clojure - Event count at certain time interval in riemann -

i have check number of count appearing in event @ each interval of every 30 seconds. if count greater 5 means, need trigger email.

i using below code, email didn't triggered.

(let [userindex1 (default :ttl 300 (update-index (index)))]   (streams     prn     userindex1))  (streams   (where (and (service "system_log")               (not (expired? event)))      ; fixed-time-window sends vector of events out every 30 seconds     (fixed-time-window       30       ; smap passes events function       (smap         (fn [events]           ;calculate no of count of events failure           (let [numberoffailure (count (filter #(="ie" (:description %)) events))]              {:status "login failures"              :metric  numberoffailure               :totalfail (boolean(numberoffailure > 5))}              (streams               prn               numberoffailure))))         ;check if variable status true if condition satisfied trigger email       (let [email (mailer {:host "smtp.gmail.com"                            :port 25                            :user "aaaaa"                            :pass "bbbbb"                            :auth "true"                            :subject (fn [events]                                       (clojure.string/join ", "                                                            (map :service events)))                            :from "abc@gmail.com"})]         (streams           (where (and (:status "login failures")                       (:totalfail true))             (email "123@gmail.com"))))))) 

where going wrong?

there couple of issues here. i'll try address of them, post minimal working example:

1. the first fn passed smap should return event. event can created event or assoc'ing 1 of received events. in sample plain map created (which not work, it's not proper event), that's lost because streams called (which afaik should called @ top level). instead of:

   (smap   (fn [events]     (let [numberoffailure ...]       {:status "login failures"        :metric  numberoffailure         :totalfail (boolean ...)}       (streams         prn         numberoffailure)))   ...) 

   you should like:

   (smap   (fn [events]     (let [numberoffailure ...]       (event {:status "login failures"               :metric  numberoffailure                :totalfail (boolean ...)}))   ...) 

2. to calculate totalfail remember need use prefix notation call >, must (> totalfail 5). , boolean not needed, > return boolean.

3. i initialize mailer out of top-level streams call, enclosing scope using let or def. should work is.

4. you should pass last where children stream smap, must second argument smap. let's recall smap docs:

   (smap f & children) streaming map. calls children (f event), whenever (f event) non-nil. prefer (adjust f) , (combine f). example:  (smap :metric prn) ; prints metric of each event. (smap #(assoc % :state "ok") index) ; indexes each event state "ok" 

5. the last where should not enclosed streams, , and sentence must work on event, must be:

   (where (and (= (:status event) "login failures")             (:total-fail event))   (email "123@gmail.com")) 

6. the :subject fn mailer should passed part of second map, explained in mailer documentation

7. there's open issue on fixed-time-window makes bit unreliable: doesn't fire time window due waits until new event fired, might want use different windowing strategy until get's fixed.

here goes full minimal working example based on yours:

(let [email (mailer {:host "localhost"                      :port 1025                      :from "abc@gmail.com"})]   (streams     (where (and (service "system_log")                 (not (expired? event)))       (fixed-time-window         5         (smap           (fn [events]             (let [count-of-failures (count (filter #(= "ie" (:description %)) events))]               (event                 {:status "login failures"                  :metric  count-of-failures                   :total-fail (>= count-of-failures 2)})))           (where (and (= (:status event) "login failures")                       (:total-fail event))             (email "hello123@gmail.com")))))))