Adaptive event aggregation

1. A system, comprising:

at least one processor; and

a memory coupled with the at least one processor, wherein the memory is configured to provide the processor with instructions which when executed cause the at least one processor to:

monitor an application network using a plurality of agents;

sample a data collection into a learning buffer;

perform adaptive event aggregation to determine retaining values for an aggregation dimension using learning in an event that the learning buffer is full;

store additional events into an overflow buffer using inline aggregation;

extract an aggregated result from the learning buffer and the overflow buffer; and

generate a report of the application network based on the aggregation dimension.

2. The system recited in claim 1 , wherein performing adaptive event aggregation comprises determining the retaining values for an aggregation dimension based at least part on aggregating over events associated with monitoring the application network using the plurality of agents.

3. The system recited in claim 1 , wherein the report comprises at least one of the following: a visualization of the application network, an event monitoring report, or a network topology report.

4. The system recited in claim 1 , wherein performing adaptive event aggregation comprises performing inline learning and collection of event data.

5. The system recited in claim 1 , wherein the at least one processor is further configured to:

generate a graphical visualization of the application network based on the report indicating critical and failure events based on a success threshold.

6. The system recited in claim 1 , wherein the at least one processor further configured to:

generate a graphical visualization of a topology of the application network.

7. The system of claim 1 , wherein to sample a data collection into a learning buffer, the at least one processor is configured to:

copy event records comprising keys and metrics into the learning buffer until the learning buffer reaches a size limit, wherein the event records detail API call events in the application network, and wherein the metrics are aggregated in the learning buffer based on the aggregation dimension.

8. The system of claim 1 , wherein the retaining values specify a number of values to keep in the learning buffer for the aggregation dimension.

9. The system of claim 1 , wherein to store additional events into an overflow buffer using inline aggregation, the at least one processor is configured to:

receive an additional event record after the learning buffer reaches the size limit; and

copy the additional event record into the overflow buffer when the additional event record does not match the aggregation dimensions in the learning buffer, wherein a value in the additional event record is replaced with a special token when the value is not found in the retaining values.

10. The system of claim 1 , where to the at least one processor further configured to:

generate a graphical visualization of the application network based on the aggregate result, wherein the graphical visualization further indicates a number of API calls between applications in the application network.

11. A method comprising:

monitoring an application network using a plurality of agents;

sampling a data collection into a learning buffer;

performing adaptive event aggregation to determine retaining values for an aggregation dimension using learning in an event that the learning buffer is full;

storing additional events into an overflow buffer using inline aggregation;

extracting an aggregate result from the learning buffer and the overflow buffer; and

generating a report of the application network based on the aggregation dimension.

12. The method of claim 11 , the sampling further comprising:

copying event records comprising keys and metrics into the learning buffer until the learning buffer reaches a size limit, wherein the event records detail API call events in the application network, and wherein the metrics are aggregated in the learning buffer based on the aggregation dimension.

13. The method of claim 11 , wherein the retaining values specify a number of values to keep in the learning buffer for the aggregation dimension.

14. The method of claim 11 , the storing further comprising:

receiving an additional event record after the learning buffer reaches the size limit; and

copying the additional event record into the overflow buffer when the additional event record does not match the aggregation dimensions in the learning buffer, wherein a value in the additional event record is replaced with a special token when the value is not found in the retaining values.

15. The method of claim 11 , further comprising:

generating a graphical visualization of the application network based on the aggregate result, wherein the graphical visualization further indicates a number of API calls between applications in the application network.

16. A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:

monitoring an application network using a plurality of agents;

sampling a data collection into a learning buffer;

performing adaptive event aggregation to determine retaining values for an aggregation dimension using learning in an event that the learning buffer is full;

storing additional events into an overflow buffer using inline aggregation;

extracting an aggregate result from the learning buffer and the overflow buffer; and

generating a report of the application network based on the aggregation dimension.

17. The non-transitory computer-readable device of claim 16 , the sampling comprising:

copying event records comprising keys and metrics into the learning buffer until the learning buffer reaches a size limit, wherein the event records detail API call events in the application network, and wherein the metrics are aggregated in the learning buffer based on the aggregation dimension.

18. The non-transitory computer-readable device of claim 16 , wherein the retaining values specify a number of values to keep in the learning buffer for the aggregation dimension.

19. The non-transitory computer-readable device of claim 16 , the storing comprising:

receiving an additional event record after the learning buffer reaches the size limit; and

copying the additional event record into the overflow buffer when the additional event record does not match the aggregation dimensions in the learning buffer, wherein a value in the additional event record is replaced with a special token when the value is not found in the retaining values.

20. The non-transitory computer-readable device of claim 16 , the operations further comprising:

generating a graphical visualization of the application network based on the aggregate result, wherein the graphical visualization further indicates a number of API calls between applications in the application network.