AnsweredAssumed Answered

Help with an ESA alert

Question asked by Maximiliano Cittadini on Feb 11, 2019
Latest reply on Feb 11, 2019 by Lee Kirkpatrick


I'm trying to write an ESA alert to trigger under de following conditions:

ESA recieves an event from device_type = 'device' and a user_src is 'username' with a meta = 'cond01' or meta = 'cond02'... this event also has a "number" meta and NO event with the following conditions arribes to ESA within 20 seconds: device_type = 'device' and meta = 'cond03'  and the same number as the first event. The rule is as follows:


@Name('Test Rule')

SELECT * FROM pattern
[Every a = Event(
(device_type.toLowerCase() IN ( 'device' ) AND user_src.toLowerCase() IN ( 'username' ) AND meta.toLowerCase() IN ( 'cond01' , 'cond02' ) ) )
-> (timer:interval(20 seconds) and not Event(device_type.toLowerCase() IN ( 'device' ) AND number= a.number AND meta.toLowerCase()='cond03'))];


the rule work fine, but it aggregates all the events within the same alert and I need one alert for each time that the first event is matched (the device produces several first conditions with different "number")


Sorry if I'm not clear, but I'm a little lost with this.