Note that there are some explanatory texts on larger screens.

plurals
  1. POProcessing events from Event Log and react on a certain pattern (Rx?)
    primarykey
    data
    text
    <p>I need to process events coming from the EventLog. This is easy using the <a href="http://msdn.microsoft.com/en-us/library/bb671202%28v=vs.90%29.aspx" rel="nofollow">EventLogWatcher</a> attaching to the EventRecordWritten event. However the query I am interested in (eventid == 299 || eventid == 500) provides more events than what I need. Here is an example of the stream</p> <pre><code>Event ID Correlation ID 299 1AD... (this is actually a guid) X1 500 1AD... X2 500 1AD... 500 1AD... 299 43B... Y1 299 EDB... Z1 500 43B... Y2 500 EDB... Z2 500 43B... 500 43B... </code></pre> <p>I am interested in the event 299 and the first event 500 that matches the correlation id of the 299 event. I marked them in the stream above, that's the output collection I am interested in: <code>[X1, X2, Y1, Y2, Z1, Z2]</code> which probably is a dictionary using the correlation id as a key and a tuple of <code>EventRecord</code> as the value</p> <pre><code>{ 1AD.., &lt;X1, X2&gt; } { 43B.., &lt;Y1, Y2&gt; } { EDB.., &lt;Z1, Z2&gt; } </code></pre> <p>In general events might come in order (299 and then 500) but in a high concurrency situation I foresee two 299 events coming together and then the 500 events so I don't want to rely on the order the events come. The correlation id is the key to correlate them (which is the first property of the event <code>eventRecord.Properties[0]</code>)</p> <p>I think this can be solved with a state machine but it would be interesting to see if anyone comes up with a solution with Rx represented by a query to an observable. That would keep the pattern matching logic in a single place.</p> <p><strong>UPDATE</strong>: here is the answer to the solution. Thanks Gideon it was exactly the starting point I needed!</p> <pre><code>var pairs = events .Where(e299 =&gt; e299.EventArgs.EventRecord.Id == 299) .SelectMany(e299 =&gt; events.Where(e500 =&gt; e500.EventArgs.EventRecord.Id == 500 &amp;&amp; e299.EventArgs.EventRecord.Properties[0].Value.ToString() == e500.EventArgs.EventRecord.Properties[0].Value.ToString()) .Take(1), (e299, e500) =&gt; new { First = e299, Second = e500 }); </code></pre> <p>Thanks in advance, Matias</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload