简体   繁体   English

WSO2:在Siddhi查询中更新输出流

[英]WSO2 : Updating an output stream in Siddhi Query

I have a siddhi query to get the count of total events in one minute by using a timebatch window. 我有一个siddhi查询,可通过使用timebatch窗口在一分钟内获取事件总数。 Using an output stream I am updating a bar chart with constant coming values, timestamps(date and time,till minute ) on the x-axis and events count on the y-axis. 使用输出流,我正在更新条形图,其中恒定不变的即将到来的值,x轴上的时间戳记(日期和时间,直到分钟)和y轴上的事件计数。

But there are sometimes when either the number of events in one minute take too long to be transmitted and hence query does not give correct results. 但是有时有时候,一分钟内事件的数量花费的时间太长而无法发送,因此查询不能给出正确的结果。

For instance if I get total 60 events and this query first gives me the count of 40 which displayed in bar chart but then after a minute it changes its value to 20 which is correct according to the logic but I am concerned if there is a way I could update the stream as well as bar chart for any previous timestamps (in that case 40+20) and insert into it new values for the next upcoming timestamps. 例如,如果我总共获得60个事件,并且该查询首先给我显示了条形图中显示的40个计数,但是一分钟后,它将其值更改为20(根据逻辑是正确的),但是我担心是否有办法我可以更新任何先前时间戳(在这种情况下为40 + 20)的流和条形图,并在其中插入下一个即将到来的时间戳的新值。

I have seen update function is used with tables not stream, is it so? 我见过更新功能用于表而不是流,是吗? And also I want 2 outputStreams populating two different bar charts from the same input stream. 我也想要2个outputStreams从同一输入流填充两个不同的条形图。 So is below query correct for that purpose? 那么下面的查询是否为此正确?

Query is: 查询是:

/* Enter a unique ExecutionPlan */
@Plan:name('FTPExecutionPlan')

/* Enter a unique description for ExecutionPlan */
-- @Plan:description('ExecutionPlan')

/* define streams/tables and write queries here ... */

@Import('FTPInStream:1.0.0')
define stream FTPInStream (ts string, uid string, id_orig_h string, id_orig_p int, id_resp_h string, id_resp_p int, user string, password string,command string, arg string, mime_type string, file_size string, reply_code int, reply_msg string);

@Export('FTPIPOutStream:1.0.0')
define stream FTPIPOutStream (ip_address string, ftp_requests int);

@Export('FTPOutStream:1.0.0')
define stream FTPOutStream (ts string, ftp_requests int);

from FTPInStream
select time:dateFormat(str:replaceAll(ts,'T',' '),'yyyy-MM-dd HH:mm', 'yyyy-MM-dd HH:mm:ss') as ts, uid, id_orig_h, id_orig_p, id_resp_h, id_resp_p
insert into intermediateStream;

from intermediateStream#window.timeBatch(1 min)
select ts, cast(count(ts), 'int') as ftp_requests
group by ts
insert into FTPOutStream;

from intermediateStream#window.timeBatch(1 min)
select id_orig_h as ip_address, cast(count(id_orig_h), 'int') as ftp_requests
group by id_orig_h
insert into FTPIPOutStream;

But there are sometimes when either the number of events in one minute take too long to be transmitted and hence query does not give correct results. 但是有时有时候,一分钟内事件的数量花费的时间太长而无法发送,因此查询不能给出正确的结果。

In above situation, you should probably be using externalTimeBatch window, instead of timeBatch window. 在上述情况下,您可能应该使用externalTimeBatch窗口,而不是timeBatch窗口。 Then it'll process event batch relative to the event's time stamp instead of actual time. 然后,它将处理相对于事件时间戳而不是实际时间的事件批处理。

I have seen update function is used with tables not stream, is it so? 我见过更新功能用于表而不是流,是吗?

Yes. 是。 only event tables have delete/update functionality. 仅事件表具有删除/更新功能。 Event streams do not have that functionality. 事件流不具有该功能。

And also I want 2 outputStreams populating two different bar charts from the same input stream. 我也想要2个outputStreams从同一输入流填充两个不同的条形图。 So is below query correct for that purpose? 那么下面的查询是否为此正确?

Yes. 是。 Since you are exporting both FTPOutStream and FTPIPOutStream, you can use them to populate two different bar charts. 由于要同时导出FTPOutStream和FTPIPOutStream,因此可以使用它们填充两个不同的条形图。

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM