Systems and methods for in-memory processing of events

1. A method implemented by a physical processor executing machine readable instructions for in-memory processing of events, the method comprising:

determining a set of unique elements of a plurality of queries, wherein each query of the plurality of queries is executed on a defined schedule and a tune duration;

receiving, at a local memory of a computing device, a plurality of events in an event stream;

filtering the plurality of events using the set of unique elements:

for each query of the plurality of queries, determining a query result for each filtered event of the plurality of events; and

for each query of the plurality of queries, providing in-memory aggregation of the query result of each filtered event.

2. The method of claim 1 , wherein the set of unique elements includes a unique computed field.

3. The method of claim 1 , wherein determining the set of unique elements comprises:

determining a computed field of a first query of the plurality of queries and a computed field of a second query of the plurality of queries are identical.

4. The method of claim 1 , further comprising:

for each query of the plurality of queries, storing an aggregated query result in a persistent storage.

5. The method of claim 1 , wherein determining the set of unique elements comprises:

determining a filter tree for a first query of the plurality of queries, wherein the filter tree for the first query includes a set of unique elements of the first query;

determining a filter tree for a second query of the plurality of queries, wherein the filter tree for the second query includes a set of unique elements of the second query; and

combining the filter tree for the first query with the filter tree of the second query.

6. The method of claim 1 , further comprising:

generating a plurality of data checkpoints, wherein each checkpoint includes an in-memory running value of an aggregated query result;

detecting a shut-down of the computing device; and

restoring the computing device to a previous state using a data checkpoint of the plurality of checkpoints.

7. The method of claim 6 , wherein restoring the computing device further comprises:

loading the data checkpoint of the plurality of checkpoints to the local memory of the computing device; and

determining whether the computing device is fully restored to the previous state.

8. The method of claim 7 , further comprising:

obtaining events of interest from a persistent storage where it is determined the computing device is not fully restored;

filtering the events of interest using the set of unique elements;

for each query of the plurality of queries, determining a query result for each filtered event of interest; and

for each query of the plurality of queries, providing in-memory aggregation of the query result of each filtered event of interest.

9. A system for processing events, the system comprising:

a persistent store for storage of aggregated query results; and

a computer that includes:

a memory for in-memory aggregation of query results; and

a physical processor that implements machine readable instructions that cause the computer to:

determine a set of unique elements of a plurality of queries, wherein each query of the plurality of queries is executed on a defined schedule and a time duration;

receive a plurality of events in an event stream;

filter the plurality of events using the set of unique elements;

for each query of the plurality of queries, determine a query result for each filtered event of the plurality of events; and

for each query of the plurality of queries, provide in-memory aggregation of the query result of each filtered event.

10. The system of claim 9 , wherein the persistent store includes the plurality of events, and wherein the physical processor implements machine readable instructions to cause the computer to:

select a query of the plurality of queries; and

execute the selected query on the plurality of events in the persistent store.

11. The system of claim 9 , wherein determining the set of unique elements comprises:

determining a computed field of a first query of the plurality of queries and a computed field of a second query of the plurality of queries are identical.

12. The system of claim 9 , wherein for each query of the plurality of queries, an aggregated query result is stored in the persistent store.

13. A non-transitory computer-readable medium storing a plurality of instructions to control a data processor to process events, the plurality of instructions comprising instructions that cause the data processor to:

determine a set of unique elements of a plurality of queries, wherein each query of the plurality of queries is executed on a defined schedule and a time duration;

receive, at a local memory of a computing device, a plurality of events in an event stream;

filter the plurality of events using the set of unique elements;

for each query of the plurality of queries, determine a query result for each filtered event of the plurality of events; and

for each query of the plurality of queries, provide in-memory aggregation of the query result of each filtered event.

14. The non-transitory computer-readable medium of claim 13 , wherein the set of unique elements includes a unique computed field.

15. The non-transitory computer-readable medium of claim 13 , wherein the instructions that cause the data processor to determine the set of unique elements comprise instructions that cause the data processor to determine a computed field of a first query of the plurality of queries and a computed field of a second query of the plurality of queries are identical.