Replies: 10 comments
-
|
@canob Use failed_logins_count_same_user.StartTime instead of |
Beta Was this translation helpful? Give feedback.
-
Hi @ngjaying |
Beta Was this translation helpful? Give feedback.
-
|
@canob You do not need to quote all the fields. You can use something like
|
Beta Was this translation helpful? Give feedback.
-
@ngjaying I tried your suggestion before I opened the issue, but not on SELECT, instead on the ON of the JOIN, and if I don't put all between ` ` (the stream name and the field name with dots), the JOIN is not working, the rule is not firing. That was the reason that I assumed that then in the SELECT part I need to do the same. To Translate what I'm saying to an example: And this is not working for the JOIN: So, I changed my SQL query with your suggestion, and now is working the SELECT of SQL query, but on ON of the JOIN, I need to stil put all between ` ` (the stream name and the field name with dots). Thanks for your help! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @canob, Could you explain the first rule (by following this document https://ekuiper.org/docs/en/latest/api/restapi/rules.html#query-rule-plan) in order to let us know the plan. |
Beta Was this translation helpful? Give feedback.
-
|
@ngjaying , so, after additional testing, the ON part of the JOIN is not working at all, :( And as you can see, successful_UserName is not equal to failed_UserName, and successful_WorkstationName is not equal to failed_WorkstationName, :( Any additional way to declare fields with dots in the ON part of the JOIN? |
Beta Was this translation helpful? Give feedback.
-
|
@canob |
Beta Was this translation helpful? Give feedback.
-
So, the reason that I'm getting an output when I use `stream_name.field.with.dots` , even that is not correct, is because at the end the evaluation is nil = nil, and that is true, right? |
Beta Was this translation helpful? Give feedback.
-
Hi @Yisaer. Here is the rule-plan: And the rule content in this moment, after applied the suggested changes by @ngjaying , is this one: Thanks for your help. |
Beta Was this translation helpful? Give feedback.
-
Ok, so I finally understood what happened @ngjaying , after double check the events. My use case is a successful login after 5 failed logins, all of them from the same account name and from the same workstation name. The problem is the "closure" of the time window, that happen after the successful login (basically, I'm doing 6-7 failed logins, and immediately after that a successful login), and that was the reason because the rule was not firing using stream_name.`field.with.dots`. |
Beta Was this translation helpful? Give feedback.
-
Environment:
What happened and what you expected to happen:
When I try to declare specific fields of both streams on a SQL query with an INNER JOIN, I'm getting and empty JSON object, {} in the output file.
For example, with this SQL query, using * FROM, I obtain all the fields of the first stream, and all the fields of the second stream, but the problem here is that some of the fields of the first stream have the same name of the fields of the second stream, so I lost that fields in the JOIN:
But when I try to do this SQL query with specific fields on SELECT, I get an empty JSON object, {}, in the output file:
How to reproduce it (as minimally and precisely as possible):
The raw event received on first stream, failed_logins_count_same_user:
The raw event received on second stream, successful_logins, in the next 60 seconds of the first event:
The result output to a file of the SQL query that is working (the first one in the example at the top):
Anything else we need to know?:
Nothing in particular.
Beta Was this translation helpful? Give feedback.
All reactions