Detecting out-of-order events

Events might arrive with a delay in the agent, and in an unexpected order. Events have a time stamp that is defined by the application that they come from. In most cases, there is a delay between the time stamp of the event and the moment when the event arrives into the system to be processed by the agent. Some events might arrive later than others.

The order in which the events arrive into the system might be different from the order that is expected from their time stamps. Therefore, it is important to have a clear understanding of the interactions between the events. For example, if an event is late and other events arrive during this delay, the action that is defined in the event might no longer be applicable.

In a rule, now refers to the logical time when the rule is triggered. now can correspond to the time stamp of the processed event, or to the time after a specified duration. However, in some cases events can arrive out-of-order. For example, an event that happened first might be processed after another event that happened later. When an event is processed out-of-order, its time stamp is before now.

You can write rules to check that an event arrives in the correct order.

The following rule checks that the time stamp of the recent purchase event corresponds to now. This rule is triggered only if the event arrives in the expected order.

when a purchase event occurs, called 'recent purchase'
if
    'recent purchase' is at the same time as now
    and the amount of 'recent purchase' is more than 200
then
    set the category of 'the customer' to GOLD;

In a rule that uses the clause when <event> has occurred <calendar duration> ago, if an event arrives out-of-order, the postponed processing might happen sooner because the event was already late. For example, in the following rule, if the purchase event arrives 1 minute late, that is 1 minute after its timestamp, the rule is evaluated 3 hours 59 minutes after the event arrives.

when a purchase event has occurred 4 hours ago, called 'the recent purchase'
then
    print "A purchase happened 4 hours ago";