1

In the CEP engine can I look for a patterns for events that haven't occurred.

Editing the fraud pattern detection query: Can I fire the event if two purchases of the same card are made within one day and if the first purchase is less than $10 and the second one isn't greater than $10,000.

from every (a1 = purchase[price > 10] ) NOT -> a2 = purchase [price >10000 and 1.cardNo==a2.cardNo] within 1 day insert into potentialFraud a1.cardNo as cardNo, a2.price as price, a2.place as place;

Fire if event1 hasn't been followed by event2 within the last hour rather than fire if event1 has been followed by event2 within the last hour?

Colin Divilly
  • 11
  • 1

1 Answers1

0

Non occurrences are not supported as of CEP 3.1.0 (but it will be available in the next version, 4.0.0).

But your use case can be implemented in an alternative way. Since you want to find the occurrence of at least 1 event > 10 and no events > 10000 (per card no.) in the last hour, you can do something like follows:

  1. add a filter that filters events with price > 10
  2. send them to a time window (of 1 hour)
  3. in the time window, use functions to calculate max() value (with a group by) and emit the max value with the output events
  4. In a filter, check for max < 10000

This will look for one or more events with price > 10, but less than 10000 in the last hour.

You'll find the below documentation useful for implementing this: https://docs.wso2.com/display/CEP310/Windows

Rajeev Sampath
  • 2,739
  • 1
  • 16
  • 19