list集合数据 基于CEP 进行恶意登录监控

import java.util

import org.apache.flink.cep.PatternSelectFunction
import org.apache.flink.cep.scala.CEP
import org.apache.flink.cep.scala.pattern.Pattern
import org.apache.flink.streaming.api.TimeCharacteristic
import org.apache.flink.streaming.api.functions.timestamps.BoundedOutOfOrdernessTimestampExtractor
import org.apache.flink.streaming.api.scala._
import org.apache.flink.streaming.api.windowing.time.Time
//输入登录事件样类型
case class LoginEvent(userId: Long, ip: String, eventType: String, evenTime: Long)

//输出报警信息类型
case class Warning(userId: Long, firstFailTime: Long, lastFailTime: Long, warningMsg: String)

object LoginFailCEP {
def main(args: Array[String]): Unit = {
val env = StreamExecutionEnvironment.getExecutionEnvironment
env.setParallelism(1)
env.setStreamTimeCharacteristic(TimeCharacteristic.EventTime)
//1. 定义输入数据流
val LonginEntStream = env.fromCollection(List(
LoginEvent(1, “192.168.0.1”, “fail”, 1558430842),
// LoginEvent(1, “192.168.0.3”, “success”, 1558430845),
LoginEvent(1, “192.168.0.2”, “fail”, 1558430843),
LoginEvent(1, “192.168.0.3”, “fail”, 1558430844),
LoginEvent(2, “192.168.10.10”, “success”, 1558430845)
))
// val LonginEntStream= env.socketTextStream(“hdp1”,4444)
// .map(data => {
// val dataArray: Array[String] = data.split(",")
// LoginEvent(dataArray(0).trim.toLong, dataArray(1).trim, dataArray(2).trim, dataArray(3).trim.toLong)
// })
.assignTimestampsAndWatermarks(new BoundedOutOfOrdernessTimestampExtractorLoginEvent {
override def extractTimestamp(element: LoginEvent): Long = element.evenTime*1000
})

val value1 = LonginEntStream.map((_,1)).keyBy(0).sum(1)
val loginfailpa = Pattern.begin[LoginEvent]("begin").where(_.eventType=="fail")
  .next("next").where(_.eventType=="fail")
  .within(Time.seconds(2))
val patternStream = CEP.pattern(LonginEntStream, loginfailpa)
patternStream.select(new LonginFailmath()).print("warning")
env.execute()

}
}
class LonginFailmath()extends PatternSelectFunction[LoginEvent,Warning]{
override def select(map: util.Map[String, util.List[LoginEvent]]): Warning = {
//第一个失败事件
val firstFail = map.get(“begin”).iterator().next()
//第二个失败事件
val lasetFail = map.get(“next”).iterator().next()
//包装 输出信息
Warning(firstFail.userId,firstFail.evenTime,lasetFail.evenTime,“在两秒没连续登录失败！”)
}
}