Evaluating event-generated data using append-only tables
First Claim
1. A method for evaluating events comprising:
- creating a filter that specifies an array of constant values corresponding to one or more attributes that are associated with one or more events;
receiving and storing in memory a stream of records, wherein the stream of records is generated to represent a stream of events, and wherein each record of the stream of records includes a set of attributes that are associated with a particular event, of the stream of events, that is represented by said each record;
selecting a plurality of events from the stream of events by applying the filter to the stream of records in order to select a corresponding plurality of records, wherein applying the filter comprises performing one or more array operations to compare the array of constant values specified in the filter to attributes stored in the plurality of records; and
storing the plurality of records in an append-only sequence, wherein the append-only sequence is a storage representation of the plurality of events that allows only appending new records that represent new events but does not allow modifying and deleting existing records that represent already existing events;
wherein the method is performed by one or more computer systems.
1 Assignment
0 Petitions
Accused Products
Abstract
Techniques are provided for evaluating base events, compound events, and logical update events in an event processing system. In one embodiment, the base events, compound events, and logical update events are definitions in a particular syntax language that specify conditions for evaluating input event data. In this embodiment, base event definitions are evaluated over the input event data; logical update event definitions are evaluated by determining whether the effect of any earlier event is changed by the arrival of a new event; and compound event definitions are evaluated over records representing events that have been selected by evaluating the base event definitions over the input event data.
-
Citations
32 Claims
-
1. A method for evaluating events comprising:
-
creating a filter that specifies an array of constant values corresponding to one or more attributes that are associated with one or more events; receiving and storing in memory a stream of records, wherein the stream of records is generated to represent a stream of events, and wherein each record of the stream of records includes a set of attributes that are associated with a particular event, of the stream of events, that is represented by said each record; selecting a plurality of events from the stream of events by applying the filter to the stream of records in order to select a corresponding plurality of records, wherein applying the filter comprises performing one or more array operations to compare the array of constant values specified in the filter to attributes stored in the plurality of records; and storing the plurality of records in an append-only sequence, wherein the append-only sequence is a storage representation of the plurality of events that allows only appending new records that represent new events but does not allow modifying and deleting existing records that represent already existing events; wherein the method is performed by one or more computer systems. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
-
-
14. A method for evaluating events comprising:
-
receiving a request to evaluate a compound event, wherein the compound event specifies correlation conditions between a set of base events, wherein the correlation conditions specify one or more join operations between the set of base events, wherein each base event in the set of base events specifies conditions for selecting one or more events that are included in a plurality of events that are stored in an append-only sequence; retrieving a sequence of events from the append-only sequence, wherein each event in the sequence of events has been selected into the plurality of events and stored in the append-only sequence based on the conditions specified in one or more base events of the set of base events; and evaluating the compound event, wherein evaluating the compound event comprises; analyzing the correlation conditions that are specified in the compound event; automatically splitting the sequence of events into two or more sub-sequences of events based on the analysis of the correlation conditions; and processing the two or more sub-sequences of events in parallel; wherein the method is performed by one or more computer systems. - View Dependent Claims (15, 16)
-
-
17. A machine-readable volatile or non-volatile medium storing one or more sequences of instructions comprising instructions which, when executed by one or more processors, cause the one or more processors to perform:
-
creating a filter that specifies an array of constant values corresponding to one or more attributes that are associated with one or more events; receiving and storing in memory a stream of records, wherein the stream of records is generated to represent a stream of events, and wherein each record of the stream of records includes a set of attributes that are associated with a particular event, of the stream of events, that is represented by said each record; selecting a plurality of events from the stream of events by applying the filter to the stream of records in order to select a corresponding plurality of records, wherein applying the filter comprises performing one or more array operations to compare the array of constant values specified in the filter to attributes stored in the plurality of records; and storing the plurality of records in an append-only sequence, wherein the append-only sequence is a storage representation of the plurality of events that allows only appending new records that represent new events but does not allow modifying and deleting existing records that represent already existing events. - View Dependent Claims (18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29)
-
-
30. A machine-readable volatile or non-volatile medium storing one or more sequences of instructions comprising instructions which, when executed by one or more processors, cause the one or more processors to perform:
-
receiving a request to evaluate a compound event, wherein the compound event specifies correlation conditions between a set of base events, wherein the correlation conditions specify one or more join operations between the set of base events, wherein each base event in the set of base events specifies conditions for selecting one or more events that are included in a plurality of events that are stored in an append-only sequence; retrieving a sequence of events from the append-only sequence, wherein each event in the sequence of events has been selected into the plurality of events and stored in the append-only sequence based on the conditions specified in one or more base events of the set of base events; and evaluating the compound event, wherein evaluating the compound event comprises; analyzing the correlation conditions that are specified in the compound event; automatically splitting the sequence of events into two or more sub-sequences of events based on the analysis of the correlation conditions; and processing the two or more sub-sequences of events in parallel. - View Dependent Claims (31, 32)
-
Specification