Question

我有一个关于将output子句与命名窗口，模式和insert into语句结合使用的问题。我的目标是检测事件的缺失，将其存储在命名窗口中，当事件再次开始时，选择并删除该行并将其用作＆＃34; online＆＃34;指标（见Esper - detect event after absence）我想以某种方式想要在短时间内有多个离线 - 在线事件时限制事件发生率（禁用误报）。我认为输出子句可以在这里提供帮助但是当我在insert into语句中使用它时，没有事件存储在命名窗口中。这是正确的方法，还是有其他方法来限制这种情况下的事件？

这是我在Esper EPL在线的代码：

create schema MonitorStats(id string, time string, host string, alert string);

create window MonitorWindow.win:keepall() as select id, alert, time, host from MonitorStats;

insert into MonitorWindow select a.id as id, 'offline' as alert, a.time as time, a.host as host from pattern 
 [every a=MonitorStats(id='1234') -> (timer:interval(25 sec) and not MonitorStats(id=a.id))];

on pattern[every b=MonitorStats(id='1234') -> (timer:interval(25 sec) and MonitorStats(id=b.id))]
select and delete b.id as id, 'online' as alert, b.time as time, b.host as host from MonitorWindow as win
where win.id = b.id;

Answer 1

您可以将输出事件插入另一个流并使用“每次输出”。

insert into DetectedStream select ....;
select * from DetectedStream output first every 10 seconds;

带有命名窗口的Esper输出子句

1 个答案: