Question

我有UsersCount事件流，其中包含已连接的用户数。目前，当用户数量在特定时间范围内下降一定百分比时会触发查询：

expression Disconnected { x => max(x.usersCount) - x.usersCount }
expression DisconnectedPercent { x => Disconnected(x) / max(x.usersCount) * 100 }
select usersCount, 
       max(usersCount) as maxUsersCount, 
       DisconnectedPercent(users) as disconnectedPercent, 
       Disconnected(users) as disconnectedCount
from UsersCount.win:time(2 min) as users
having DisconnectedPercent(users) >= 30 
   and Disconnected(users) >= 2
output first every 10 minutes

现在我需要改进查询以在几秒钟内检查用户是否重新连接，即DisconnectedPercent达到某个负阈值，例如：

select ... 
from pattern [every UsersCount(DisconnectedPercent >= 30) -> 
   (timer:interval(10 sec) and not UserCount(DisconnectPercent < -10)].win:time(2 min)

现在我实现的解决方案需要两个语句和一个额外的流。声明一是：

expression Disconnected { x => max(x.usersCount) - x.usersCount } 
expression DisconnectedPercent { x => Disconnected(x) / max(x.usersCount) * 100 }
insert into UsersDisconnectTrigger 
    select usersCount, 
           max(usersCount) as maxUsersCount, 
           Disconnected(users) as disconnectedCount,
           DisconnectedPercent(users) as disconnectedPercent 
from UsersCount.win:time(5 minutes) as users 
having DisconnectedPercent(users) >= 30 and Disconnected(users) >= 10

注册监听器的第二个语句是：

select a.usersCount as usersCount, 
       a.maxUsersCount as maxUsersCount, 
       a.disconnectedCount as disconnectedCount, 
       a.disconnectedPercent as disconnectedPercent 
from pattern [every  a=UsersDisconnectTrigger -> 
           (timer:interval(5 minutes) 
     and not b=UsersCount((usersCount - a.usersCount) / a.usersCount >= 20 / 100)))].win:time(5 minutes)

有没有办法组合单个语句来检测这种模式？是否可以选择如上所述的有意义的值？

Answer 1

您想要研究使用“insert-into”。有第一个语句填充聚合值流。当阈值超出时，让第二个语句消耗第一个语句的流警报。有第三个语句消耗第一个语句的流，当它为负时报警。

Esper：其次是具有聚合标准的模式

1 个答案: