0

I am using CEP to check if an event has arrived within a specified amount of time (lets say 1 min). If not, I want to publish an alert.

More specifically, a (server) machine generates a heartbeat data stream and sends it to CEP. The heartbeat stream contains the server id and a timestamp. An alert should be generated if no heartbeat data arrive within the 1 min period.

Is it possible to do something like that with CEP? I have seen other questions regarding the detection of non-occurencies but I am still not sure how to approach the scenario described above.

Community
  • 1
  • 1
zlinks
  • 1,037
  • 2
  • 16
  • 26

1 Answers1

1

You can try this :

define stream heartbeats (serverId string, timestamp long);

from heartbeats#window.time(1 minute) insert expired events into delayedStream;

from every e = heartbeats -> e2 = hearbeats[serverId == e.serverId]
  or expired = delayedStream[serverId == e.serverId]
within 1 minute
select e.serverId, e2.serverId as id2, expired.serverId as id3
insert into tmpStream;

// every event on tmpStream with a 'expired' match has timeout
from tmpStream[id3 is not null]
select serverId
insert into expiredHearbeats;
Jérémie B
  • 10,611
  • 1
  • 26
  • 43
  • I had to change `[id3 is not null]` to `[not( id3 is null)]` in order for the execution plan to work. In order to test it I am sending heartBeats every 15 secs. but the expiredHearbeats stream would still get populated after 1 min(using a logger to print the expired events) – zlinks Feb 18 '17 at 14:08