Pattern for having same/different condition across events

[pranjal0811]

I want to have a pattern where I can filter the condition across events on same/different values for some fields.

For eg: I have the query like - "from every e1=authenticationStream[type == 'FAILURE' ]<5> -> e2=authenticationStream[type == 'SUCCESS'] within 1 min select 'rule1' as ruleId insert into outputStream"

If I want to check whether all these events have the same IP across all events. What are the possible ways to do that?

Siddhi version = 5.1.1

Thanks,

[suhothayan]

We are implementing a way to process lists, but as of now you can do the following,

from every e1=authenticationStream[type == 'FAILURE' ]<5> 
                   -> e2=authenticationStream[type == 'SUCCESS'] within 1 min 
select  e1[0].ip == e1[1].ip and e1[0].ip == e1[2].ip and 
            e1[0].ip == e1[3].ip and e1[0].ip == e1[4].ip and 
            e1[0].ip == e2.ip as allHaveSameIp
insert into outputStream;

[suhothayan]

When we have a better approach will update that too

[pranjal0811]

I have written the query like this -
from every e1=authenticationStream[type == 'FAILURE' ] -> e2=authenticationStream[type == 'FAILURE' and ip == e1.ip]<4> -> e3=authenticationStream[type == 'SUCCESS' and ip == e2.ip] within 1 min select 'myrule' as ruleId insert into outputStream;

what would be the difference between the two solutions.

[suhothayan]

This will work.
In your query, the events will be matched if they have the same ip as of e1.ip
and in my query, it will match any event but at the end checks if all the events have the same ip.

Following is a better version for your usecase. As of now this is not working, we are fixing this.
Will be available with Siddhi Core 5.1.2.

define stream AuthenticationStream (ip string, type string);

@purge(enable='true', interval='15 sec', idle.period='2 min')
partition with (ip of AuthenticationStream)
begin
    from every (e1=AuthenticationStream[type == 'FAILURE' ]<1:> -> 
                        e2=AuthenticationStream[type == 'SUCCESS' ]) within  1 min 
    select e1[0].ip as ip, e1[3].ip as ip4
    having not(ip4 is null)
    insert into BreakIn
end;

Here the partition purge idle.period should be greater than the expected wait time you will use in the query, which is in your case 1 min.