Salesforce

ESA Displays Warning For Array Operators

« Go Back
Header
ESA Displays Warning For Array Operators
ESA-Displays-Warning-For-Array-Operators
Event Stream Analysis issue
Rework
2,344.62
Article Content
 
RSA Product Set: NetWitness Logs & Packets / Security Analytics
RSA Product/Service Type: Event Stream Analysis
RSA Version/Condition: 10.6.x
Platform: CentOS, Esper
O/S Version: EL6
When writing an advanced rule, array operators, such as anyOf, fails. For example:
SELECT * FROM
Event(
alias_host.anyOf(i => i.length()>50)
);

Results in an error similar to the following which shows 'Expecting array-type input' but received different type:
Logger name: com.espertech.esper.epl.enummethod.dot.PropertyExprEvaluatorScalarArray
Thread: pipeline-sessions-0
Level : WARN
Message : Expected array-type input from property 'alias_host' but received class java.util.Vector

Another common example of this sort of incorrect type is when performing fuzzy comparison using the LIKE operator.
To do a fuzzy comparison using LIKE operator, first convert the array to a string. A different example would be:
SELECT * from Event (cast(alias_host, string) LIKE '%TESTHOST%');

The syntax for Esper 5.3.0 used by rsa-esa-server RPM can be found in esper\docs folder of http://esper.espertech.com/distributions/esper-5.3.0.zip

Note: If you used array operators in EPL developed in versions 10.5.0.0, 10.5.0.1, and 10.6.0.0, you will need to modify the EPL to use the above workaround.
Article Settings
External
Manual
Lee McCotter
11/17/2017 8:46 AM
Lee McCotter
Article Assignment
 
 
 
Article Properties
Published
Knowledge
000041557
Lee McCotter
Katrina Nash
English

Powered by