Detecting One of Several Events

Match one or two events, followed by other events in order.

1. Replace the Query statement in the Queries tab with the following text (or copy the text from PatternMatchingCCL.txt between the lines "-- Pattern Matching Code Block 2" and "-- Pattern Matching Code Block 3"):

   -- Match a pattern indicating front running:
   --   Row with customer order
   --   (from either of two streams)
   --   Row with placed order for broker
   --   Row with placed order for customer
   
   INSERT INTO StreamFraudAlerts
   SELECT "Front Running", Broker.OrderId,
   	Broker.Symbol, Broker.Customer
   FROM StreamPhoneOrders Phone, StreamWebOrders Web, 
   	StreamPlacedOrders Broker, StreamPlacedOrders Cust
   MATCHING [10 SECONDS: Phone || Web, Broker, Cust]
   ON Phone.Broker = Web.Broker = Broker.Customer = Cust.Broker 
   	AND Phone.Symbol = Web.Symbol = Broker.Symbol = Cust.Symbol
   WHERE Phone.OrderId = Cust.OrderId 
   	OR Web.OrderId = Cust.OrderId;
   

   The FROM clause in this Query statement uses four data sources from three streams. The MATCHING clause uses the "or" operator (||) to look for a row arriving on either StreamPhoneOrders or StreamWebOrders, followed by two rows arriving on StreamPlacedOrders. The ON clause conditions now include equality across all four data sources. The WHERE clause condition now matches against either StreamPhoneOrders or StreamWebOrders.

2. Open a viewer for StreamWebOrders, and then run the project, again allowing it to run for about a minute.
3. Examine the viewer for StreamFraudAlerts:

   
   
   

   The output stream now includes rows identifying front running for orders originating in ether the StreamPhoneOrders or StreamWebOrders stream. Examine the other viewers again to ensure that you can explain how the different rows matched the pattern in the Query statement.

4. Stop the project.