Stream siddhi count()为每个事件返回值,而不是为组(或窗口)返回值
这是我定义的查询。我发送的事件是Stream siddhi count()为每个事件返回值,而不是为组(或窗口)返回值,stream,wso2,complex-event-processing,siddhi,Stream,Wso2,Complex Event Processing,Siddhi,这是我定义的查询。我发送的事件是 define stream rawStream ( catBehavior string, catOutcome string, srcAddress string, deviceCat string, srcUsername string, catObject string, destAddress string, appProtocol string, t
define stream rawStream ( catBehavior string, catOutcome string, srcAddress string, deviceCat string,
srcUsername string, catObject string, destAddress string, appProtocol string,
testMinCount string , testGroupBy string );
@info(name = 'condition1')
from rawStream[ catBehavior == '/Authentication/Verify' ]
select srcAddress, catOutcome, deviceCat, srcUsername, destAddress, appProtocol,
testMinCount, distinctcount( testMinCount ) as distinctMinCount, testGroupBy, count() as count
group by testGroupBy
insert into e1_OutputStream
结果表明,计数为每个事件++
rawStream=[/Authentication/Verify,FAIL,1.1.1.1,deviceCat,srcUsername,catObject,destAddress,appProtocol,dis0,group1]
...
rawStream=[/Authentication/Verify,FAIL,1.1.1.1,deviceCat,srcUsername,catObject,destAddress,appProtocol,dis9,group9]
但在关联部分,我想做关联,一个条件是过滤一个组(或窗口),比如“如果组中的事件(usename)>20,那么”我应该怎么做?我在siddhi中使用模式进行关联,它使用单个事件作为主题,我可以得到计数,但它是针对单个事件的,但我需要的一些条件是针对组(或窗口).就像在二维空间中理解三维世界一样,就像在二维空间中理解三维世界一样。我需要的计数值是一个组(窗口),但它由事件携带
[
{
"timestamp": 1482803288482,
"data": [
...
"dis0",
1,
"group1",
1
],
"isExpired": false
}
][
{
"timestamp": 1482803288482,
"data": [
...
"dis9",
9,
"group9",
9
],
"isExpired": false
}
]