Detect Two Events Occurring in Quick Succession
Detect event B occurring quickly after event A using the slidingTimeWindow()
function
Query
head()
| slidingTimeWindow(
[{event = "A" | count(event, as=countAs)}, selectLast(event)],
span=1s
)
| countAs > 0
| event = "B"
Introduction
The slidingTimeWindow()
function can be used to
detect two events occurring in quick succession.
In this example, the slidingTimeWindow()
function
is used to detect event B occurring quickly after event A.
Note that the slidingTimeWindow()
function must be
used after an aggregator function to ensure event ordering. Also note
that the events must be sorted in order by timestamp to prevent errors
when running the query. It is possible to select any field to use as a
timestamp.
Example incoming data might look like this:
@timestamp | event |
---|---|
1451606300500 | A |
1451606301000 | B |
1451606302000 | A |
1451606304000 | B |
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0{{Aggregate}} 1{{Aggregate}} 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
head()
Selects the oldest events ordered by time.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0{{Aggregate}} 1{{Aggregate}} 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| slidingTimeWindow( [{event = "A" | count(event, as=countAs)}, selectLast(event)], span=1s )
Creates a sliding time window of 1 second. Within each window it counts the occurrences of event A, returning the results in a new field named countAs, and selects the event type of the last event in the window.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0{{Aggregate}} 1{{Aggregate}} 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> result style 2 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| countAs > 0
Filters for windows where at least one event A occurred.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0{{Aggregate}} 1{{Aggregate}} 2[/Filter/] 3{{Aggregate}} result{{Result Set}} repo --> 0 0 --> 1 1 --> 2 2 --> 3 3 --> result style 3 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| event = "B"
Checks if the last event in the window is event B.
Event Result set.
Summary and Results
The query is used to detect instances where event B occurs quickly
(within 1 second) after event A. The
span
parameter
configures the interval, allowing this to be customized.
Sample output from the incoming example data:
countAs | event | @timestamp |
---|---|---|
1 | B | 1451606301000 |
The query is useful for identifying sequences of events that happen in quick succession, which could indicate specific patterns of behavior or system interactions.