Tracking a sequence of events using EPL

Question

I am writing a Java-based web server monitor application that should be able to detect whenever a user browse, in a certain time frame, a given set of pages in a particular order. To this end, I am using the Esper library. I am having some doubts about the best formulation of the query.

I first declared an 'Access' object used to store all the information of the HTTP requests reaching my web server. Whenever a new request is issued to the server, a new Access object is instantiated and sent, as an event, to the EPL processing core.

Suppose I want to track all users who browse page A, page B and, then, page C. Which is the optimal approach for dealing with a case like this? Do I need to perform several joins, one for each transition, like in the following example?

select * from Access(request='GET /A HTTP/1.1').win:time(30 sec) as a1,
Access(request='GET /B HTTP/1.1').win:time(30 sec) as a2, 
Access(request='GET /C HTTP/1.1').win:time(30 sec) as a3
where a1.IP=a2.IP AND a2.IP=a3.IP

Answer 1

select * from pattern[ every
    a=pageA ->
    b=pageB(a.IP=b.IP) ->
    c=pageC(a.IP=b.IP and c.IP=b.IP) within timer.interval(30s)];

Hope this may help if you want to get in specific order.