基于多匹配次数条件的Apache Solr查询与告警创建需求

Alright, let's tackle your two Solr requirements using your sample purchase event data as a reference. I'll break this down into query writing and alert setup, step by step.

First, let's clarify the core goal: we want to identify when a specific event (e.g., purchases from amazon.com) happens at least n times, then retrieve all matching documents. Here are two common scenarios:

Scenario 1: Verify count first, then fetch documents #

If you want to first confirm the number of matching documents meets your threshold before retrieving them, use these two steps:

Step 1: Count matching documents #

Run this query to get the total number of documents matching your condition (we'll use amazon.com as the target here):

q=event:*amazon.com*&rows=0

• q=event:*amazon.com*: Filters all documents where the event field contains amazon.com (if your event field is analyzed/分词, you can use q=event:amazon.com for more precise matching)
• rows=0: Returns only the count (numFound in the response) without any actual documents

Check the numFound value in the response. If it's greater than or equal to n, proceed to fetch the documents.

Step 2: Retrieve all matching documents #

Once you confirm the count meets your threshold, run this query to get the full set of matching documents:

q=event:*amazon.com*&rows=1000&sort=time desc

• rows=1000: Set this to a value large enough to capture all matching documents (adjust based on your expected volume, or use pagination with start if needed)
• sort=time desc: Optional, sorts results from newest to oldest based on the time field

Quick note: Your sample data has a typo in the event field (Purches instead of Purchased). If your event field is stored as an exact string, make sure your queries match the typo, or use a wildcard like event:*Purchas*from amazon.com* to cover both spellings.

Scenario 2: Group by condition and fetch high-count groups #

If you want to monitor multiple conditions (e.g., purchases from both amazon.com and flipkart.com) and retrieve documents only for groups that hit n occurrences, use Solr's facet grouping:

First, run a facet query to identify high-count events:

q=*:*&rows=0&facet=true&facet.field=event&facet.mincount=n

• facet.field=event: Groups results by the event field
• facet.mincount=n: Only returns groups that appear at least n times

The response will list event values that meet your threshold (e.g., Item Purched from amazon.com). You can then run a targeted query to fetch all documents for that event:

q=event:"Item Purched from amazon.com"&rows=1000

Solr's Alerting framework (available in SolrCloud mode) lets you automate monitoring for your threshold condition and trigger alerts when it's met. Here's how to set it up:

Step 1: Create an Alert Trigger #

First, define a trigger that monitors your target query and checks for the n occurrence threshold. For example, a trigger that alerts when there are 3+ Amazon purchase events in the last 5 minutes:

Create a JSON file (e.g., trigger.json):

{
  "create": {
    "name": "amazon_purchase_threshold_trigger",
    "query": "event:*amazon.com*",
    "threshold": 3,
    "thresholdType": "COUNT",
    "timeWindowSize": "5m",
    "schedule": "*/1 * * * ?"
  }
}

Submit it via Solr API:

curl -X POST -H "Content-Type: application/json" http://<your-solr-host>:<port>/<your-collection>/alert -d @trigger.json

Step 2: Define an Alert Action #

Next, create an action to execute when the trigger fires. Let's use an email alert as an example:

Create a JSON file (e.g., action.json):

{
  "create": {
    "name": "send_purchase_alert_email",
    "class": "org.apache.solr.alerting.EmailAction",
    "recipients": "your-alert-inbox@example.com",
    "sender": "solr-monitoring@example.com",
    "smtpHost": "smtp.your-domain.com",
    "subject": "Alert: {{count}} Amazon Purchase Events Detected",
    "body": "Found {{count}} matching purchase events:\n{{docs}}"
  }
}

Submit the action:

curl -X POST -H "Content-Type: application/json" http://<your-solr-host>:<port>/<your-collection>/alert -d @action.json

Step 3: Link Trigger to Action #

Finally, associate the trigger with your action so alerts fire when the threshold is met:

Create a JSON file (e.g., link.json):

{
  "add-action": {
    "trigger": "amazon_purchase_threshold_trigger",
    "action": "send_purchase_alert_email"
  }
}

Submit the link:

curl -X POST -H "Content-Type: application/json" http://<your-solr-host>:<port>/<your-collection>/alert -d @link.json

Key Notes: #

• Ensure your SolrCloud cluster has the Alerting component enabled (it's enabled by default in SolrCloud mode)
• If you don't need a time window, remove the timeWindowSize parameter to monitor all historical data
• For email actions, verify your SMTP server configuration is correct to avoid delivery issues

内容的提问来源于stack exchange，提问作者Ravi Rana