You will learn
- Use the CCL Pattern Matching operator to detect specific patterns of events
- Define the alert event that will be generated whenever the pattern is detected
By Jeff Wootton
Add a pattern matching operator to watch for patterns of events in live event streams. When the pattern is detected, generate an alert.
In this example we are going to use the pattern matching operator to watch for a power outage on any machine that last for more than 20 seconds. The machines only send simple “Power off” and “Power On” events. So we’ll use the pattern matching operator to watch for a “Power off” event that is NOT followed by a “Power on” event for the same machine within 20 seconds.
In this tutorial we are going to work in the CCL editor. While you can create a Pattern Matching stream from the visual editor it’s a bit tedious and we’re guessing at this point you’re probably more likely to just want to see the CCL.
If your project is open in the visual editor, click on Switch to Text button to switch to CCL Editor. You can also press F6.
Click Yes if there is a prompt to save the file.
If your project wasn’t open in any editor at this point, you can simply double-click on the
.cclfile in the project (in the SDS Project Explorer) to open it in the
Scroll down to the bottom of the CCL file and paste in the following CCL:
/**@SIMPLEQUERY=PATTERN*/ CREATE OUTPUT STREAM ALARM_POWER AS SELECT A.MACHINEID MACHINEID , A.EVENT_TIME EVENT_TIME , A.LOCATION LOCATION , 'POWER' ALARM_TYPE , 'POWER Out for more than 20 seconds' ALARM_DESC FROM DEVICE_EVENTS A, DEVICE_EVENTS B MATCHING [ 20 SEC : A , ! B ] ON A.MACHINEID = B.MACHINEID AND A.EVENT_VALUE = 'Power off' AND B.EVENT_VALUE = 'Power on' ;
Now let’s take a look at the CCL above to understand it:
Again, see the SAP HANA smart data streaming, CCL Reference guide for more information on using the MATCHING clause.
Click Compile Project button to check for errors.
If you want to see this new operator in action, you run the playback tool to stream the simulated data file in again (see previous tutorial).