Table of Contents

Search

  1. Preface
  2. RulePoint
  3. RulePoint Concepts
  4. Using RulePoint
  5. RulePoint Objects
  6. Working with Topics
  7. Working with Connections
  8. Working with Sources
  9. Working with Responders
  10. Working with Responses
  11. Working with Watchlists
  12. Working with Analytics
  13. DRQL
  14. Working with Rules
  15. Working with Alerts
  16. Setting Access Controls
  17. Troubleshooting RulePoint Issues
  18. Connecting to an Ultra Messaging Application
  19. Creating an Ultra Messaging JMS Source

User Guide

User Guide

Windows Clause in DRQL

Windows Clause in DRQL

You can configure sliding or tumbling windows in rules to set a boundary for selecting events from event streams. The windows determine what events the rule must process. The events activate or expire as determined by the window type.

Sliding Windows Clause

You can classify sliding windows based on time or count. The clause specifies a window size for the events either in time or in events.
Events expire due to the following reasons:
  • In a time window, when an event exceeds the time limit, only those events expire. For an events window, when a new event arrives, only the oldest event expires if the number of events has exceeded the window count.
  • Event sets expire when they match a rule condition. In sliding windows, only event sets that match the rule conditions expire. For example, for a "when 2" rule, when a third event arrives and forms an event set combination of (e3,e2) (e3,e1), only those event sets that match the rule conditions expire.
Sliding window based on time
You can configure the time frame in seconds, minutes, and days. The window takes a time interval relative to the time of the current event. If the time stamp of the current event is t, all the events between
t-window time
and
t
are considered in forming the event sets.
The
slide within n seconds
DRQL 1.1 syntax replaces
within n seconds of DRQL
1.0.
The following single topic rule shows the usage of
slide within n seconds
over stock events:
WHEN 2 stocks WITH average(s.price) > 14 slide within 5 seconds then testresponse
The following table shows how the rule maintains a sliding window for a size of 5 seconds and when the condition is 2:
Events - Price values
Time window
Incoming events
Combination of events set that can form when a new event arrives
Cache condition evaluation
10
0 seconds
e1
-
No activation
12
2 seconds
e2
(e2,e1)
No activation
14
4 seconds
e3
(e3,e1), (e3,e2)
No activation as the event set combination does not match the condition.
16
6 seconds
e4
(e4,e2), (e4,e3)
One activation seen for (e4,e3) as the condition matches the rule. e1 expires in time. e2 is still active.
When you use sliding windows in a rule, all the events which do not match the rule or those events that exist within the specified time continue to survive.
38
8 seconds
e5
e5
No activation. e2 expires with time and will not form an event set combination.
Event set refers to a set of events that are formed according to the conditions of a rule. For example, if the condition is "when 2", the event set formed is (e1,e2). If the condition is "when 3", the set combination formed is (e1,e2,e3). Event set combination refers to the number of set combinations of events formed with the arrival of every new event. For example, if it is a "when 2" rule, and if the third event arrives, then the set combination formed is (e3,e2) (e3,e1).
Sliding window based on count
The window considers the count of events. With the arrival of the latest event, if the count exceeds the specified count limit, the oldest event expires. If there is an activation, only the matching event sets within the event set combination expire.
The following rule shows the usage of
slide within n events
over stock events:
WHEN 2 stocks WITH average(s.price) > 14 slide within 3 events then testresponse
The following table shows how the rule maintains a sliding window for a size of 3 events and when condition is 2:
Events - Price value
Events count in window
Incoming events
Combination of events set that can form when a new event arrives
Cache condition evaluation
10
1
e1
No activation
12
2
e2
(e2,e1)
No activation
14
3
e3
(e3,e1), (e3,e2), (e2,e1)
No activation as none of the set combinations do not match the condition.
16
3
e4
(e4,e2), (e4,e3)
One activation seen for (e4,e3). e1 expires with count (e4, e3, and e2 are only considered) and hence will not form an event set combination.
In sliding windows, all the events which do not match the rule or exists within the specified count will continue to be active.
18
2
e5
(e5,e2)
One activation. e2 does not expire, but count since (e4,e3) expires.

Tumbling Windows Clause

The tumble window clause specifies a window size for the events either in time or in events. Events expire due to the following reasons:
  • In a time window, events expire if they exceed the specified time limit. In an events window, when a new event arrives, the oldest event expires if the number of events exceeds the window count.
  • Event sets expire when they match the rule condition. In tumbling windows, the entire event set combination that matches the rule conditions expires. For example, if it is a "when 2" rule, and if the third event arrives, for the set combination of (e3,e2) (e3,e1) formed, even if one event set matches the rule condition, all the events in the set combination expire.
Tumbling window based on time
When the time difference between the last event and the current event is equal or just greater than the window time, the rule is activated and all the events are dropped after the evaluation irrespective of their participation in the activations.
The following rule shows the usage of
tumble within n seconds
over stock events:
WHEN 2 stocks WITH average(s.price) > 14 tumble within 5 seconds then testresponse
The following table shows how a single topic rule that uses a window clause tumbles for a size of 5 seconds and when condition is 2:
Event price value
Time window
Incoming events
Possible event set combination when new event arrives
Cache condition evaluation
10
0 seconds
e1
No activation.
12
2 seconds
e2
(e2,e1)
No activation.
14
4 seconds
e3
(e3,e1), (e3,e2)
No activation. Since none of the set combination does not match the condition.
16
6 seconds
e4
(e4,e2), ( e4,e3)
One activation. e1 expires with time and hence will not form an event set combination. Since one event combination matches the rule condition, all other events will expire in the tumbling condition. e2 also expires.
18
8 seconds
e5
Only e5
No activation. e2, e3, and e4 have expired earlier because of the specified tumbling condition.
Tumbling window based on count
The window considers the count of events. With the arrival of the latest event, if the count exceeds the specified count limit, the oldest event expires. If there is activation, all the event sets within the event set combination expires.
The following rule shows the usage of
tumble within n events
over stock events:
WHEN 2 stocks WITH average(s.price) > 14 tumble within 3 events then testresponse
The following table shows how a single topic rule that uses a tumbling window clause tumbles for a size of 3 events and when condition is 2:
Event price value
Events count in window
Incoming events
Possible event set combination when new event arrives
Cache condition evaluation
10
1
e1
-
No activation.
12
2
e2
(e2,e1)
No activation.
14
3
e3
(e3,e1), (e3,e2)
No activation as none of the set combinations do not match the condition.
16
3
e4
(e4,e2), (e4,e3)
One activation. e1 expires with count and hence will not form a set combination. Since one event combination matches the rule condition, all other events will expire in a tumbling condition. e2 also expires.
18
1
e5
Only e5
N o activation. e2 has expired earlier because of the tumbling condition.

0 COMMENTS

We’d like to hear from you!