Query definition
A query searches for an event pattern that you specify. You define a query in a file with the extension .qry. Each .qry file contains the definition of only one query.
If specified, any
package or
using statements must be before the
query declaration. See
Packages and
The using declaration.
You must specify an identifier for the query name. See
Identifiers. The convention for specifying the name of a query is to use UpperCamelCase, as shown in the example below.
Specification of metadata is optional. See
Metadata section. The convention for specifying the key in the key-value pair of the metadata is to use lowerCamelCase as shown in the example below.
Specification of query parameters is optional. See
Parameters section.
An
inputs section is required. It specifies at least one event type. These are the event types that the query operates on. See
Inputs section.
The
find statement is required. It specifies the event pattern of interest and a block that contains procedural code. See
Find statement.
Action definitions, in the same form as actions in events, are optional. See
Event actions.
Example:
query ImprobableWithdrawalLocations {
metadata {
"author":"Apama",
"version":"1"
}
parameters {
float period;
}
inputs {
Withdrawal() key cardNumber within (period);
}
find
Withdrawal as w1 -> Withdrawal as w2
where w2.country != w1.country {
log "Suspicious withdrawal: " + w2.toString() at INFO;
}
}
