Variable duration non-event pattern matching
Techniques for performing non-event pattern matching on continuous event streams using variable duration. The duration value used in non-event pattern matching can be variable. Accordingly, a first pattern match candidate can have a different associated duration from a second pattern match candidate for matches arising from events received via an event stream. In certain embodiments, the duration for a candidate pattern match may be based upon one or more attributes of an event that started the candidate pattern match or based upon an expression (e.g., an arithmetic expression) involving one or more attributes of the event.
1. A method comprising:
determining, by a computing device, that a first event received by the computing device via an event stream causes a first pattern match candidate to be started for a pattern;
computing, by the computing device, a first duration for the first pattern match candidate;
determining, by the computing device, a first expiration time for the first pattern match candidate based upon a first time associated with the first event and the first duration;
associating, by the computing device, the first expiration time with the first pattern match candidate;
determining, by the computing device, that a second event received via the event stream causes a second pattern match candidate to be started for the pattern;
computing, by the computing device, a second duration for the second pattern match candidate, the second duration being different from the first duration;
determining, by the computing device, a second expiration time for the second pattern match candidate based upon a second time associated with the second event and the second duration; and
associating, by the computing device, the second expiration time with the second pattern match candidate.
2. The method of claim 1 wherein:
the first event and the second event comprise an attribute;
computing the first duration comprises:
determining a first value of the attribute of the first event; and
using the first value to compute the first duration; and
computing the second duration comprises:
determining a second value of the attribute of the second event, the second value being different from the first value; and
using the second value to compute the second duration.
3. The method of claim 1 wherein:
the first event and the second event comprise an attribute;
computing the first duration comprises:
determining a first value of the attribute of the first event; and
evaluating an expression using the first value to compute the first duration; and
computing the second duration comprises:
determining a second value of the attribute of the second event, the second value being different from the first value; and
evaluating the expression using the second value to compute the second duration.
4. The method of claim 1 further comprising:
determining, after the first time duration for the first event has passed, whether the first pattern match candidate has matched the pattern; and
upon determining that the first pattern match candidate has matched the pattern, outputting information indicative of a non-event occurrence corresponding to the first pattern match candidate.
5. The method of claim 1 , further comprising:
determining, at or after the first expiration time associated with the first pattern match candidate, whether the first pattern match candidate has matched the pattern; and
upon determining that the first pattern match candidate has matched the pattern, outputting information indicative of a non-event occurrence corresponding to the first pattern match candidate.
6. A computing device comprising:
a memory; and
a set of processing units, wherein one or more processing units from the set of processing units are adapted to:
determine that a first event received by the computing device via an event stream causes a first pattern match candidate to be started for a pattern;
compute a first duration for the first pattern match candidate;
determine a first expiration time for the first pattern match candidate based upon a first time associated with the first event and the first duration;
associate the first expiration time with the first pattern match candidate;
determine that a second event received via the event stream causes a second pattern match candidate to be started for the pattern;
compute a second duration for the second pattern match candidate, the second duration being different from the first duration;
determine a second expiration time for the second pattern match candidate based upon a second time associated with the second event and the second duration; and
associate the second expiration time with the second pattern match candidate.
7. The computing device of claim 6 wherein the one or more processing units from the set of processing units are adapted to:
determine a first value of an attribute of the first event; and
use the first value to compute the first duration;
determine a second value of the attribute of the second event, the second value being different from the first value; and
use the second value to compute the second duration.
8. The computing device of claim 6 wherein the one or more processing units from the set of processing units are adapted to:
determine a first value of an attribute of the first event; and
evaluate an expression using the first value to compute the first duration;
determine a second value of the attribute of the second event, the second value being different from the first value; and
evaluating the expression using the second value to compute the second duration.
9. The computing device of claim 6 wherein the one or more processing units from the set of processing units are further adapted to:
determine, after the first time duration for the first event has passed, whether the first pattern match candidate has matched the pattern; and
upon determining that the first pattern match candidate has matched the pattern, output information indicative of a non-event occurrence corresponding to the first pattern match candidate.
10. The computing device of claim 6 wherein the one or more processing units from the set of processing units are adapted to:
determine the first expiration time by adding the first duration to the first time associated with the first event; and
determine the second expiration time by adding the second duration to the second time associated with the second event.
