SERVICE INTERFACE FOR EVENT DATA STORE

1 . A method comprising:

receiving a query from a service, the query comprising a first field value, a time period and a content request;

performing, by a processing device, a first search of a data store using the first field value to identify a plurality of events having the time period and at least one field that comprises the first field value;

determining, by the processing device, a first subset of the plurality of events associated with a first context definition;

determining a plurality of fields specified in the first context definition;

determining, for events in the first subset, field values of one or more fields specified in the first context definition;

determining, from the field values of the one or more fields specified in the first context definition, content that satisfies the content request; and

generating a response to the query that comprises the content.

2 . The method of claim 1 , further comprising:

determining a first source type associated with the first subset of the plurality of events; and

determining that the first source type is associated with the first context definition, wherein the first context definition identifies the first plurality of fields that are pertinent to context of a particular event.

3 . The method of claim 1 , wherein the first context definition has a first context type, the method further comprising:

determining a second subset of the plurality of events associated with a second context definition having a second context type;

determining a second plurality of fields specified in the second context definition;

determining, for events in the second subset, field values of one or more fields specified in the second context definition; and

determining, from the field values of the one or more fields specified in the second context definition, additional content that satisfies the content request, wherein the response to the query comprises the additional content.

4 . The method of claim 1 , wherein the content request is for content associated with a first context type, and wherein the first context definition has the first context type, the method further comprising:

determining a second subset of the plurality of events associated with a second context definition having the first context type;

determining a second plurality of fields specified in the second context definition; and

determining, for events in the second subset, field values of one or more fields specified in the second context definition, wherein the content comprises the field values of the one or more fields specified in the first context definition and the field values of the one or more fields specified in the second context definition.

5 . The method of claim 1 , wherein the requested content comprises field values of a particular field of the plurality of fields specified in the first context definition, the method further comprising:

determining the field values of the particular field from the first subset of the plurality of events wherein the content comprises the field values of the particular field.

6 . The method of claim 1 , wherein the requested content comprises most common field values, the method further comprising:

determining one or more most common field values from the field values of the one or more fields specified in the first context definition, wherein the content comprises the one or more most common field values.

7 . The method of claim 1 , wherein the requested content comprises one or more event contexts, the method further comprising:

determining an event context for each event in the first subset, each event context from events in the first subset comprising a list of key value pairs, wherein keys in the list correspond to the fields specified in the first context definition and values in the list correspond to the field values associated with the fields, and wherein the content comprises at least one determined event context.

8 . The method of claim 7 , wherein the requested content comprises a most common event context, the method further comprising:

determining a first plurality instances of a first event context, wherein the first plurality of instances of the first event context comprise matching fields and matching field values;

determining a first number of instances in the first plurality of instances of the first event context;

determining a second plurality instances of a second event context, wherein the second plurality of instances of the second event context comprise matching fields and matching field values;

determining a second number of instances in the second plurality of instances of the first event context;

determining that the first number is greater than the second number; and

determining that the first event context is the most common event context, wherein the content comprises the first event context.

9 . The method of claim 7 , wherein the requested content comprises a most relevant event context, the method further comprising:

determining a particular event context having a highest number of matching instances that are within a threshold distance in time from the time period; and

determining that the event context is the most relevant event context, wherein the content comprises the particular event context.

10 . The method of claim 1 , further comprising:

determining a source type associated with the service;

determining a response format based on the source type; and

formatting the response to correspond to the response format.

11 . A computing device comprising:

a memory; and

a processing device operatively coupled to the memory, wherein the processing device is to:

receive a query from a service, the query comprising a first field value, a time period and a content request;

perform a first search of a data store using the first field value to identify a plurality of events having the time period and at least one field that comprises the first field value;

determine a first subset of the plurality of events associated with a first context definition;

determine a plurality of fields specified in the first context definition;

determine, for events in the first subset, field values of one or more fields specified in the first context definition;

determine, from the field values of the one or more fields specified in the first context definition, content that satisfies the content request; and

generate a response to the query that comprises the content.

12 . The computing device of claim 11 , wherein the processing device is further to:

determine a first source type associated with the first subset of the plurality of events; and

determine that the first source type is associated with the first context definition, wherein the first context definition identifies the first plurality of fields that are pertinent to context of a particular event.

13 . The computing device of claim 11 , wherein the first context definition has a first context type, and wherein the processing device is further to:

determine a second subset of the plurality of events associated with a second context definition having a second context type;

determine a second plurality of fields specified in the second context definition;

determine, for events in the second subset, field values of one or more fields specified in the second context definition; and

determine, from the field values of the one or more fields specified in the second context definition, additional content that satisfies the content request, wherein the response to the query comprises the additional content.

14 . The computing device of claim 11 , wherein the content request is for content associated with a first context type, and wherein the first context definition has the first context type, and wherein the processing device is further to:

determine a second subset of the plurality of events associated with a second context definition having the first context type;

determine a second plurality of fields specified in the second context definition; and

determine, for events in the second subset, field values of one or more fields specified in the second context definition, wherein the content comprises the field values of the one or more fields specified in the first context definition and the field values of the one or more fields specified in the second context definition.

15 . The computing device of claim 11 , wherein the requested content comprises field values of a particular field of the plurality of fields specified in the first context definition, and wherein the processing device is further to:

determining the field values of the particular field from the first subset of the plurality of events wherein the content comprises the field values of the particular field.

16 . The computing device of claim 11 , wherein the requested content comprises most common field values, and wherein the processing device is further to:

determining one or more most common field values from the field values of the one or more fields specified in the first context definition, wherein the content comprises the one or more most common field values.

17 . The computing device of claim 11 , wherein the requested content comprises one or more event contexts, and wherein the processing device is further to:

determine an event context for each event in the first subset, each event context from events in the first subset comprising a list of key value pairs, wherein keys in the list correspond to the fields specified in the first context definition and values in the list correspond to the field values associated with the fields, and wherein the content comprises at least one determined event context.

18 . The computing device of claim 17 , wherein the requested content comprises a most common event context, and wherein the processing device is further to:

determine a first plurality instances of a first event context, wherein the first plurality of instances of the first event context comprise matching fields and matching field values;

determine a first number of instances in the first plurality of instances of the first event context;

determine a second plurality instances of a second event context, wherein the second plurality of instances of the second event context comprise matching fields and matching field values;

determine a second number of instances in the second plurality of instances of the first event context;

determine that the first number is greater than the second number; and

determine that the first event context is the most common event context, wherein the content comprises the first event context.

19 . The computing device of claim 17 , wherein the requested content comprises a most relevant event context, and wherein the processing device is further to:

determine a particular event context having a highest number of matching instances that are within a threshold distance in time from the time period; and

determine that the event context is the most relevant event context, wherein the content comprises the particular event context.

20 . The computing device of claim 11 , wherein the processing device is further to:

determine a source type associated with the service;

determine a response format based on the source type; and

format the response to correspond to the response format.

21 . A computer readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

receiving a query from a service, the query comprising a first field value, a time period and a content request;

performing, by the processing device, a first search of a data store using the first field value to identify a plurality of events having the time period and at least one field that comprises the first field value;

determining, by the processing device, a first subset of the plurality of events associated with a first context definition;

determining a plurality of fields specified in the first context definition;

determining, for events in the first subset, field values of one or more fields specified in the first context definition;

determining, from the field values of the one or more fields specified in the first context definition, content that satisfies the content request; and

generating a response to the query that comprises the content.