This is just a loose idea but I think you can solve all of these very
easily without the windowing bolts if you add a data store.
1: Have a bolt that produces an alarm immediately if it sees a tuple where
the condition is met.
2: When your bolt sees the condition is true, it writes into the data store
e.g. "conditionXTimesSeen": 2. If it sees a tuple where the condition is
not matched, it deletes the field.
3. Same as above, but have both a "conditionXTimesSeen" field, and
"conditionXInitiallySeenTimestamp" field.
4. Same as above, but only have the "conditionXInitiallySeenTimestamp"
field.
So in your data store you have basically this structure:
"conditionX": {"consecutiveTimesSeen": 10, "initiallySeenTimestamp":
1562685593 }
"conditionY": {"consecutiveTimesSeen": 4, "initiallySeenTimestamp":
1562685550 }
And your bolt e.g. updates conditionX if it sees a tuple where conditionX
is true, and if it sees a tuple where conditionX is not true, it deletes
the "conditionX" entry. If it sees a tuple where conditionX is true, and it
causes the "conditionX" entry to exceed e.g. the time limit, you trigger
the alarm.
Den man. 8. jul. 2019 kl. 12.10 skrev pavidhanaj <[email protected]>:
> Hi,
>
> I have created the Ruleenginebolt, which evaluates certain condition over
> incoming tuple fields, and if the condition met, it will trigger an alert
>
> I want to control alerting frequency, and we have come up with the below
> cases,
>
>
> 1. Only once when the condition met.
> 2. When the condition matches __ times continuously.
> 3. The condition met for __ times / __ minutes
> 4. When the condition persists for __ mins
>
>
>
> I find it difficult to map these cases exactly with storm sliding/tumbling
> window. could you please guide me in configuring the storm sliding/tumbling
> window bolts for above cases?
>
> Thanks,
> Pavithra.
>
>
> Sent using Zoho Mail <https://www.zoho.com/mail/>
>
>
>
>
