[rules-users] Using eval in LHS
Input:
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,107,32,0,0,0,10,53320,-1,-1,-1,-1,-1,-1
0,0,109,20,0,0,0,19,100644,-1,-1,-1,-1,-1,-1
0,0,109,20,0,0,0,19,100644,-1,-1,-1,-1,-1,-1
0,0,106,28,0,0,0,26,137745,-1,-1,-1,-1,-1,-1
0,0,108,32,0,0,0,67,354281,-1,-1,-1,-1,-1,-1
0,0,105,30,0,0,1,94,501089,-1,-1,-1,-1,-1,-1
Problem:
Should find vehicles with same data (if it occurs more than thrice).
Though eval in rule 'Detect Accident' results in true, consequence is not
fired.
Output:
Added
Not Found -- 107---2
test---2107
Not Found -- 107---3
test---3107
Not Found -- 107---4
test---4107
no of veh : 1
no of veh : 1
no of veh : 1
Not Found -- 109---5
test---1109
Not Found -- 109---6
test---2109
Not Found -- 106---7
Please find the DRL below.
package com.hp.hpl.CHAOS.LR;
# importing classes
import java.lang.Integer;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Iterator;
import com.hp.hpl.CHAOS.Rules.VehicleLocation;
global java.lang.String output
declare VehicleLocation
@role( event )
@expires ( 1m )
end
declare Statistics
smashedcars : ArrayList
stopped_cars : ArrayList
accidents: ArrayList
collided_at : HashMap
end
rule "Setup statistics"
salience 110
no-loop true
when
not( Statistics( ) )
vehLoc : VehicleLocation()
then
Statistics s = new Statistics();
s.setSmashedcars (new ArrayList());
s.setStopped_cars (new ArrayList());
s.getStopped_cars().add(vehLoc);
s.setCollided_at(new HashMap());
insert( s );
System.out.println("Added");
end
rule "Add to stopped cars"
salience 100
no-loop true
when
vehLoc : VehicleLocation()
$stat : Statistics ()
((not( VehicleLocation(vid == vehLoc.vid) from $stat.getSmashedcars(
then
modify($stat) {
getStopped_cars().add(vehLoc);
}
System.out.println("Not Found -- " + vehLoc.getVid() + "---" +
$stat.getStopped_cars().size());
end
rule "Identify Collided Vehicles"
salience 90
no-loop true
when
vehLoc : VehicleLocation()
$stat : Statistics ()
$allStoppedcars : ArrayList( size > 0 )
from collect ( VehicleLocation(xway == vehLoc.xway, pos ==
vehLoc.pos, dir == vehLoc.dir, lane == vehLoc.lane) from $stat.stopped_cars)
then
System.out.println("test" + "---" + $allStoppedcars.size() + "" +
vehLoc.getVid());
modify($stat) {
setCollided_at(collided_at($allStoppedcars, vehLoc.getXway(),
vehLoc.getPos(), vehLoc.getDir(), vehLoc.getLane()));
}
retract (vehLoc);
end
rule "Detect Accident"
salience 80
no-loop true
when
vehLoc : VehicleLocation()
$stat : Statistics ()
eval(collision_occured($stat.getCollided_at()))
then
System.out.println("Detect Accident");
end
function HashMap collided_at(ArrayList stopped_cars, int x, int pos, int
dir, int lane) {
HashMap collided_at = new HashMap();
for (Iterator iterator = stopped_cars.iterator(); iterator.hasNext(); )
{
VehicleLocation vehLoc = (VehicleLocation) iterator.next();
if (vehLoc.getXway() == x
&& vehLoc.getPos() == pos
&& vehLoc.getDir() == dir
&& vehLoc.getLane() == lane) {
int key = vehLoc.getVid();
if (!collided_at.containsKey(key)) {
collided_at.put (key, new Integer(1));
continue;
}
collided_at.put (key,
((Integer)collided_at.get(key)).intValue()+1);
}
}
return collided_at;
}
function boolean collision_occured(HashMap collided_vehicles) {
java.util.Set entries = collided_vehicles.entrySet();
int noOfCollidedVehicles = 0;
java.util.Iterator iterator = entries.iterator();
while ( iterator.hasNext() ) {
java.util.Map.Entry object = (java.util.Map.Entry) iterator.next();
if ((Integer)object.getValue() > 3) {
noOfCollidedVehicles += 1;
}
}
if (noOfCollidedVehicles > 0) {
System.out.println("no of veh : " + noOfCollidedVehicles);
return true;
}
return false;
}
Please let me know what should I correct here.
