'Irregular alerts when detecting missing events for multiple keys using Siddhi
I want to detect missing events for multiple keys and the rule has two parts:
- No event in the timeWindow after system starts - Trigger an alert
- No event for timeWindow after an event already occured.
I have this rule which works fine for one id..
from not inputStream[id == 'ID12345'] for 20 sec
select 'ID12345' as id, 'ID12345-GapDetection' as ruleId insert into outputStream;
from every f1=inputStream[id == 'ID12345'] -> not inputStream[id == f1.id] for 20 sec
select f1.id as id, 'ID12345-GapDetection' as ruleId insert into outputStream;
However, when I add a similar rule, with the only difference being filter Id (Adding 2 rules in the system - ID12345, IDPQRST) with different rule ids.
from not inputStream[id == 'IDPQRST'] for 20 sec
select 'IDPQRST' as id, 'IDPQRST-GapDetection' as ruleId insert into outputStream;
from every f1=inputStream[id == 'IDPQRST'] -> not inputStream[id == f1.id] for 20 sec
select f1.id as id, 'IDPQRST-GapDetection' as ruleId insert into outputStream;
The output is random and not what I expect. It randomly alerts in the following ways:
- Two correct alerts (One for each ID)
- Alerts for either of the IDs
- Misses the alerting completely and stops alerting any further
- Alerts for the same ID twice
I have tried a couple of other rules too to achieve the same solution, however they all end up with the same issue. My other tried rule is:
Using sequence:
from not inputStream[id == 'ID12345'] for 20 sec
select 'ID12345' as id, 'ID12345-GapDetection' as ruleId insert into outputStream;
from every f1=inputStream[id == 'ID12345'], not inputStream[id == 'ID12345'] for 20 sec
select f1.id as id, 'ID12345-GapDetection' as ruleId insert into outputStream;
This makes me wonder if this has got something to do with the way internal rule trigger works for detecting missing events within a certain time period.
I also noticed that if input events are generated at a slower rate, the alerts get triggered correctly.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
