workflow/example/event-driven-workflow.yaml at main · GoCodeAlone/workflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
# Event-Driven Workflow Example Configuration
# This demonstrates complex event pattern processing with multiple event types

requires:
  plugins:
    - name: api
    - name: messaging
    - name: workflow-plugin-http

modules:
  # Message broker for receiving events
  - name: event-broker
    type: messaging.broker
    config:
      description: "Central message broker for events"

  # Event processor for complex pattern matching
  - name: event-processor
    type: processing.step
    config:
      componentId: "event-pattern-matcher"
      bufferSize: 1000
      cleanupInterval: "5m"

  # Event handlers for different pattern matches
  - name: security-alert-handler
    type: messaging.handler
    config:
      description: "Handles security related event patterns"

  - name: system-fault-handler
    type: messaging.handler
    config:
      description: "Handles system fault event patterns"

  - name: user-activity-handler
    type: messaging.handler
    config:
      description: "Handles user activity event patterns"

  - name: business-insight-handler
    type: messaging.handler
    config:
      description: "Handles business insight event patterns"

  # API endpoints that emit events
  - name: http-server
    type: http.server
    config:
      address: ":8080"

  - name: api-router
    type: http.router
    dependsOn:
      - http-server

  - name: event-api
    type: http.handler
    config:
      contentType: "application/json"

workflows:
  # HTTP routes for API
  http:
    routes:
      - method: "POST"
        path: "/api/events"
        handler: event-api

  # Event processing workflow
  event:
    # Define the processor to use
    processor: event-processor

    # Define event patterns to match
    patterns:
      # Detect login failures - 3 or more failed logins within 5 minutes
      - patternId: "login-brute-force"
        eventTypes: ["user.login.failed"]
        windowTime: "5m"
        condition: "count"
        minOccurs: 3
        maxOccurs: 0
        orderMatters: false

      # Detect system errors - sequence of specific errors within 2 minutes
      - patternId: "critical-system-fault"
        eventTypes: ["system.error.db", "system.error.api", "system.error.auth"]
        windowTime: "2m"
        condition: "sequence"
        minOccurs: 1
        maxOccurs: 0
        orderMatters: true

      # Detect potential data breach - specific sequence within 10 minutes
      - patternId: "potential-data-breach"
        eventTypes: ["user.permission.escalation", "data.access.sensitive", "user.unusual.location"]
        windowTime: "10m"
        condition: "sequence"
        minOccurs: 1
        maxOccurs: 0
        orderMatters: true

      # Detect business opportunity - specific user behavior pattern
      - patternId: "purchase-opportunity"
        eventTypes: ["user.view.product", "user.add.cart", "user.abandon.cart"]
        windowTime: "30m"
        condition: "sequence"
        minOccurs: 1
        maxOccurs: 0
        orderMatters: true

    # Define handlers for patterns
    handlers:
      - patternId: "login-brute-force"
        handler: security-alert-handler

      - patternId: "critical-system-fault"
        handler: system-fault-handler

      - patternId: "potential-data-breach"
        handler: security-alert-handler

      - patternId: "purchase-opportunity"
        handler: business-insight-handler

    # Define message broker to event processor adapters
    adapters:
      - broker: event-broker
        topics: ["user.login.failed", "user.permission.escalation", "user.unusual.location"]
        eventType: "security.event"
        sourceIdKey: "userId"
        correlIdKey: "sessionId"

      - broker: event-broker
        topics: ["system.error.db", "system.error.api", "system.error.auth"]
        eventType: "system.event"
        sourceIdKey: "serviceId"
        correlIdKey: "traceId"

      - broker: event-broker
        topics: ["user.view.product", "user.add.cart", "user.abandon.cart", "data.access.sensitive"]
        eventType: "user.event"
        sourceIdKey: "userId"
        correlIdKey: "sessionId"