--
View this message in context:
http://www.nabble.com/Using-eval-in-LHS-tp24646946p24646946.html
Sent from the drools - user mailing list archive at Nabble.com.
___
rules-users mailing list
rules-users@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/rules-users
[rules-users] Rule with temporal operators
global java.lang.String output declare OMNewTicket @role( event ) @timestamp (timeStampAttr) @expires (10m) end # Find 'critical' events of 'Windows' which occured after 1minute but before 10 minutes # of 'warning' events of 'Symantec' provided no 'Security' with severity 'normal' exist in between rule "Sample Temporal" no-loop true when $ticket : OMNewTicket($severity1 : severity == "warning", appName == "Symantec", $timeStampAttr1 : timeStampAttr) $ticket1 : OMNewTicket(this after[1m, 10m] $ticket, severity == "critical", $appName1 : appName == "Windows", $timeStampAttr2 : timeStampAttr) not (OMNewTicket( timeStampAttr <= $timeStampAttr2, timeStampAttr >= $timeStampAttr1, appName == "Login_failure", severity == "normal")) then drools.getWorkingMemory().setGlobal( "output", "found"); end For the input : e6382090-a259-71dd-12b9-92dfda1614178 10/25/2008:5:59:AM warning SymantecApplication 956cb3a0-a22d-71dd-09d7-c0195b7b14178 10/25/2008:6:00:AM warningLogin_failure Security 28bdb2e0-a25a-71dd-1bc3-c01959f414178 10/25/2008:6:05:AM critical WindowsApplication 956cb3a0-a22d-71dd-09d7-c0195b7b14178 10/25/2008:10:04:AM normal Login_failure Security 20f39930-a27d-71dd-0369-81f8b3ee14178 10/25/2008:10:04:AM warning Symantec Application 648d5010-a27c-71dd-1bc3-c01959f414178 10/25/2008:10:05:AM criticalWindows Application 8bcb9bb0-a32f-71dd-10c5-c01959dc14179 10/26/2008:7:23:AM warning Login_failure Security 8882ee70-a331-71dd-1fbc-c0068f1714179 10/26/2008:7:37:AM warning Symantec Application I get the below output: 405000 405000 0 warning SymantecSat Oct 25 05:59:00 406000 406000 0 warning Login_failureSat Oct 25 06:00:00 407000 407000 0 critical WindowsSat Oct 25 06:05:00found 408000 408000 0 normal Login_failureSat Oct 25 10:04:00 409000 409000 0 warning SymantecSat Oct 25 10:04:00 41 41 0 critical WindowsSat Oct 25 10:05:00 411000 411000 0 warning Login_failureSun Oct 26 07:23:00 found 412000 412000 0 warning SymantecSun Oct 26 07:37:00 I use pseudo clock and I set the time in the third column(example 10/25/2008:5:59:AM) of the input as the 'timeStampAttr' by converting it to long. I also adjust the clock accordingly. My requirement is to get the those 'critical-windows' event which happens after 1 to 10minutes of 'warning-Symantec' provided no 'normal-Login_Failure' between them. Problem here is, I could not get convinced with the occurance of found in row #7. Coz 'Login_failure' did not occur between 10minute interval of a symantec and windows event. Also my intention is to identify the windows event. -- View this message in context: http://www.nabble.com/Rule-with-temporal-operators-tp24370198p24370198.html Sent from the drools - user mailing list archive at Nabble.com. ___ rules-users mailing list rules-users@lists.jboss.org https://lists.jboss.org/mailman/listinfo/rules-users
[rules-users] Rule with temporal operators
Need your help to know what went wrong in the rule. global java.lang.String output declare OMNewTicket @role( event ) @timestamp (timeStampAttr) @expires (10m) end # Find 'critical' events of 'Windows' which occured after 1minute but before 10 minutes # of 'warning' events of 'Symantec' provided no 'Security' with severity 'normal' exist in between rule "Sample Temporal" no-loop true when $ticket : OMNewTicket($severity1 : severity == "warning", appName == "Symantec", $timeStampAttr1 : timeStampAttr) $ticket1 : OMNewTicket(this after[1m, 10m] $ticket, severity == "critical", $appName1 : appName == "Windows", $timeStampAttr2 : timeStampAttr) not (OMNewTicket( timeStampAttr <= $timeStampAttr2, timeStampAttr >= $timeStampAttr1, appName == "Login_failure", severity == "normal")) then drools.getWorkingMemory().setGlobal( "output", "found"); end For the input : e6382090-a259-71dd-12b9-92dfda1614178 10/25/2008:5:59:AM warning SymantecApplication 956cb3a0-a22d-71dd-09d7-c0195b7b14178 10/25/2008:6:00:AM warningLogin_failure Security 