siddhi-io / siddhi

Stream Processing and Complex Event Processing Engine
http://siddhi.io
Apache License 2.0
1.52k stars 528 forks source link

How to get last matched event by using keyword 'every'? #1779

Closed fengjian1993 closed 2 years ago

fengjian1993 commented 2 years ago

Description:

Affected Siddhi Version:

OS, DB, other environment details and versions:

Steps to reproduce:

@info(name = 'fetch AB') from every A = O[str:contains(log, 'A')] -> B = O[str:contains(log, 'B') and A.sourceIp == B.sourceIp and B.eventTime - A.eventTime < 10000] select A[last].sourceIp as sourceIp, A[last].log as logA, B.log as logB, A[last].eventTime as eventTimeA, B.eventTime as eventTimeB insert into AB;

for input

['1.1.1.1', A, 10000] ['1.1.1.1', A, 11000] ['1.1.1.1', B, 12000]

it outpur

AB : [Event{timestamp=1649643158661, data=[1.1.1.1, A, B, 10000, 12000], isExpired=false}, Event{timestamp=1649643158661, data=[1.1.1.1, A, B, 11000, 12000], isExpired=false}] (Encoded)

How can i just get [1.1.1.1, A, B, 11000, 12000] as result

Related Issues:

fengjian1993 commented 2 years ago

solved

from every(A = O[str:contains(log, 'A')]<1:> -> B = O[str:contains(log, 'B') and A.sourceIp == B.sourceIp and B.eventTime - A.eventTime < 10000]) select A[last].sourceIp as sourceIp, A[last].log as logA, B.log as logB, A[last].eventTime as eventTimeA, B.eventTime as eventTimeB insert into AB;