There is a continuous stream of data, after all transformations it has next schema:
root
|-- message_id: string (nullable = true)
|-- device_id: string (nullable = true)
|-- metric_id: long (nullable = true)
|-- value: long (nullable = true)
|-- timestamp: string (nullable = true)
There is also set of rules, i.e.:
if metric_id = 4077 and value > 10 and value < 25
That means if any row in a stream meets that condition, then this row must be pushed into a different stream.
How identify messages that meet alert criteria (there are several) and after push them to different stream?