28bdb2e0-a25a-71dd-1bc3-c01959f414178 10/25/2008:6:05:AM critical WindowsApplication 956cb3a0-a22d-71dd-09d7-c0195b7b14178 10/25/2008:10:04:AM normal Login_failure Security 20f39930-a27d-71dd-0369-81f8b3ee14178 10/25/2008:10:04:AM warning Symantec Application 648d5010-a27c-71dd-1bc3-c01959f414178 10/25/2008:10:05:AM criticalWindows Application 8bcb9bb0-a32f-71dd-10c5-c01959dc14179 10/26/2008:7:23:AM warning Login_failure Security 8882ee70-a331-71dd-1fbc-c0068f1714179 10/26/2008:7:37:AM warning Symantec Application I get the below output: 405000 405000 0 warning SymantecSat Oct 25 05:59:00 406000 406000 0 warning Login_failureSat Oct 25 06:00:00 407000 407000 0 critical WindowsSat Oct 25 06:05:00found 408000 408000 0 normal Login_failureSat Oct 25 10:04:00 409000 409000 0 warning SymantecSat Oct 25 10:04:00 41 41 0 critical WindowsSat Oct 25 10:05:00 411000 411000 0 warning Login_failureSun Oct 26 07:23:00 found 412000 412000 0 warning SymantecSun Oct 26 07:37:00 I use pseudo clock and I set the time in the third column(example 10/25/2008:5:59:AM) of the input as the 'timeStampAttr' by converting it to long. I also adjust the clock accordingly. My requirement is to get the those 'critical-windows' event which happens after 1 to 10minutes of 'warning-Symantec' provided no 'normal-Login_Failure' between them. Problem here is, I could not get convinced with the occurance of found in row #7. Coz 'Login_failure' did not occur between 10minute interval of a symantec and windows event. Also my intention is to identify the windows event. -- View this message in context: http://www.nabble.com/Rule-with-temporal-operators-tp24370166p24370166.html Sent from the drools - user mailing list archive at Nabble.com. ___ rules-users mailing list rules-users@lists.jboss.org https://lists.jboss.org/mailman/listinfo/rules-users
[rules-users] Unpredicatable output with Temporal rule
Requirement:
To identify those tickets with "critical" severity which occurs after
2minutes but before 5minutes of a ticket with severity 'warning', provided
both are of different application name.
This rule though not meaningful, is considered to understand the temporal
operator.
This is the rule:
declare OMNewTicket
@role( event )
@expires (10m)
end
rule "Sample Temporal"
salience 10
no-loop true
when
$ticket : OMNewTicket(severity == "warning", $appName : appName)
$ticket1 : OMNewTicket(this after[2m, 5m] $ticket, severity ==
"critical",
appName != $appName)
then
String $s = "";
String $s1 = "";
if ( $ticket != null) {
$s = formatDate($ticket.getReceivingTime());
}
if ( $ticket1 != null ) {
$s1 = formatDate($ticket1.getReceivingTime());
}
drools.getWorkingMemory().setGlobal( "output", "found");
drools.getWorkingMemory().setGlobal( "output1", $s);
drools.getWorkingMemory().setGlobal( "output2", $s1);
end
function String formatDate( String inputDate ) {
try {
DateFormat formatter = new SimpleDateFormat("MM/dd/yy:hh:mm:aaa");
Date date = (Date)formatter.parse(inputDate);
return date.toString();
} catch (ParseException e) {
System.out.println("Exception :"+e);
return null;
}
}
Input:
14178 10/25/2008:9:33:AM critical
TCS_Tibco_AMS_Email
14178 10/25/2008:9:49:AM warning NETLOGON
14178 10/25/2008:9:58:AM warning NETLOGON
14178 10/25/2008:10:00:AM warning crypt32
14178 10/25/2008:10:00:AM warning crypt32
14178 10/25/2008:10:00:AM warning crypt32
14178 10/25/2008:10:03:AM warning crypt32
14178 10/25/2008:10:04:AM warning Symantec
14178 10/25/2008:10:05:AM criticalWindows
SharePoint Services 3
14178 10/25/2008:10:08:AM criticalOVIS
14178 10/25/2008:10:10:AM criticalOffice
SharePoint Server
14225 12/11/2008:3:25:AM warning ASBDSM
14225 12/11/2008:3:25:AM warning WinDiskSpace
14225 12/11/2008:3:25:AM criticalOVIS
14225 12/11/2008:3:30:AM normal OVIS
14225 12/11/2008:3:34:AM critical
TCS_Tibco_AMS_Email
Output:
Status Time of TicketTimestamp of Ticket1 Time (Clock)
found Sat Oct 25 10:00:00Sat Oct 25 10:05:00Sat Oct 25
10:05:00
found Sat Oct 25 10:00:00Sat Oct 25 10:08:00Sat Oct 25
10:08:00
found Sat Oct 25 10:04:00Sat Oct 25 10:10:00Sat Oct 25
10:10:00
found Thu Dec 11 03:25:00 Thu Dec 11 03:34:00 Thu Dec 11
03:34:00
Here Time of Ticket is output1 from rule and Timestamp of Ticket1 is
output2 of the consequence.
