Find a string in Riemann

I want to find the string in sentence using clojure in riemann. I have wrote the code using re-matches but I am facing some error while executing it.

(smap
     (fn [events]
         (let [count-of-failures (count (re-matches #("POST*" (:Webservice %)) events))]

This is the error I got

java.lang.ClassCastException: riemann.config$eval96$fn__97$fn__98 cannot be cast to java.util.regex.Pattern
    at clojure.core$re_matcher.invoke(core.clj:4460)
    at clojure.core$re_matches.invoke(core.clj:4497)
    at riemann.config$eval96$fn__97.invoke(riemann_v1.config:31)
    at riemann.streams$smap$stream__3695.invoke(streams.clj:161)
    at riemann.streams$fixed_time_window_fn$stream__3946$fn__3979.invoke(streams.clj:381)
    at riemann.streams$fixed_time_window_fn$stream__3946.invoke(streams.clj:381)
    at riemann.config$eval96$stream__145$fn__150.invoke(riemann_v1.config:25)
    at riemann.config$eval96$stream__145.invoke(riemann_v1.config:25)
    at riemann.core$stream_BANG_$fn__5678.invoke(core.clj:19)
    at riemann.core$stream_BANG_.invoke(core.clj:18)
    at riemann.transport$handle.invoke(transport.clj:159)
    at riemann.transport.tcp$tcp_handler.invoke(tcp.clj:93)
    at riemann.transport.tcp$gen_tcp_handler$fn__5904.invoke(tcp.clj:65)
    at riemann.transport.tcp.proxy$io.netty.channel.ChannelInboundHandlerAdapter$ff19274a.channelRead(Unknown Source)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:333)
    at io.netty.channel.AbstractChannelHandlerContext.access$700(AbstractChannelHandlerContext.java:32)
    at io.netty.channel.AbstractChannelHandlerContext$8.run(AbstractChannelHandlerContext.java:324)
    at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:36)
    at io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:116)
    at io.netty.util.concurrent.DefaultThreadFactory$DefaultRunnableDecorator.run(DefaultThreadFactory.java:137)

Solution

I often use a pattern like this for such things

(fixed-time-window 10
   (smap
     (fn [events]
         (let [count-of-failures 
               (count (filter #(re-find #"POST*" 
                                        (:Webservice %)) 
                       events))]
            (assoc (first events) 
                   :service "failure-counts"
                   :metric count-of-failures))))
      index
      slack
      prn
      divine-intervention))

the top call to fixed-time-window takes in events one a time such as:

{:service "foo"} {:service "foo"} {:service "foo"}

and bundles them into groups by time:

[{:service "foo"} {:service "foo"}] [{:service "foo"}]

there is one child stream of that bundler which takes each group and counts things then passes them to it's child streams single events that look like this:

{:service "foo" :metric 2} ;; there where two in the first 10 second window
{:service "foo" :metris 1} ;; there was one in the second 10 second window.

the streams coming out of that are then passed to each of the child streams. In my example I called the example child streams:

index , a build in function that puts things into the index for the dash etc.
slack which is a function who's definition is not given here that forwads events to a slack channel. It's organizaion specific (channel names, tokesn etc) so there is no point in posting it.
prn: prints to the console for debugging
divine-intervention: another function, who's implementation is left as an exercise, which miraculously flips the appropriate bits in all systems to make the problem go away ;-)