Esper: Notice, when number of events (with specific parameters) exceeds a threshold

Question

searching for a solution for this quite a long time:

I have a contact form. Every time somebody sends a mail through it, a ContactEvent(receiver, senderIpAddress) is issued to Esper. Now, I would like Esper to inform me, when a specific Ip Address issues more than 50 contact events in 10 minutes.

Syntax Errors in code below are due to code simplification

create window ContactWindow.win:time(10 min) as select ipAddress, mail from ContactEvent 

then I populate it like this:

insert into ContactWindow select ipAddress, mail from ContactEvent";

Eventually, there is an eventlistener on something like this:

select ip, count(ip) as cnt from ContactWindow  group by ip

Which actually works. It's not exactly what I would want tough, as my statement listener is issued each time, an ip addresse's message count changes. ("IP X has sent 43 messages the last 10 minutes", "IP X has sent 44 messages the last 10 minutes",...) I'd only like to get one event telling me "IP X is over 50 messages in the last 10 minutes" and another one telling me, that it has dropped below that border now.

Is there a way to get this to work?

Answer 1

Maybe add a having clause . In your example

select ip, count(ip) as cnt from ContactWindow  group by ip having count(ip)>50