Hi Stig Rohde Døssin,
Thanks for your suggestion. I need some more clarifications on solving this, please help me with achieving the conditions mentioned below... In all four cases, I want to send the data to the windowing bolts with custom time interval and count for a different group of tuples, for example, the tuple for rule-1 need to send at the time interval of 3 secs and data for rule-2 at the time interval of 10 secs, etc, And at one time the data in the windowing bolt must have the data of same deviceid, ruleid, eventid. ( data in windowing bolt need not be mingled with some other group of data) How can i achieve these two using windowing concepts Thanks, Pavithra. Sent using https://www.zoho.com/mail/ ---- On Tue, 09 Jul 2019 21:14:01 +0530 Stig Rohde Døssing <mailto:[email protected]> wrote ---- You can probably also do this with a couple of different window configurations. Duplicate your tuple stream to a few different bolts. 1. BoltA just alerts immediately if it sees the condition be true for a tuple 2. (Alert if there are x consecutive tuples where the condition is true) BoltB is a count based window bolt, set to x count. It alerts if the condition is true for all the tuples in the window 3. (Alert if there are x consecutive tuples over y minutes, where the condition is true) BoltC is a sliding window bolt, set to y minutes. It alerts if there are x consecutive tuples in the window where the condition is true. 4. (Alert if the condition is true for all tuples in a window of x minutes) BoltD is a sliding window bolt, set to x minutes. It alerts if the condition is true for all tuples in the window. Obviously boltC and D could be the same bolt. Den tir. 9. jul. 2019 kl. 17.23 skrev Stig Rohde Døssing <mailto:[email protected]>: This is just a loose idea but I think you can solve all of these very easily without the windowing bolts if you add a data store. 1: Have a bolt that produces an alarm immediately if it sees a tuple where the condition is met. 2: When your bolt sees the condition is true, it writes into the data store e.g. "conditionXTimesSeen": 2. If it sees a tuple where the condition is not matched, it deletes the field. 3. Same as above, but have both a "conditionXTimesSeen" field, and "conditionXInitiallySeenTimestamp" field. 4. Same as above, but only have the "conditionXInitiallySeenTimestamp" field. So in your data store you have basically this structure: "conditionX": {"consecutiveTimesSeen": 10, "initiallySeenTimestamp": 1562685593 } "conditionY": {"consecutiveTimesSeen": 4, "initiallySeenTimestamp": 1562685550 } And your bolt e.g. updates conditionX if it sees a tuple where conditionX is true, and if it sees a tuple where conditionX is not true, it deletes the "conditionX" entry. If it sees a tuple where conditionX is true, and it causes the "conditionX" entry to exceed e.g. the time limit, you trigger the alarm. Den man. 8. jul. 2019 kl. 12.10 skrev pavidhanaj <mailto:[email protected]>: Hi, I have created the Ruleenginebolt, which evaluates certain condition over incoming tuple fields, and if the condition met, it will trigger an alert I want to control alerting frequency, and we have come up with the below cases, Only once when the condition met. When the condition matches __ times continuously. The condition met for __ times / __ minutes When the condition persists for __ mins I find it difficult to map these cases exactly with storm sliding/tumbling window. could you please guide me in configuring the storm sliding/tumbling window bolts for above cases? Thanks, Pavithra. Sent using https://www.zoho.com/mail/
