Introduction to Apama EPL

Before EPL can look for patterns in event streams, you must define the types of events you are interested in and inject their definitions in the correlator. An event definition informs the correlator about the composition of an event type. An example event definition for a stock exchange tick feed is as follows:

event StockTick {
   string symbol;
   float price;
   float volume;
}

Each field of the event has a type and a name. The type informs the correlator how to handle that field and what operations to allow on it. As you can see, the correlator can handle multiple types, such as numeric values and textual values, within the same event type. Apama can handle any number of different event types at one time.

Client event sources and the IAF need to be able to inject events into the correlator. For the correlator to be able to detect an event of interest, the event’s type definition must have been loaded into the correlator. An example of a StockTick event is as follows:

StockTick (“APAMA”, 55.20, 250010)

An event listener observes the correlator event stream analyzing each event in turn until it finds a sequence of events that match its event expression. When this happens the event listener triggers, causing the correlator to execute the listener action.

A stream listener passes stream query output to procedural code. A stream query operates on one or two streams to transform their contents into a single output stream. The type of the stream query output items need not be the same as the type of the query input items. The output for one stream query can be the input for another stream query. At the end of the chain of stream queries, a stream listener coassigns each stream query output item to a variable and executes specified code.

One or more actions — an action is one or more operations that the correlator performs. An action might be to register a listener or it might be an operation to perform when the correlator finds a match between an incoming event or sequence and a listener.

The following EPL example illustrates these concepts in the form of a simple monitor called PriceRise. The monitor is composed of three actions. The first two actions declare listeners, which are indicated by the on keyword.

monitor PriceRise
{
action onload() {
      StockTick firstTick;
      on all StockTick(“IBM”,>=75.5,*):firstTick {
         furtherRise (firstTick);
      }
      float f;
      from tick in all StockTick(symbol="IBM")
         within 60.0 every 60.0
         select mean(tick.price): f { average(tick.price); }
   }
   action average(float av) {
      log "60-second average for IBM: "+av.toString();
   }
   action furtherRise(StockTick tick) {
      StockTick finalTick;
      on all StockTick("IBM",>=(tick.price*1.05),*): finalTick {
         log "IBM has hit "+finalTick.price.toString();
         emit PlaceSellOrder("IBM",finalTick.price,1000.0);
      }
   }
}

When a monitor starts running, the correlator executes the monitor’s onload() action. In the PriceRise monitor, the onload() action creates an event listener for all IBM stock ticks that have a price above 75.5 at any volume and a stream listener for all IBM stock ticks. Since the last field of the event (volume) is irrelevant to the event listener it is represented by an asterisk (*), which indicates a wildcard. This monitor effectively goes to sleep until the correlator detects an IBM stock tick.

If the correlator detects an IBM stock tick, the stream listener takes it as input and uses it to log 60-second averages for IBM stock prices. If the IBM stock tick also has a price that is greater than or equal to 75.5, the correlator copies the field values in that event to the firstTick variable and calls the furtherRise() action.

The furtherRise() action creates another event listener. This event listener is looking for the next part of the event pattern, which involves detecting if the IBM stock price goes up by more than 5% from its new value. The second listener uses the firstTick variable to obtain the price value in the event that caused the first listener to detect a match. If the price rise occurs, the correlator copies the values in the matching, incoming event to the finalTick variable, and executes the associated block of code.

The associated block of code logs the new price and emits a PlaceSellOrder event to a receiver that is external to the correlator. For example, an adapter can pick up this event, and translate it into a message that an order book can operate on. The PlaceSellOrder event causes placement of an order for 1000 units of IBM stock.