6:19 a.m.
I have been looking at the following scenario
1. Alerts are generated by an enterprise system and Sent to the Rule Engine
in batches.
2. I must check the alert batch for possible correlation between the alerts
based on Rules defined in my Rule file (.drl)
*3. Verify if any Correlation already exists for the alerts received if yes
update that correlation with fresh alert data*
4. if no correlation exists i do nothing.
5. If a Correlation exists and No correlation is present in RE representing
the same for those group of alerts I create a New Correlation and update the
RE.
*Steps 1 to 3 are repeated every 15 seconds in the system,*
How do I keep the Objects in Drools to keep checking for Correlation
scenarios as and when I receive data from the enterprise system at regular
intervals so that i can update existing correlation as metioned at *Step 3*
Any approach or suggestion would be very helpful.
-----
Thanks for the support ...!!!
VR
--
View this message in context:
http://drools.46999.n3.nabble.com/How-to-Compute-against-WorkingMemory-in...
Sent from the Drools: User forum mailing list archive at Nabble.com.
7:01 a.m.
I am looking for a In memory processing feature which i am not entirely clear
about as i am a beginner in drools so any pseudo code will be helpful as
well.
-----
Thanks for the support ...!!!
VR
--
View this message in context:
http://drools.46999.n3.nabble.com/How-to-Compute-against-WorkingMemory-in...
Sent from the Drools: User forum mailing list archive at Nabble.com.
7:20 a.m.
For the described scenario, insert the facts into Working Memory as
they arrive and after the last one, call kSession.fireAllRules().
-W
On 26/04/2013, vr <veneet(a)aol.in> wrote:
I am looking for a In memory processing feature which i am not
entirely
clear
about as i am a beginner in drools so any pseudo code will be helpful as
well.
-----
Thanks for the support ...!!!
VR
--
View this message in context:
http://drools.46999.n3.nabble.com/How-to-Compute-against-WorkingMemory-in...
Sent from the Drools: User forum mailing list archive at Nabble.com.
_______________________________________________
rules-users mailing list
rules-users(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/rules-users
7:36 a.m.
Not sure i fully understand the approach, Can you elaborate the same via a
mock example please.
> "insert the facts into Working Memory as they arrive and
after the last
> one."
Do you mean the Batch of alerts needs to be explictly moved to the WM
somehow ?.
*My DRL snapshot*
rule "CORRELATION"
salience 1
when
$alert : Alert()
$list : ArrayList() from collect (Alert ( sourceName=="NETWORK")
from $alert.alerts)
then
checkForAlertDescription($list,drools.getWorkingMemory(),$alert);
//Update the alert list
end
function void checkForAlertDescription(ArrayList list,WorkingMemory wm,Alert
alert) {
/// i update the alert array list via fetching the list i received from the
rule above/
ArrayList<Alert> alist =new ArrayList<Alert>();
for(int i=0;i<list.size();i++){
if( ((Alert)list.get(i)).getAlertDescription().contains("ERR"))
alist.add((Alert)list.get(i));
}
alert.setAlerts(list);
}
-----
Thanks for the support ...!!!
VR
--
View this message in context:
http://drools.46999.n3.nabble.com/How-to-Compute-against-WorkingMemory-in...
Sent from the Drools: User forum mailing list archive at Nabble.com.
8:04 a.m.
From the rule "CORRELATION" I can guess that
class
Alert {
List<Alert> alerts = ...;
public List<Alert> getAlerts(){ return alerts; }
}
which is a little strange.
If you add the constraint alertDescription contains "ERR" to the
collect, you don't need the function checkForAlertDescription any
more.
-W
On 26/04/2013, vr <veneet(a)aol.in> wrote:
*My DRL snapshot*
rule "CORRELATION"
salience 1
when
$alert : Alert()
$list : ArrayList() from collect (Alert ( sourceName=="NETWORK")
from $alert.alerts)
then
checkForAlertDescription($list,drools.getWorkingMemory(),$alert);
//Update the alert list
end
function void checkForAlertDescription(ArrayList list,WorkingMemory
wm,Alert
alert) {
/// i update the alert array list via fetching the list i received from the
rule above/
ArrayList<Alert> alist =new ArrayList<Alert>();
for(int i=0;i<list.size();i++){
if( ((Alert)list.get(i)).getAlertDescription().contains("ERR"))
alist.add((Alert)list.get(i));
}
alert.setAlerts(list);
}
-----
Thanks for the support ...!!!
