Incremental aggregation-based event pattern matching

摘要

Aspects of the present invention provide a solution for recognizing a pattern in a set of data, such as data streaming over a data communication system. In an embodiment, a set of data events is retrieved in the data stream. The retrieved objects each have a plurality of characteristics that can be matched to a predetermined desired characteristic, such as a key value. The retrieved data events can be evaluated with respect to a pattern, with a characteristic of data events being evaluated with respect to an aggregate value related to the pattern. This aggregate value can be updated incrementally based on the data in the characteristic. Based on the evaluation, a determination as to whether the set of data events received subsequent to the first object satisfies the pattern.

主权项

1. A method for recognizing a pattern, comprising:
retrieving a set of data events in a data stream, each data event in the data stream having a plurality of characteristics; retrieving, by an upstream operator, the set of data events; forwarding, by the upstream operator, the set of data events to a matching operator via the data stream; gathering, by an event stream splitter, the data stream from the upstream operator; hashing the data events in the data stream at the event stream splitter; forwarding, by the event stream splitter, the set of data events corresponding to the desired characteristic to the matching operator; forwarding, by the event stream splitter, a second set of data events corresponding a second desired characteristic to a second matching operator that evaluates only data events having the second desired characteristic; evaluating, at the matching operator, a characteristic of each data event, which has a characteristic that matches a predetermined requested characteristic, in the set of data events with respect to an aggregate value corresponding to a desired pattern and a second desired pattern for the second desired characteristic; incrementally updating the aggregate value related to the characteristic using the characteristic of a single data event; incrementally updating a second aggregate value related to a second characteristic using the second characteristic of the single data event; and determining, based on the evaluation, whether the set of data events received subsequent to a first data event satisfies the desired pattern and the second desired pattern.