Specifying maximum number of events in windows
In an input definition, you can specify a retain clause that indicates how many events can be in the window. For example:
query FraudulentWithdrawalDetection2 {
inputs {
Withdrawal() key userId retain 3;
}
find Withdrawal:w1 -> Withdrawal:w2 where w1.city != w2.city {
log "Suspicious withdrawal: " + w2.toString() at INFO;
}
}
In this query, only the most recent three Withdrawal events can be in the window. In other words, the window cannot contain more than three events. If only zero, one or two Withdrawal events with a particular key have arrived since the application was started then there would be only zero, one or two events, respectively, in the window.
The correlator evaluates the event pattern each time an event is added to the window. Suppose that at the indicated times the following events are added to the window in the partition identified by userId Dan:
Time | Event Added to Window |
10:00 | Withdrawal("Dan", "Dublin") |
10:10 | Withdrawal("Dan", "London") |
10:20 | Withdrawal("Dan", "London") |
10:30 | Withdrawal("Dan", "London") |
11:30 | Withdrawal("Dan", "Paris") |
For the partition identified by the userId Dan, the query evaluates the pattern at the following times:
Time | Window Contents | Matching Events |
10:00 | Withdrawal("Dan", "Dublin") | |
10:10 | Withdrawal("Dan", "Dublin")
Withdrawal("Dan", "London") | w1=Withdrawal("Dan","Dublin")
w2=Withdrawal("Dan","London") |
10:20 | Withdrawal("Dan", "Dublin")
Withdrawal("Dan", "London")
Withdrawal("Dan", "London") | w1=Withdrawal("Dan","Dublin")
w2=Withdrawal("Dan","London") |
10:30 | Withdrawal("Dan", "London")
Withdrawal("Dan", "London")
Withdrawal("Dan", "London") | |
11:30 | Withdrawal("Dan", "London")
Withdrawal("Dan", "London")
Withdrawal("Dan", "Paris") | w1=Withdrawal("Dan","London")
w2=Withdrawal("Dan","Paris") |
It is important to note that at 10:30, the Withdrawal("Dan", "Dublin") event that arrived at 10:00 is no longer in the window because the window retains three events at most and there are three Withdrawal events that have been added to the window more recently.