Help Required -Rule syntax.

[MathewsMax]

Hi I am trying to crate a rule which will fire an alert once 3+ events for a single host is detected within 4hr span. Instead It keeps firing every 3^rd event from the host.  I am trying the below syntax.

@RSAAlert (oneInSeconds=0, identifiers={"alias_host"})

SELECT * FROM

Event(

   (

     medium = 32

     AND

     device_type='entercept'

     AND

     alias_host IS NOT NULL

   )

).win:time(14400 sec)

match_recognize(

partition by alias_host

measures A as a

pattern (A A A A+)

define

A as A.alias_host IS NOT NULL

);

Can I please get the proper syntax or some suggestions to get it done?  Thanks in advance.

[DavidWaugh1]

Hello

I'd try your rule out on the Epser Try Out page here:

EsperTech Esper EPL Online

In the EPL Box enter the following:

create schema Event(medium int,device_type string,alias_host string);

@Name('Out') select * from Event;

@Name('MyAlert' )SELECT * FROM

Event(

  (

    medium = 32

    AND

    device_type='entercept'

    AND

    alias_host IS NOT NULL

  )

).win:time(14400 sec)

match_recognize(

partition by alias_host

measures A as a

pattern (A A A A+)

define

A as A.alias_host IS NOT NULL

);

In the Enter Sequence of Events, enter:

Event={medium=32,device_type='entercept',alias_host='a'}

t=t.plus(5 seconds)

Event={medium=32,device_type='entercept',alias_host='a'}

t=t.plus(5 seconds)

Event={medium=32,device_type='entercept',alias_host='a'}

t=t.plus(5 seconds)

Event={medium=32,device_type='entercept',alias_host='a'}

t=t.plus(5 seconds)

Event={medium=32,device_type='entercept',alias_host='a'}

t=t.plus(5 seconds)

I tried this and your syntax looks correct in that the alert will fire on the fourth alert:

At: 2001-01-01 08:00:20.000

• Insert
  • MyAlert-output={a=[{device_type='entercept',alias_host='a',medium=32},{device_type='entercept',alias_host='a',medium=32},{device_type='entercept',alias_host='a',medium=32},{device_type='entercept',alias_host='a',medium=32}]}

For me your alert will fire every four events.

When do you not want the alert to fire - eg is this only after 4 matches and then it should remain quiet for a period of time?

[DavidWaugh1 · Accepted solution]

I had a look at

Chapter 8. EPL Reference: Match Recognize

And there is an interval option

8.8. Interval

With the optional interval keyword and time period you can control how long the engine should wait for further events to arrive that may be part of a matching event sequence, before indicating a match (or matches). This is not applicable to on-demand...

The interval timer starts are the arrival of the first event matching a sequence for a partition. When the time interval passes and an event sequence matches, duplicate matches are eliminated and output occurs.

[MathewsMax]

Hi David,

Thanks for the reply and EPL Online Link. I want the alert to be fired once in 4 hours when there are more than 3 matches. It should remain quiet for the next 4 hours.  If there are any matches after 4 hours since the first alert,another alert is to be fired.

Regards,
Mathews

[MathewsMax]

Thanks David. And sorry for the late reply.