Problem :
The output 'found Thu Dec 11 03:25:00 Thu Dec 11 03:34:00
Thu Dec 11 03:34:00 ' is not satisfying the rule condition.
After first three output, there are no tuples matching the criteria
mentioned. Unable to predict the occurence of this in the output.
May I know what i miss here?
--
View this message in context:
http://www.nabble.com/Unpredicatable-output-with-Temporal-rule-tp24307147p24307147.html
Sent from the drools - user mailing list archive at Nabble.com.
___
rules-users mailing list
rules-users@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/rules-users
[rules-users] Timestamp for processing Historical Data
Hi,
I had a chance to go through the fusion sample. I tried the same example
with another logfile as input
Input:
1000 critical Symantec
5000 critical Symantec
6000 critical Symantec
Here I set the timestamp as ( some date in the past + first column of the
input).
*
Following is the simple DRL which has the rule to count number of OMTicket
using sliding window.
package* org.drools.examples.broker;
*
import* org.drools.examples.broker.model.OMTicket;
*
dialect* "mvel"
*
declare* OMTicket
@role( event )
@timestamp (timestamp)
@expires (1h)
*
end*
*
rule* "Count over last 5 seconds"
*
salience* 10
*
no-loop* *true
when
*
Number( $count : intValue ) *from* *accumulate* (
OMTicket($severity:severity) over window:time(5s) *from* entry-point "OM
stream", count() )
*
then*
System.out.println("Number of Critical Tickets over last 5 seconds : " +
$count);
*end*
Here, I just read and insert facts as events with no scheduling.
But the ouput varies for each invocation and it is also not as expected.
Am I missing any configuration here?
___
rules-users mailing list
rules-users@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/rules-users
Re: [rules-users] Finding Average using sliding window
Do anybody have answer for this? Also, rules get fired over facts in the LIFO order. How can I make it to FIFO? PriyaSha wrote: > > I've read through the fusion document...But am clueless on getting average > over a fixed time window... > > In the stocktick sample, using sliding window I could get average for > every event happening. > > But I would like to get the average for a fixed time window. > > For example, if I would like to know the average stockprice of 'RHAT' for > every fixed window of 30s, how this can be achieved in drools fusion? > -- View this message in context: http://www.nabble.com/Finding-Average-using-sliding-window-tp23827973p23901057.html Sent from the drools - user mailing list archive at Nabble.com. ___ rules-users mailing list rules-users@lists.jboss.org https://lists.jboss.org/mailman/listinfo/rules-users
Re: [rules-users] Finding Average using sliding window
Do anybody have answer for this? Also, rules get fired over facts in the LIFO order. How can I make it to FIFO? PriyaSha wrote: > > I've read through the fusion document...But am clueless on getting average > over a fixed time window... > > In the stocktick sample, using sliding window I could get average for > every event happening. > > But I would like to get the average for a fixed time window. > > For example, if I would like to know the average stockprice of 'RHAT' for > every fixed window of 30s, how this can be achieved in drools fusion? > -- View this message in context: http://www.nabble.com/Finding-Average-using-sliding-window-tp23827973p23901049.html Sent from the drools - user mailing list archive at Nabble.com. ___ rules-users mailing list rules-users@lists.jboss.org https://lists.jboss.org/mailman/listinfo/rules-users
[rules-users] Finding Average using sliding window
I've read through the fusion document...But am clueless on getting average over a fixed time window... In the stocktick sample, using sliding window I could get average for every event happening. But I would like to get the average for a fixed time window. For example, if I would like to know the average stockprice of 'RHAT' for every fixed window of 30s, how this can be achieved in drools fusion? -- View this message in context: http://www.nabble.com/Finding-Average-using-sliding-window-tp23827973p23827973.html Sent from the drools - user mailing list archive at Nabble.com. ___ rules-users mailing list rules-users@lists.jboss.org https://lists.jboss.org/mailman/listinfo/rules-users
