Hierarchical Temporal Event Management

摘要

Hierarchical temporal event management enables reduction or elimination of synchronization of multiple potentially huge indexes for real-time log indexing. Logs are time series data of events having associated times. Raw events are indexed in a hierarchical index. Transformed, filtered, or aggregated events are indexed in the hierarchical index at a different level of the hierarchy than the raw events. The result is a single hierarchical index that supports queries that optionally cross “level boundaries”, enabling a search on both aggregated information and specific elements. Such searches are usable when generating “drill down” data for graphs and reports. Search requests having corresponding search specifications are received from requestors. In response, a hierarchical event store is searched and results are provided to the requestors. Optionally the results are themselves indexed in a level of the hierarchical index, enabling results of computationally expensive aggregate searches to be stored in the hierarchical index.

主权项

1. A method comprising:
receiving, by an event store, one or more events; associating each of the received events with a respective hierarchical level; storing, in the event store, the received events in accordance with the respective hierarchical levels; and determining one or more derived events based at least in part on one or more of the received events.