Hi Basanth, AFAIK, CEP works like sessions window and a session is started for each event which comes in and expires at the end of the time limit. Technically the count is kept separately for each event, so there's no reset. For ex, if you have 6 events,
1,2,3,4,5,6 (and they arrive in order like this) then, when event 1 arrives a time counter of 1 min is started(that's your within time), same with event 2, 3,4,5,6 so, in this case, you would generate 2 alerts corresponding to first event 1 and first event 2 (as they both are followed by 4 more similar events and within the given time). So the behaviour you are getting is expected and correct for situation 3. For situation 4, "Want to Alert when the above condition happens continuously for x interval (could be seconds, minutes or hours) " what do you mean by continuously? if you want an alert when you are getting multiple alerts(define multiple - what would you mean by multiple - the threshold) for situation 3, then create a second pattern which detects the occurence of the first pattern. a very nice example by Till can be found here, although this uses the old API, but you would get the idea: https://github.com/tillrohrmann/cep-monitoring/blob/master/src/main/java/org/stsffap/cep/monitoring/CEPMonitoring.java -- View this message in context: http://apache-flink-user-mailing-list-archive.2336050.n4.nabble.com/Flink-CEP-questions-tp14971p15001.html Sent from the Apache Flink User Mailing List archive. mailing list archive at Nabble.com.
