1. Introduction

This article mainly introduces how the expression pattern syntax in alarm rules combines with MySQL alarms. You can understand the depth of the syntax and its integration with business through the usage scenarios described in this article.

1.1 Prerequisites

Before reading this article, you should understand the basic syntax of expression patterns. Please refer to the link: Expression Syntax

1.2 Use Cases

This article will illustrate alarm examples using taxi orders. The example database first creates a database named taxi_service, and within it, a table named orders is created. The meanings of the table fields are as follows:

order_id: Order ID

passenger_name: Passenger’s name

driver_name: Driver’s name

status: The status of the order, which can be one of the following:

• Payment Successful
• Order Canceled

abnormal_status: The abnormal status of the order

• No Abnormality
• Low Level Abnormality
• Medium Level Abnormality
• High Level Abnormality

created_at: Creation time

updated_at: Update time

completed_at: Completion time

order_amount: Order amount

order_duration: Order duration (in minutes)

2 Arithmetic Operations

2.1 Single Query Condition Operations

Calculate the average amount of successful payments for the last 3 days. If the average amount is less than 60, trigger an alarm.

$A.avg_successful_payments < 60

2.2 Multiple Query Condition Priority Operations

Calculate the proportion of canceled order amounts to total amounts over the last 3 days. If it exceeds 5%, trigger an alarm.

$B.total_canceled_orders / ($A.total_successful_payments + $B.total_canceled_orders) * 100 > 5

3 Relational Operators

Calculate if the order in the last 6 hours has no abnormal status and the canceled order amount is greater than 100, or if the order has a high-level abnormal status and the canceled order amount is greater than 100. Trigger an alarm.

$A.status == 'Order Canceled' && $A.abnormal_status == "No Abnormality" && $A.total_order_amount > 100 || $A.status == 'Order Canceled' && $A.abnormal_status == "High Level Abnormality" && $A.total_order_amount > 100

4 Logical Operators

Calculate if the number of canceled orders yesterday is greater than the number of canceled orders the day before, and if the proportion of successful orders yesterday to successful orders the day before is less than 60%. Trigger an alarm.

$A.failed_orders > $B.failed_orders and $A.successful_orders / $B.successful_orders > 0.6

5 Element Value Comparison

Calculate if Driver13 and Driver33 have an order amount greater than 1000 or an order count greater than 50, and trigger an alarm.

($A.driver_name in ["Driver13","Driver33"] && $A.total_order_amount > 1000) || ($A.driver_name in ["Driver13","Driver33"] && $A.counts > 50)

Note: in and not in are used to check if an element exists in an array, not for fuzzy matching.

6 String Contains

Calculate if the driver’s name contains “Driver9” and the total order amount is greater than 3000, trigger an alarm. (Keywords can be an error code)

$A.driver_name contains "Driver9" && $A.total_order_amount > 3000

7 Regular Expression Matching

Calculate if the order abnormal status matches any level of abnormality regex and if the count value is greater than 55, trigger an alarm.

$A.abnormal_status matches ".* Level Abnormality$" && $A.total_counts > 55

8 Value Range Interval

Calculate if the count of orders with amounts between 50 and 100 is greater than 1, trigger an alarm.

$A.total_counts > 1 && between($A.order_amount, [50,100])

Note: between and not between apply to non-string type values.

9 Time Comparison

Calculate if data has not been updated for more than 60 seconds, trigger an alarm.

now().Unix() - $A.create_at > 60

created_at is the timestamp field of the data, as shown in the figure below.

Note: Timestamps only support addition and subtraction operations.