Workflow Overview

​

Architecture

• Live queries: Subscribe to streaming aggregates
• Historical queries: Query aggregated historical data
• Writeback: Send results to WebSocket clients or HTTP endpoints
• Event ingestion: Write events back to Slung

​

Host Functions

extern "C" {
    fn u_query_live(filter_ptr: usize) -> u64;
    fn u_query_history(filter_ptr: usize) -> f64;
    fn u_poll_handle(handle_ptr: u64) -> usize;
    fn u_free_handle(handle_ptr: u64) -> u32;
    fn u_write_event(timestamp_ptr: usize, value_ptr: usize, tags_ptr: usize) -> u32;
    fn u_writeback_ws(producer_ptr: u64, data_ptr: usize) -> u32;
    fn u_writeback_http(url_ptr: usize, data_ptr: usize, method_ptr: u32) -> usize;
}

​

Query Syntax

OP:SERIES:[TAGS]:[RANGE]

• OP: AVG, MIN, MAX, SUM, COUNT
• SERIES: Time series name
• TAGS: Filter using AND, OR, NOT operators
• RANGE: Optional time range (e.g., [1h], [1609459200000000,1609545600000000])

​

Examples

AVG:temp:[sensor=1]
SUM:requests:[status=200,method=GET]:[1h]
MAX:cpu:[host=prod AND region=us-west]

​

Workflow Lifecycle

1. Initialize: Set up query handles and state
2. Poll: Continuously poll handles for new events
3. Process: Execute business logic on incoming events
4. Writeback: Send results to destinations
5. Cleanup: Free handles when done

​

Event Structure

pub struct Event {
    pub timestamp: i64,      // Unix timestamp in microseconds
    pub value: f64,          // Aggregated numeric value
    pub tags: Vec<String>,   // Event tags
    pub producers: Vec<u64>, // Producer connection IDs
}

​

Use Cases

• Real-time alerting and anomaly detection
• Stream processing and transformation
• Metric aggregation and downsampling
• Multi-stream correlation
• Event-driven automation

​

Next Steps