EVENT-STREAM SEARCHING USING COMPILED RULE PATTERNS

摘要

Methods, systems, and computer-readable media for implementing event-stream searching using compiled rule patterns are disclosed. A rule base is compiled based at least in part on one or more rule patterns. The field names are sorted within the rule patterns. The rule patterns comprise one or more field names and one or more field values. The rule base represents a finite-state machine comprising a plurality of states. A plurality of events are received. The events comprise field names and field values describing events associated with resources in a provider network. The field names are sorted within the events. The rule patterns are evaluated against the events using the rule base. In determining a matched rule pattern for one of the events, the finite-state machine transitions between at least two of the states for the matched rule pattern.

主权项

1. A system, comprising:
a plurality of computing devices configured to implement a rule evaluation system and a provider network comprising a plurality of resources, wherein the rule evaluation system is configured to:
compile a plurality of rule patterns into a rule base, wherein the rule patterns comprise one or more field names and one or more field values, wherein, in compiling the rule patterns, the field names within the rule patterns are sorted, wherein the rule base represents a finite-state machine comprising a plurality of states, and wherein transitions between the states represent matches of field names and matches of field values;begin receiving a stream of events, wherein the events comprise field names and field values describing resource changes in the provider network;sort the field names within the events;evaluate the rule patterns against the stream of events using the rule base, wherein, in determining a matched rule pattern, the finite-state machine transitions from an initial state to an additional state based at least in part on a matched field name or a matched field value; andinvoke one or more actions for the matched rule pattern, wherein the one or more actions are performed by one or more action handlers.