Join streams on tumbling window

[ZarkoPetrovicZuhlke]

Hi,

I am trying to build event notification system using eKuiper. I have set up three streams:

1. Machine data stream - pulls data from http endpoint in 10s intervals
2. Telemetry stream - subscription to MQTT - each machine is sending telemetry data at a rate of 1 message per second
3. Network scanner event - subscription to MQTT - these events happen when network scanner module detects anomalies, which means irregularly.

I have created a rule to process those messages and output syntetic event in case that telemetry data is missing. Rule has joined these three streams in this way:

select * from machine_stream
  left join telemetry_stream
  left join network_scanner
group by TUMBLINGWINDOW(ss,10)

The rule is giving output every 10 seconds and it is returning count of telemetry data and network scanner data.

When network scanner event occurs in the 10 second window - data is joined correctly and output event looks good. But, what I am trying to accomplish is - when network scanner event didn't occur in 10s window - take the information from the last one that occured. I tried using LAST_VALUE and LATEST functions but without success.

Can you please tell me if what I am trying to build here is possible and perhaps point me in right direction.

Thanks,
Zarko

[ngjaying]

Hi @ZarkoPetrovicZuhlke Could you please check this doc https://ekuiper.org/docs/en/latest/example/data_merge/merge_multi_stream.html? Thanks.