Using drools compute duration of events within a text log
We're experimenting with Drools to process a large amount of textual data from log files.  I'm trying to understand how to properly measure an event time.

The event in question begins in one log line, but may finish either by a successful completion or an unusual abort.  That's what I'm having problems capturing.

Here's the outline of my code:

    rule "Found Call Start"
        when
            LogEntry( message matches ".*CallOriginateCmd.*", logTimestamp : timestamp )
        then
            Call call = new Call();
            call.setStarttime( logTimestamp );
            call.setPartial ( true );
            insert( call );
            AnalysisLog.debug( logTimestamp, "Call Started" );
    end

    rule "Found Call End"
        when
            LogEntry( message matches ".*Client ended the call.*", logTimestamp : timestamp )
            call : Call( partial == true )
        then
            call.setEndtime( logTimestamp );
            call.setPartial( false );
            call.setFailure( false );
            update( call );
            AnalysisLog.debug( logTimestamp, "Call Ended." );
    end

    rule "Found Call Failure"
        when 
            LogEntry( message matches ".*timeout sending Config.*", logTimestamp : timestamp )
            call : Call( partial == true )
        then
            call.setEndtime( logTimestamp );
            call.setPartial( false );
            call.setFailure( true );
            update( call );
            AnalysisLog.debug( logTimestamp, "Call Failed." );
    end

The output from above is:

    Jan 17 22:53:04: Call Started
    Jan 18 02:10:23: Call Failed.
    Jan 17 23:09:23: Call Started
    Jan 18 02:10:23: Call Failed.
    Jan 17 23:25:39: Call Started

Every call seems to match Failed, although only the last call in the log should have matched.

I thought that the code:

    call : Call( partial == true )

within the "when" clause would link the start+end or start+abort together, but this apparently doesn't do this.

Instead, I suppose I need to find a way in the "when" clause to find the call where the logTimestamp is closest to the Starttime of the call.  Is this possible?

TIA
Using drools compute duration of events within a text log
===

We're experimenting with Drools to process a large amount of textual data from log files.  I'm trying to understand how to properly measure an event time.

The event in question begins in one log line, but may finish either by a successful completion or an unusual abort.  That's what I'm having problems capturing.

Here's the outline of my code:

    rule "Found Call Start"
        when
            LogEntry( message matches ".*CallOriginateCmd.*", logTimestamp : timestamp )
        then
            Call call = new Call();
            call.setStarttime( logTimestamp );
            call.setPartial ( true );
            insert( call );
            AnalysisLog.debug( logTimestamp, "Call Started" );
    end

    rule "Found Call End"
        when
            LogEntry( message matches ".*Client ended the call.*", logTimestamp : timestamp )
            call : Call( partial == true )
        then
            call.setEndtime( logTimestamp );
            call.setPartial( false );
            call.setFailure( false );
            update( call );
            AnalysisLog.debug( logTimestamp, "Call Ended." );
    end

    rule "Found Call Failure"
        when 
            LogEntry( message matches ".*timeout sending Config.*", logTimestamp : timestamp )
            call : Call( partial == true )
        then
            call.setEndtime( logTimestamp );
            call.setPartial( false );
            call.setFailure( true );
            update( call );
            AnalysisLog.debug( logTimestamp, "Call Failed." );
    end

The output from above is:

    Jan 17 22:53:04: Call Started
    Jan 18 02:10:23: Call Failed.
    Jan 17 23:09:23: Call Started
    Jan 18 02:10:23: Call Failed.
    Jan 17 23:25:39: Call Started

Every call seems to match Failed, although only the last call in the log should have matched.

I thought that the code:

    call : Call( partial == true )

within the "when" clause would link the start+end or start+abort together, but this apparently doesn't do this.

Instead, I suppose I need to find a way in the "when" clause to find the call where the logTimestamp is closest to the Starttime of the call.  Is this possible?

TIA