Before marking this resolved, document one more critical aspect that often gets missed with edge rules and custom certificates.
// Edge Gateway MQTT Configuration
mqtt.tls.version=TLSv1.2
mqtt.tls.cipherSuites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
mqtt.eventType=temperature
The issue isn’t just event type matching - it’s the complete event schema validation chain:
1. Custom CA Certificate Handling:
Your custom CA must be registered in Watson IoT Platform under Security > Connection Security > CA Certificates. The edge gateway’s client certificate must chain back to this CA. If the CA isn’t properly registered, the platform accepts the TLS connection but marks the device as ‘untrusted’ internally, which causes the rules engine to skip processing events from that source as a security measure.
Verify CA registration:
- Navigate to Security > Connection Security
- Confirm your CA certificate is listed and status shows ‘Active’
- Check the certificate expiration date
- Ensure ‘Allow Rules Processing’ is enabled for this CA
2. MQTT TLS Configuration:
For edge gateways with custom certificates, the MQTT topic structure must include the correct device type and event type. Your corrected topic should be:
iot-2/type/{deviceType}/id/{deviceId}/evt/temperature/fmt/json
The TLS handshake must complete successfully AND the client certificate must be validated before the rules engine processes any events. Enable debug logging on your edge gateway:
mqtt.debug.level=TRACE
rules.engine.debug=true
This will show you exactly when the rules engine receives events and whether they’re being filtered out due to certificate trust issues.
3. Edge Rule Event Schema Matching:
The rules engine validates three layers for edge deployments:
- Event type (must match rule condition exactly - case sensitive)
- Payload schema (JSON structure must match defined device type schema)
- Source authentication (device must be trusted based on certificate validation)
Your rule condition should explicitly reference the event type:
{
"condition": {
"eventType": "temperature",
"expression": "$event.d.temp > 85"
}
}
The $event.d.temp path assumes your JSON payload structure is:
{"d": {"temp": 92}}
If your device publishes a flat structure like {"temp": 92}, change the expression to $event.temp > 85.
Verification Steps:
- Confirm CA certificate is registered and ‘Allow Rules Processing’ is enabled
- Verify MQTT topic includes correct event type ‘temperature’
- Check payload JSON structure matches rule expression path
- Enable debug logging to see rule evaluation attempts
- Test with a single device first before deploying to fleet
Common Pitfall:
When you tested through the UI, it bypassed the certificate validation layer entirely - that’s why it worked. The UI test injects events directly into the rules engine with a ‘trusted’ flag. Real device events go through the full authentication and validation pipeline.
After making these changes, you should see rule triggers within one message cycle (30 seconds in your case). If critical alerts are still missing after confirming all three areas, check the rules engine logs for schema validation errors - that’s usually the final piece.