Rules engine fails to trigger action when evaluating complex multi-attribute conditions on device events

I’m having issues with a custom rule that should trigger an alert when multiple sensor conditions are met simultaneously. The rule is designed to detect potential equipment failure by checking temperature, vibration, and pressure readings together. However, the action (sending alert to maintenance system) never fires even though I can see in the event logs that all three conditions are satisfied.

Here’s my rule condition setup:


(temperature > 85 AND vibration > 7.5) OR
(pressure < 20 AND temperature > 80)

The individual attributes are present in the device model and I can see them in the event payload when I test. I’m wondering if there’s an issue with how the logical grouping is evaluated, or if the rule engine has specific requirements for attribute presence that I’m missing. Has anyone successfully implemented multi-attribute rules with complex AND/OR logic?

For production scenarios with multi-sensor correlation, I always recommend edge aggregation. It’s more reliable and reduces cloud-side processing. On your edge gateway, implement a simple buffering mechanism that collects readings from all sensors within a 10-second window, then emits a single consolidated event. This also reduces your message volume and costs. The trade-off is slightly higher latency, but for equipment monitoring that’s usually acceptable.

I’d also recommend testing your rule logic with the rules-engine utility in the IoT console. Go to Rules Designer → Test Rule and manually construct a test event payload with all three attributes present. This will tell you immediately if your logical grouping syntax is correct or if there’s a parsing issue. Sometimes parentheses in complex conditions don’t evaluate the way you expect - the engine is left-to-right with standard operator precedence.

Let me address all three aspects of your rules engine challenge systematically:

Logical Grouping in Rule Conditions: Your condition syntax has a subtle precedence issue. The rules engine evaluates left-to-right with AND taking precedence over OR. Your current rule:


(temperature > 85 AND vibration > 7.5) OR (pressure < 20 AND temperature > 80)

This is actually parsed as:


((temperature > 85 AND vibration > 7.5) OR pressure < 20) AND temperature > 80

To fix the logical grouping, be explicit with your parentheses and consider breaking complex rules into stages. Use this corrected syntax:


rule_stage_1: (temperature > 85 AND vibration > 7.5)
rule_stage_2: (pressure < 20 AND temperature > 80)
final_rule: (rule_stage_1 OR rule_stage_2)

This creates a rule chain where each stage evaluates cleanly and you avoid precedence ambiguity.

Attribute Presence in Event Payload: As others noted, your sensors send separate payloads. The rules engine requires all referenced attributes to be present in a single event. You have two solutions:

  1. Edge aggregation (recommended): Implement a 10-second collection window on your gateway:

aggregation.window.seconds=10
aggregation.strategy=last_value
emit.on.window.close=true
  1. Cloud-side stateful rules: Use the enrichment feature to maintain device state. Create a virtual attribute that tracks the last known value of each sensor:

virtual.temperature.ttl=15000
virtual.vibration.ttl=15000
virtual.pressure.ttl=15000

This keeps a 15-second memory of each reading. Your rule then evaluates against these virtual attributes which are always present.

Testing with Rules-Engine Utility: Always validate rules before deployment. In Rules Designer, use the test payload feature:

  1. Navigate to Rules Designer → Your Rule → Test
  2. Construct a complete test payload with all attributes:
{
  "temperature": 86,
  "vibration": 8.2,
  "pressure": 18,
  "timestamp": "2025-03-05T16:00:00Z"
}
  1. Click “Evaluate Rule” and check the execution trace
  2. The trace shows you exactly which conditions passed/failed and why

In your case, I suspect you’ll find that when you test with a complete payload, the rule fires correctly. This confirms the issue is payload completeness, not rule logic.

For your specific use case (equipment failure detection), I strongly recommend the edge aggregation approach. It’s more deterministic, reduces cloud processing costs, and ensures you never miss correlated conditions due to timing issues. The 5-10 second latency is negligible for predictive maintenance scenarios.

You have a few options here. Edge-side aggregation is one approach - combine readings into a single event before transmission. But that adds complexity and latency. Another option is to use the rules engine’s windowing feature with state retention. Create separate rules for each sensor pair that can fire, then use a correlation rule to track state across multiple events within a time window. It’s more complex but gives you flexibility for asynchronous sensor data.

First thing to check - are all three attributes (temperature, vibration, pressure) arriving in the SAME event payload? The rules engine evaluates conditions against a single event at a time, not across multiple events. If your sensors send separate messages for each reading, the rule will never fire because the engine never sees all three values together in one evaluation cycle.