VR
--
View this message in context:
http://drools.46999.n3.nabble.com/How-to-Compute-against-WorkingMemory-in...
Sent from the Drools: User forum mailing list archive at Nabble.com.
_______________________________________________
rules-users mailing list
rules-users(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/rules-users
8:19 a.m.
Actually that a quick sample to make my point and also you're correct i have
just kept a ArrayList inside the Alert POJO as I said I am completly new to
Drools and RE and am still working on fragments... those functions are just
sample placeholders
So assuming I got *Batch 1* and the *$list* has the alerts received in
Batch 1
When I get *Batch 2*, 15seconds later I want to be able to compare the
alerts received in Batch 2 against the one's in Batch 1 that was already
processed by the Rule engine.
So that i can draw up the correlation for the fresh alerts with the old ones
and this is going to happen till a stipulated timeout say 1-2 hours which
gives me a lot of interim batches received.
the Correlation has to be recursive so that i can make the Alerts compact
and deliever them to downstream systems after the 1-2 hour interval elapses.
hence i am looking out for how to retain the collections in RE be it
WorkingMemory or some other area.
Hope I am able to clarify my scenario a bit better.
-----
Thanks for the support ...!!!
VR
--
View this message in context:
http://drools.46999.n3.nabble.com/How-to-Compute-against-WorkingMemory-in...
Sent from the Drools: User forum mailing list archive at Nabble.com.
9:16 a.m.
You can have one fact in WM and this object can contain any number of
list fields.
This approach may be useful or not - much depends on the way the
correlation between batch n and batch n+1 is to be determined.
I think I mentioned the alternative, but I can't be more specific
since I don't know about this correlation and about what should happen
to batch n after n+1 has been processed. In any case, for this
scenario, an Alert should contain a batch identifier.
-W
On 26/04/2013, vr <veneet(a)aol.in> wrote:
Actually that a quick sample to make my point and also you're
correct i
have
just kept a ArrayList inside the Alert POJO as I said I am completly new to
Drools and RE and am still working on fragments... those functions are just
sample placeholders
So assuming I got *Batch 1* and the *$list* has the alerts received in
Batch 1
When I get *Batch 2*, 15seconds later I want to be able to compare the
alerts received in Batch 2 against the one's in Batch 1 that was already
processed by the Rule engine.
So that i can draw up the correlation for the fresh alerts with the old ones
and this is going to happen till a stipulated timeout say 1-2 hours which
gives me a lot of interim batches received.
the Correlation has to be recursive so that i can make the Alerts compact
and deliever them to downstream systems after the 1-2 hour interval
elapses.
hence i am looking out for how to retain the collections in RE be it
WorkingMemory or some other area.
Hope I am able to clarify my scenario a bit better.
-----
Thanks for the support ...!!!
VR
--
View this message in context:
http://drools.46999.n3.nabble.com/How-to-Compute-against-WorkingMemory-in...
Sent from the Drools: User forum mailing list archive at Nabble.com.
_______________________________________________
rules-users mailing list
rules-users(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/rules-users
8:08 a.m.
On 26/04/2013, vr <veneet(a)aol.in> wrote:
Not sure i fully understand the approach, Can you elaborate the same
via a
mock example please.
>> "insert the facts into Working Memory as they arrive and after the last
>> one."
Do you mean the Batch of alerts needs to be explictly moved to the WM
somehow ?.
Well, any object that should match a pattern in a rule must be
inserted into the WM.
I suspect that you plan to match a single (?) container (which,
confusingly, is also called "Alert") and use "from" to get at a batch
of *actual* Alert facts.
You might consider inserting the "actual" Alert facts, drop the
container and process the batch of Alert facts in WM.
-W
4232
days inactive
4232
days old
7 comments
2 participants
participants (2)
-
vr -
Wolfgang Laun