Sorry, 'bout the repost, but I copy/pasted the wrong event.
Here ist the correct definition.


I send the first event (SendingMailOK) and a second later I send another event (PrintingOK).
Event1:
<Event xmlns="http://www.mercatis.com/lighthouse3">
    <context>
        <deployedComponentCode>Mail Service</deployedComponentCode>
        <deploymentLocation>MailServer</deploymentLocation>
    </context>
    <code>SendingMailOK</code>
    <dateOfOccurrence>${__time(yyyy-MM-dd'T'HH:mm:ss.S)}+02:00</dateOfOccurrence>
    <level>INFO</level>
    <machineOfOrigin>ExchangeServer1</machineOfOrigin>
    <message>Sending Mail OK</message>
    <udfs>
        <udf>
            <key>receipient</key>
            <value>zettner_d</value>
            <type>string</type>
        </udf>
        <udf>
            <key>subject</key>
            <value>Welcome to MyCorp. Daniela Zettner</value>
            <type>string</type>
        </udf>
    </udfs>
</Event>

Event 2:
<Event xmlns="http://www.company.com/bla">
    <context>
        <deployedComponentCode>IdCardPrinter</deployedComponentCode>
        <deploymentLocation>IDPrinter in HR</deploymentLocation>
    </context>
    <code>PrintingOK</code>
    <dateOfOccurrence>${__time(yyyy-MM-dd'T'HH:mm:ss.S)}+02:00</dateOfOccurrence>
    <level>INFO</level>
    <machineOfOrigin>HP-50x2</machineOfOrigin>
    <message>Printing OK. IDCard for: zettner_d</message>
    <udfs>
        <udf>
            <key>userID</key>
            <value>zettner_d</value>
            <type>string</type>
        </udf>
    </udfs>
</Event>


All three statements compile without any problems:

Statement 1
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
sendmail.udfs.udf[0].value="zettner_d"))]

Statement 2
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
print.udfs.udf[0].value="zettner_d"))]

Statement 3
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
        -> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK", udfs.udf[0].value=sendmail.udfs.udf[0].value))]



PROBLEM:
Statement 1 and 2 work as expected and do not return anything, however Statement 3 detects an Event.

Thanks for you help.

Best Regards,
Peter

[Thomas Bernhardt]

Some parts of this message have been removed. Learn more about Nabble's security policy.

Hi Peter,
please confirm the problem with version 3.2, as the last version has a related JIRA fixed
Best regards,
Tom

---

From: peter.kroepfl <peter.kroepfl@...>
To: user@...
Sent: Friday, September 4, 2009 10:17:31 AM
Subject: Re: [esper-user] Event correlation question


Sorry, 'bout the repost, but I copy/pasted the wrong event.
Here ist the correct definition.


I send the first event (SendingMailOK) and a second later I send another
event (PrintingOK).
Event1:

    <context>
        <deployedComponentCode>Mail Service</deployedComponentCode>
        <deploymentLocation>MailServer</deploymentLocation>
    </context>
    <code>SendingMailOK</code>
 
<dateOfOccurrence>${__time(yyyy-MM-dd'T'HH:mm:ss.S)}+02:00</dateOfOccurrence>
    <level>INFO</level>
    <machineOfOrigin>ExchangeServer1</machineOfOrigin>
    <message>Sending Mail OK</message>
    <udfs>
        <udf>
            <key>receipient</key>
            <value>zettner_d</value>
            <type>string</type>
        </udf>
        <udf>
            <key>subject</key>
            <value>Welcome to MyCorp. Daniela Zettner</value>
            <type>string</type>
        </udf>
    </udfs>
</Event>

Event 2:

    <context>
        <deployedComponentCode>IdCardPrinter</deployedComponentCode>
        <deploymentLocation>IDPrinter in HR</deploymentLocation>
    </context>
    <code>PrintingOK</code>
 
<dateOfOccurrence>${__time(yyyy-MM-dd'T'HH:mm:ss.S)}+02:00</dateOfOccurrence>
    <level>INFO</level>
    <machineOfOrigin>HP-50x2</machineOfOrigin>
    <message>Printing OK. IDCard for: zettner_d</message>
    <udfs>
        <udf>
            <key>userID</key>
            <value>zettner_d</value>
            <type>string</type>
        </udf>
    </udfs>
</Event>


All three statements compile without any problems:

Statement 1
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
sendmail.udfs.udf[0].value="zettner_d"))]

Statement 2
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
-> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
print.udfs.udf[0].value="zettner_d"))]

Statement 3
select * from pattern [every sendmail=XMLEvent(code="SendingMailOK")
        -> (timer:interval(3 sec) and not print=XMLEvent(code="PrintingOK",
udfs.udf[0].value=sendmail.udfs.udf[0].value))]



PROBLEM:
Statement 1 and 2 work as expected and do not return anything, however
Statement 3 detects an Event.

Thanks for you help.

Best Regards,
Peter
--
View this message in context: http://www.nabble.com/Event-correlation-question-tp25291216p25295201.html
Sent from the Esper User list mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email