[rules-users] Semantic of rules with not and coincide
Dear all,
I am currently stuck with a problem concerning the use of not and
conincide. I want to analyze a stream of error code events from a set of
devices and detect the following situations. Every event has a timestamp
(long), a device id (String) and an error code (String).
What I want to detect is the following
- If I get two events, one with code C1 and one with C2 from a single
device within 1 minute, it represents a special event combination. The
order of their appearence is not relevant.
- If I just get C1 (without the C2 within the time frame), just report
C1
- If I just get C2 (without the C1 within the time frame), just report
C2
I can successfully detect the special event combination with the
following rule
rule "Detect combination"
when
$e1 : Event ($d: device, code == "C1")
$e2 : Event (device == $d, code == "C2", this coincides [1m] $e1)
then
... do some output
end
Then I tried to implement the detection of C1 only as follows
rule "Detect code C1"
when
$e1 : Event ($d: device, code == "C1")
not ( $e2 : Event (device == $d, code == "C2", this coincides [1m]
$e1))
then
... do some other output
end
My understanding of the rule is that it should fire, if I get the event
with code C1 and there is no other event with error code C2 for the same
device that happens within one minute before and after the C1 event. To
my surprise, the rule fires immediately when I insert an event with
error code C1. Shouldn't the implementation wait at least 1 minute to be
sure that no C2 error event will be inserted?
BTW this is how I insert the events in my test case:
clock.advanceTime(70, TimeUnit.SECONDS);
FactHandle handle1 = ksession.insert( new Event(65000, "A", "C1") );
ksession.fireAllRules();
clock.advanceTime( 10, TimeUnit.SECONDS );
FactHandle handle2 = ksession.insert( new Event(75000, "A", "C2") );
ksession.fireAllRules();
clock.advanceTime( 2, TimeUnit.SECONDS );
And this is mainly the output I get:
detected code C1 @ 70000
event id=44b895e5-7287-404b-8204-3de5690b2360 timestamp=65000
device=A code=C1
detected combination @ 80000
event id=44b895e5-7287-404b-8204-3de5690b2360 timestamp=65000
device=A code=C1
event id=fc89715b-fc30-4b12-ab31-a3884dcd4886 timestamp=75000
device=A code=C2
Any ideas concerning an alternative solution are highly welcomed.
Thanks,
Ingo