im totally new to Esper, so please don't shoot me, if the following question sounds stupid.
I am sending POJO-events to an esper instance. This POJOS have some attributes, as follows:
MyEventPOJO {
final String sourceIP;
final String destIP;
final Calendar transmissionTime;
final List<WorkingDay> WorkingDays;
The List<WorkingDay>
holds a List of WorkingDays that indicate, at which time a host is allowed to do certain things. Each one of the WorkingDay
's has a unique dayName
(see class discription below).
The event MyEventPOJO
is sent to esper as soon as an activity of the host with sourceIP
has been found. The event is created in another part of the software. In that part a database is queried for the WorkingDays
of the host. This information is put into the List<WorkingDay>
and sould then be correlateed with the transmissionTime
. The transmission time represents the time(date and time of activity) at which the activity of the host has been tracked.
The result of the correlation should be all the MyEventPOJO
's where the host was active outside of the permitted times that are specified by the List<WorkingDay>
A WorkingDay looks like this:
public class WorkingDay {
final String dayName;
final Calendar startTimeOfDay;
final Calendar endTimeOfDay;
.
.
.
I want to create a statement that filters out the events, where following things are true:
MyEventPOJO.tramissionTime
has the same day name as WorkingDay.dayName
MyEventPOJO.tramissionTime
's time of day is outside of the range of WorkingDay.startTimeOfDay
and WorkingDay.endTimeOfDay
Edit: The statement should collect all MyEventPOJO
's, that match the expressions stated above using a time_batch window of 10 minute length.
I appreciate any advice you can give me. Thanks in advance.
I wish you a nice weekend and hope i can solve this problem with your help.
I used a script to get the day name from the calendar.
expression string getCalendarDayName(ts) [
getCalendarDayName(ts);
function getCalendarDayName(ts) {
return new java.text.SimpleDateFormat("EEEE").format(ts.getTime());
}
]
select * from MyEventPOJO(
workingDays.allOf(v => dayName = getCalendarDayName(transmissionTime))
and
workingDays.allOf(v => transmissionTime.before(startTimeOfDay) or transmissionTime.after(endTimeOfDay))
)