You can probably also do this with a couple of different window configurations. Duplicate your tuple stream to a few different bolts.
1. BoltA just alerts immediately if it sees the condition be true for a tuple 2. (Alert if there are x consecutive tuples where the condition is true) BoltB is a count based window bolt, set to x count. It alerts if the condition is true for all the tuples in the window 3. (Alert if there are x consecutive tuples over y minutes, where the condition is true) BoltC is a sliding window bolt, set to y minutes. It alerts if there are x consecutive tuples in the window where the condition is true. 4. (Alert if the condition is true for all tuples in a window of x minutes) BoltD is a sliding window bolt, set to x minutes. It alerts if the condition is true for all tuples in the window. Obviously boltC and D could be the same bolt. Den tir. 9. jul. 2019 kl. 17.23 skrev Stig Rohde Døssing < [email protected]>: > This is just a loose idea but I think you can solve all of these very > easily without the windowing bolts if you add a data store. > > 1: Have a bolt that produces an alarm immediately if it sees a tuple where > the condition is met. > 2: When your bolt sees the condition is true, it writes into the data > store e.g. "conditionXTimesSeen": 2. If it sees a tuple where the condition > is not matched, it deletes the field. > 3. Same as above, but have both a "conditionXTimesSeen" field, and > "conditionXInitiallySeenTimestamp" field. > 4. Same as above, but only have the "conditionXInitiallySeenTimestamp" > field. > > So in your data store you have basically this structure: > > "conditionX": {"consecutiveTimesSeen": 10, "initiallySeenTimestamp": > 1562685593 } > "conditionY": {"consecutiveTimesSeen": 4, "initiallySeenTimestamp": > 1562685550 } > > And your bolt e.g. updates conditionX if it sees a tuple where conditionX > is true, and if it sees a tuple where conditionX is not true, it deletes > the "conditionX" entry. If it sees a tuple where conditionX is true, and it > causes the "conditionX" entry to exceed e.g. the time limit, you trigger > the alarm. > > Den man. 8. jul. 2019 kl. 12.10 skrev pavidhanaj <[email protected]>: > >> Hi, >> >> I have created the Ruleenginebolt, which evaluates certain condition over >> incoming tuple fields, and if the condition met, it will trigger an alert >> >> I want to control alerting frequency, and we have come up with the below >> cases, >> >> >> 1. Only once when the condition met. >> 2. When the condition matches __ times continuously. >> 3. The condition met for __ times / __ minutes >> 4. When the condition persists for __ mins >> >> >> >> I find it difficult to map these cases exactly with storm >> sliding/tumbling window. could you please guide me in configuring the storm >> sliding/tumbling window bolts for above cases? >> >> Thanks, >> Pavithra. >> >> >> Sent using Zoho Mail <https://www.zoho.com/mail/> >> >> >> >>
