In-memory hierarchical representation of data values

1 . A method of a system comprising a hardware processor, the method comprising:

storing, in a memory, an in-memory representation of data values comprising a hierarchical arrangement of bins comprising leaf bins at a lowest level of the hierarchical arrangement, wherein a leaf bin of the leaf bins comprises an aggregated statistical metric based on an aggregate of a subrange of the data values, and bins at different hierarchical levels of the hierarchical arrangement of bins represent different resolutions at which the data values are aggregated;

receiving, at the system, data values related to a computing environment;

assigning a subset of the received data values to a first leaf bin of the leaf bins based on metadata associated with the received data values;

computing a first aggregated statistical metric based on data values of the subset of the received data values;

adding the first aggregated statistical metric to the first leaf bin;

receiving, at the system, a new data value;

update the first aggregated statistical metric in the first leaf bin using a statistic calculation algorithm that updates a current value of the first aggregated statistical metric based on combining the current value of the first aggregated statistical metric with an update value derived from the new data value, wherein a memory footprint of the first leaf bin remains constant after the updating of the first aggregated statistical metric in the first leaf bin;

receiving, at the system, a query requesting a computation, the query comprising a query filter specifying a time range or a domain in the computing environment;

identifying a hierarchical level of the different hierarchical levels of the hierarchical arrangement of bins based on the query filter; and

performing the computation using bins at the identified hierarchical level.

2 . The method of claim 1 , wherein the assigning of the subset of the received data values to the first leaf bin is further based on bin metadata that identifies a domain of the computing environment represented by the first leaf bin.

3 . The method of claim 1 , wherein the identifying of the hierarchical level of the different hierarchical levels of the hierarchical arrangement of bins based on the query filter comprises determining which of the different hierarchical levels corresponds to a grouping specified by the query filter.

4 . The method of claim 1 , comprising:

computing a second aggregated statistical metric based on the data values of the subset of the received data values; and

adding the second aggregated statistical metric to the first leaf bin, wherein the first leaf bin includes a set of aggregated statistical metrics including the first aggregated statistical metric and the second aggregated statistical metric.

5 . The method of claim 1 , wherein the different hierarchical levels of the hierarchical arrangement of bins comprise hierarchical levels that correspond to different domains of the computing environment.

6 . The method of claim 1 , wherein the different hierarchical levels of the hierarchical arrangement of bins comprise hierarchical levels that correspond to different temporal ranges.

7 . The method of claim 1 , wherein the first leaf bin comprises bin metadata indicating one or more neighbor bins of the first leaf bin.

8 . The method of claim 7 , comprising:

identifying, by the system, a neighbor bin of the first leaf bin using the bin metadata.

9 . The method of claim 8 , wherein the neighbor bin is at a hierarchical level that is higher than a hierarchical level of the first leaf bin, the method comprising:

as part of the computation in response to the query, compute an aggregated statistical metric of the neighbor bin, wherein the aggregated statistical metric of the neighbor bin is not computed during ingesting of data values in the system.

10 . The method of claim 1 , wherein the first aggregated statistical metric of the first leaf bin is aggregated at a first resolution that is greater than a second resolution at which data values are aggregated of a bin at a higher hierarchical level than the first leaf bin in the hierarchical arrangement of bins.

11 . The method of claim 1 , wherein the system comprises a plurality of computing nodes, the memory is in a first computing node of the plurality of computing nodes, and the in-memory representation of data values is a first in-memory representation of a first subset of data values, and wherein the method further comprises:

producing, by the system in a further memory of a second computing node of the plurality of computing nodes, a second in-memory representation of a second subset of data values comprising a hierarchical arrangement of bins,

wherein the computation performed in response to the query further uses bins at a hierarchical level of the second in-memory representation.

12 . The method of claim 1 , comprising:

maintaining, by the system, a data structure comprising indicators of which bins of the in-memory representation are stale, wherein a given bin is stale if an aggregated statistical metric in a child bin of the given bin has been updated and an aggregated statistical metric in the given bin has not yet been updated.

13 . The method of claim 1 , comprising:

evicting, by the system, a selected bin from the memory based on a timestamp of the bin; and

based on the evicting of the selected bin, evicting, by the system, child bins of the selected bin.

14 . A system comprising:

a memory to store an in-memory representation of data values comprising a hierarchical arrangement of bins comprising leaf bins at a lowest level of the hierarchical arrangement, wherein a leaf bin of the leaf bins comprises an aggregated statistical metric based on an aggregate of a subrange of the data values, and bins at different hierarchical levels of the hierarchical arrangement of bins represent different resolutions at which the data values are aggregated;

a processor; and

a non-transitory storage medium storing instructions executable on the processor to:

receive data values from a computing environment;

assign a subset of the received data values to a first leaf bin of the leaf bins based on metadata associated with the received data values;

compute a first aggregated statistical metric based on data values of the subset of the received data values;

add the first aggregated statistical metric to the first leaf bin;

receiving a new data value;

responsive to the new data value, update the first aggregated statistical metric in the first leaf bin using a statistic calculation algorithm that updates a current value of the first aggregated statistical metric based on combining the current value of the first aggregated statistical metric with an update value derived from the new data value, wherein a memory footprint of the first leaf bin remains constant after the updating of the first aggregated statistical metric in the first leaf bin;

receive a query requesting a computation, the query comprising a query filter specifying a time range or a domain in the computing environment;

identify a hierarchical level of the different hierarchical levels of the hierarchical arrangement of bins based on the query filter; and

perform the computation using bins at the identified hierarchical level.

15 . The system of claim 14 , wherein responsive to the new data value, the instructions are executable on the processor to:

defer updating an aggregated statistical metric of a parent bin of the first leaf bin.

16 . The system of claim 15 , wherein the instructions are executable on the processor to:

update the aggregated statistical metric of the parent bin during evaluation of the query.

17 . The system of claim 14 , wherein the assigning of the subset of the received data values to the first leaf bin is further based on bin metadata that identifies a domain of the computing environment represented by the first leaf bin.

18 . A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:

store, in a memory, an in-memory representation of data values comprising a hierarchical arrangement of bins comprising leaf bins at a lowest level of the hierarchical arrangement, wherein a leaf bin of the leaf bins comprises an aggregated statistical metric based on an aggregate of a subrange of the data values, and bins at different hierarchical levels of the hierarchical arrangement of bins represent different resolutions at which the data values are aggregated;

receive, at the system, incoming data values related to a computing environment;

assign a subset of the incoming data values to a first leaf bin of the leaf bins based on metadata associated with the incoming data values;

compute a first aggregated statistical metric based on data values of the subset of the incoming data values;

add the first aggregated statistical metric to the first leaf bin;

receive, at the system, a new data value;

update the first aggregated statistical metric in the first leaf bin using a statistic calculation algorithm that updates a current value of the first aggregated statistical metric based on combining the current value of the first aggregated statistical metric with an update value derived from the new data value, wherein a memory footprint of the first leaf bin remains constant after the updating of the first aggregated statistical metric in the first leaf bin;

receive, at the system, a query requesting a computation, the query comprising a query filter specifying a time range or a domain in the computing environment;

identify a hierarchical level of the different hierarchical levels of the hierarchical arrangement of bins based on the query filter; and

perform the computation using bins at the identified hierarchical level.

19 . The non-transitory machine-readable storage medium of claim 18 , wherein the first aggregated statistical metric is updated using Welford's online algorithm.

20 . The non-transitory machine-readable storage medium of claim 18 , wherein the assigning of the subset of the incoming data values to the first leaf bin is further based on bin metadata that identifies a domain of the computing environment represented by the first leaf bin.