11. The computing device of claim 6 wherein the one or more processing units from the set of processing units are further adapted to: determine, at or after the first expiration time associated with the first pattern match candidate, whether the first pattern match candidate has matched the pattern; and upon determining that the first pattern match candidate has matched the pattern, output information indicative of a non-event occurrence corresponding to the first pattern match candidate.
12. A non-transitory computer-readable memory storing a plurality of instructions executable by one or more processing units, the plurality of instructions comprising:
instructions that cause at least one processing unit from the one or more processing units to determine that a first event received via an event stream causes a first pattern match candidate to be started for a pattern;
instructions that cause at least one processing unit from the one or more processing units to compute a first duration for the first pattern match candidate;
instructions that cause at least one processing unit from the one or more processing units to determine a first expiration time for the first pattern match candidate based upon a first time associated with the first event and the first duration;
instructions that cause at least one processing unit from the one or more processing units to associate the first expiration time with the first pattern match candidate;
instructions that cause at least one processing unit from the one or more processing units to determine that a second event received via the event stream causes a second pattern match candidate to be started for the pattern;
instructions that cause at least one processing unit from the one or more processing units to compute a second duration for the second pattern match candidate, the second duration being different from the first duration;
instructions that cause at least one processing unit from the one or more processing units to determine a second expiration time for the second pattern match candidate based upon a second time associated with the second event and the second duration; and
instructions that cause at least one processing unit from the one or more processing units to associate the second expiration time with the second pattern match candidate.
13. The non-transitory computer-readable memory of claim 12 wherein:
the instructions that cause at least one processing unit from the one or more processing units to compute the first duration comprise:
instructions that cause at least one processing unit from the one or more processing units to determine a first value of an attribute of the first event; and
instructions that cause at least one processing unit from the one or more processing units to use the first value to compute the first duration; and
the instructions that cause at least one processing unit from the one or more processing units to compute the second duration comprise:
instructions that cause at least one processing unit from the one or more processing units to determine a second value of the attribute of the second event, the second value being different from the first value; and
instructions that cause at least one processing unit from the one or more processing units to use the second value to compute the second duration.
14. The non-transitory computer-readable memory of claim 12 wherein:
the instructions that cause at least one processing unit from the one or more processing units to compute the first duration comprise:
instructions that cause at least one processing unit from the one or more processing units to determine a first value of an attribute of the first event; and
instructions that cause at least one processing unit from the one or more processing units to evaluate an expression using the first value to compute the first duration; and
instructions that cause at least one processing unit from the one or more processing units to compute the second duration comprise:
instructions that cause at least one processing unit from the one or more processing units to determine a second value of the attribute of the second event, the second value being different from the first value; and
instructions that cause at least one processing unit from the one or more processing units to evaluate the expression using the second value to compute the second duration.
15. The non-transitory computer-readable memory of claim 12 wherein the plurality of instructions further comprises:
instructions that cause at least one processing unit from the one or more processing units to determine, after the first time duration for the first event has passed, whether the first pattern match candidate has matched the pattern; and
instructions that cause at least one processing unit from the one or more processing units to, upon determining that the first pattern match candidate has matched the pattern, output information indicative of a non-event occurrence corresponding to the first pattern match candidate.
16. The non-transitory computer-readable memory of claim 12 wherein:
the instructions that cause at least one processing unit from the one or more processing units to determine the first expiration time comprise instructions that cause at least one processing unit from the one or more processing units to determine the first expiration time by adding the first duration to the first time associated with the first event; and
the instructions that cause at least one processing unit from the one or more processing units to determine the second expiration time comprise instructions that cause at least one processing unit from the one or more processing units to determine the second expiration time by adding the second duration to the second time associated with the second event.
17. The non-transitory computer-readable memory of claim 12 wherein the plurality of instructions further comprises:
instructions that cause at least one processing unit from the one or more processing units to determine, at or after the first expiration time associated with the first pattern match candidate, whether the first pattern match candidate has matched the pattern; and
instructions that cause at least one processing unit from the one or more processing units to, upon determining that the first pattern match candidate has matched the pattern, output information indicative of a non-event occurrence corresponding to the first pattern match candidate.