Advanced Queries

Scenario - 1

There are many exchange transactions will occurred in a business environment. Most of the time these transactions will be succeeded but some times it can failed. In this situation if we want to send a trigger when failed transaction is exceeded the given threshold level.

Eg: Incoming event contains transactionID, businessID, code and timestamp. If we want to trigger an event when total failed transactions are exceeded the 5% of the total transaction in 1 minute time interval. 

Query1

from inputEventStream[code=="failed"]#window.time(1200000) 
select count(code) as myCount,transactionID,businessID,timestamp 
group by transactionID,businessID
insert into errorStream; 

Query2
 
from inputEventStream#window.time(1200000) 
select count(code) as myCount,transactionID,businessID,timestamp 
group by transactionID,businessID 
insert into allStream; 

Query3

from errorStream#window.length(1) as errorStream unidirectional join 
allStream#window.length(1) as allStream on errorStream.myCount > allStream.myCount*0.05 
select errorStream.timestamp as timestamp, errorStream.transactionID as transactionID,errorStream.businessID as businessID
insert into doneProcessesStream; 

Query 1

Here, we are checking the event which is coming through the "inputEventStream" is a failed event or succeeded event using the value of the property "code" (code=="failed").  If it is a failed event then counting the total failed events and add that information to the "errorStream".   

Query 2

Here, we are counting all the incoming events which is coming through the "inputEventStream" and add the information to the "allStream".

Query 3

Here, we are joining the events in the "errorStream" and "inputEventStream" when number of failed events of a business exceeded the threshold level. (Here 5% is the threshold level). then we'll add those information to the "doneProcessStream". 

Scenario - 2

Usage of ATM cards is massively increased in the day-today life and also frauds related to ATM transaction also highly increased.

Common Pattern : If there is a high amount of withdrawal occurred for a ATM card which contains the less amount of withdrawal on the same day, then it can be a possible fraud situation. To identify these types of scenario we need to use the "pattern" structure which provided by siddhi. 

Query

from every a1 = withdrawalStream[amount < 1000]
-> b1 = withdrawalStream[amount > 50000 and a1.cardNO == a2.cardNO]
within 1day  

Here, we are checking whether there is a high amount withdrawal ( > 50000) happened in a day where there is a less amount ( < 1000) withdrawal occurred for the same ATM card.