Ya Rajeev, this is not scalable, especially if we were looking for a higher number. Most importantly, this would mean counting patterns cannot be used for what they are supposed to be used. :(
On Wed, Oct 29, 2014 at 12:41 PM, Rajeev Sampath <[email protected]> wrote: > Hi, > > On Wed, Oct 29, 2014 at 11:38 AM, Seshika Fernando <[email protected]> > wrote: > >> Hi, >> >> I was trying out counting patterns and the result was not what I >> expected. Let me explain through the example I was trying. >> >> The incoming stream is a stream of credit card transactions. I want to >> get an alert on a pattern of every 3 or more transactions done using the >> same card at different locations within 10 mins. So I used the following >> siddhi query... >> >> from every e1 = Transaction -> >> e2 = Transaction[(e2.cardnum == e1.cardnum) and (e2.location != >> e1.location)]*<3:>* >> within 10000 >> select e1.cardnum as cardnum, e1.location as loc1, e2[0].location as >> loc2, e2[1].location as loc3 insert into FraudAlert >> >> > As a workaround, you can simply define the pattern for 3 events. This will > get triggered for any additional event after the first 3 events as well. > > from every e1 = Transaction -> > e2 = Transaction[(e2.cardnum == e1.cardnum) and (e2.location != > e1.location)]* ->* > *e3 = Transaction *[(e3.cardnum == e1.cardnum) and (e3.location != > e2.location) and (e3.location != e1.location)] > within 10000 > select e1.cardnum as cardnum, e1.location as loc1, e2.location as loc2, > e3.location as loc3 insert into FraudAlert > > Not a scalable approach though. :) > > > Thanks > Rajeev > > > >> So if there are only 3 transactions that have the same card number but >> different locations (say.. Dehiwela, Nairobi and Kiev), then I expect there >> to be 1 alert giving me the card number and the 3 different locations. eg:- >> [3714496353984310, Dehiwela, Nairobi, Kiev] >> >> However, when I run this, I get 3 alerts as follows >> >> [3714496353984310, Dehiwela, Nairobi, null] >> [3714496353984310, Dehiwela, Nairobi, Kiev] >> [3714496353984310, Nairobi, Kiev, null] >> >> Is this expected behaviour? If yes, then (its not very useful IMHO) and >> how do we write a query to capture the scenario I've given? >> >> Thanks, >> seshi >> >> _______________________________________________ >> Dev mailing list >> [email protected] >> http://wso2.org/cgi-bin/mailman/listinfo/dev >> >> > > > -- > Rajeev Sampath > Senior Software Engineer > WSO2, Inc.; http://www.wso2.com. > > Mobile: > * +94716265766 <%2B94716265766>* >
_______________________________________________ Dev mailing list [email protected] http://wso2.org/cgi-bin/mailman/listinfo/dev
