Methods, systems, and computer program products for event decomposition using rule-based directives and computed keys

摘要

Methods, systems, and computer program products for generating a common event format representation of information from a plurality of messages include parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message. If the rule specifies to obtain the property value from the previous message, the property value is obtained from the previous message and the common event format representation for the current message is populated with the obtained property value from the previous message. The property value may be obtained by generating a computed key based on properties of the current message that are common to the previous message, and identifying the previous message based on the key of the current message. The rule associated with the current message may also be parsed to determine if the property of the common event format representation for the current message is to be populated with a property value determined by specified code. If the rule specifies to obtain the property value using the specified code, the property value is obtained using the specified code and the common event format representation for the current message is populated with the obtained property value obtained using the specified code.