Collection pattern

A collection rule is defined by the collection pattern. It collects a group of selected events within a time interval. It is a stateful rule.

Overview

The collection pattern is used to gather similar events over a period of time. The time period is indicated by a mandatory time window, as defined by the <timeWindow> element in the rule language.

Conditions under which the rule response runs

With the collection pattern, the rule response runs when the time window is complete, as defined by the <onTimeWindowComplete> element.

Example usage of this rule pattern

An example usage of the collection pattern is a rule that does the following:
It collects events that meet the criteria of a certain event selector during the time period. When the time period ends, it summarizes the collected events into a single event that contains the total count of events and characteristic information about the summarized events.
Related reference
Collection rule summary