Grouping evens into episodes using a streaming data processor
Systems and methods are described for using a streaming data processor to group notable events reflecting operation of a computing system into episodes of related events reflecting an incident on the computing system, such as to enable root cause analysis of the incident. Each notable event can be generated based on one or more events detected within raw machine data. The streaming data processor can ingest a data stream of notable events, and apply a clustering algorithm to the events to cluster those events into episodes. When the episodes satisfy an action rule, the streaming data processor can take an action appropriate to that rule, such as transmitting an alert or programmatically altering operation of the computing system. The streaming data processor can utilize feedback as to the grouping of events into episodes to modify the clustering algorithm and improve accuracy of clustering.
1. A computer-implemented method comprising:
obtaining a data stream containing a set of events, each event representing machine data generated based on operation of a computing system;
passing individual events of the data stream through a streaming data processor configured to group events from the data stream into episodes, each episode corresponds to a subset of events grouped together according to similarities between events of the subset, wherein passing individual events of the data stream through the streaming data processor comprises:
comparing attributes of an individual event to aggregate attributes of an existing episode, the aggregate attributes representing an aggregation of attributes of events within the existing episode;
determining whether attributes of the individual event are within a threshold similarity level to the aggregate attributes; and
responsive to determining that the attributes of the individual event are not within the threshold similarity level, generating an additional episode including the individual event; and
outputting the events grouped into episodes as a record of operation of the computing system.
2. The computer-implemented method of claim 1 , wherein attributes of the individual event include one or more of: raw text of the event, a timestamp of the event, one or more field values of the event, a source of the event, or a source type of the event.
3. The computer-implemented method of claim 1 , wherein aggregate attributes of the existing episode include one or more of an average of numerical attribute value of events within the existing episode or a count vector of a non-numerical attribute value of events within the existing episode.
4. The computer-implemented method of claim 1 , wherein the threshold similarity level is a distance in n-dimensional space between a first point representing the attributes of the individual event and a second point representing the aggregate attributes of events within the existing episode.
5. The computer-implemented method of claim 1 , wherein the threshold similarity level corresponds to a distance in n-dimensional space between a first point representing the attributes of the individual event and a second point representing a centroid of events within the existing episode, wherein the centroid is determined based on the aggregate attributes.
6. The computer-implemented method of claim 1 , wherein passing individual events of the data stream through the streaming data processor further comprises:
comparing attributes of a second individual event to aggregate attributes of the existing episode;
determining whether attributes of the second individual event are within the threshold similarity level to the aggregate attributes; and
responsive to determining that the attributes of the second individual event are within the threshold similarity level, adding the second individual event to the existing episode.
7. A system comprising:
a data store including computer-executable instructions; and
a processor configured to execute the computer-executable instructions, wherein execution of the computer-executable instructions causes the processor to:
obtain a data stream containing a set of events, each event representing machine data generated based on operation of another computing system;
pass individual events of the data stream through a streaming data processor configured to group events from the data stream into episodes, each episode corresponds to a subset of events grouped together according to similarities between events of the subset, wherein passing individual events of the data stream through the streaming data processor comprises:
comparing attributes of an individual event to aggregate attributes of an existing episode, the aggregate attributes representing an aggregation of attributes of events within the existing episode;
determining whether attributes of the individual event are within a threshold similarity level to the aggregate attributes; and
responsive to determining that the attributes of the individual event are not within the threshold similarity level, generating an additional episode including the individual event; and
output the events grouped into episodes as a record of operation of the computing system.
8. The system of claim 7 , wherein passing individual events of the data stream through the streaming data processor further comprises:
comparing attributes of a second individual event to aggregate attributes of the existing episode;
determining whether attributes of the second individual event are within the threshold similarity level to the aggregate attributes; and
responsive to determining that the attributes of the second individual event are within the threshold similarity level, adding the second individual event to the existing episode.
9. The system of claim 7 , wherein passing individual events of the data stream through the streaming data processor further comprises:
comparing attributes of a second individual event to aggregate attributes of the existing episode;
determining whether attributes of the second individual event are within the threshold similarity level to the aggregate attributes; and
responsive to determining that the attributes of the second individual event are within the threshold similarity level, adding the second individual event to the existing episode; and
wherein execution of the computer-executable instructions further cause the processor to:
obtain feedback approving of inclusion of the second individual event within the existing episode; and
decrease the threshold similarity level.
10. The system of claim 7 , wherein passing individual events of the data stream through the streaming data processor further comprises:
comparing attributes of a second individual event to aggregate attributes of the existing episode;
determining whether attributes of the second individual event are within the threshold similarity level to the aggregate attributes; and
responsive to determining that the attributes of the second individual event are within the threshold similarity level, adding the second individual event to the existing episode; and
wherein execution of the computer-executable instructions further cause the processor to:
obtain feedback disapproving of inclusion of the second individual event within the existing episode; and
increase the threshold similarity level.
11. The system of claim 7 , wherein execution of the computer-executable instructions further cause the processor to:
detect that the existing episode satisfies criteria of an action rule indicating an action to be taken by the system on satisfaction of the criteria; and
execute the action, wherein the action comprises at least one of transmitting an alert or programmatically altering operation of the other computing system.
12. The system of claim 7 , wherein execution of the computer-executable instructions further cause the processor to:
detect that the existing episode satisfies criteria of an action rule indicating an action to be taken by the system on satisfaction of the criteria; and
execute the action, wherein the action comprises at least one of transmitting an alert or programmatically altering operation of the other computing system;
wherein the criteria of the action rule specify at least one of: a number of events within the existing episode required to satisfy the action rule or a field value of an event within the existing episode required to satisfy the action rule.
13. One or more non-transitory computer-readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to:
obtain a data stream containing a set of events, each event representing machine data generated based on operation of another computing system;
pass individual events of the data stream through a streaming data processor configured to group events from the data stream into episodes, each episode corresponds to a subset of events grouped together according to similarities between events of the subset, wherein passing individual events of the data stream through the streaming data processor comprises:
comparing attributes of an individual event to aggregate attributes of an existing episode, the aggregate attributes representing an aggregation of attributes of events within the existing episode;
determining whether attributes of the individual event are within a threshold similarity level to the aggregate attributes; and
responsive to determining that the attributes of the individual event are not within the threshold similarity level, generating an additional episode including the individual event; and
output the events grouped into episodes as a record of operation of the computing system.
14. The one or more non-transitory computer-readable media of claim 13 , wherein events within the set of events are notable events generated from input events detected within raw machine data.
15. The one or more non-transitory computer-readable media of claim 13 , wherein events within the set of events are notable events generated by searching indexed machine data events to determine whether the indexed machine data events satisfy criteria for generating the notable events.
16. The one or more non-transitory computer-readable media of claim 13 , wherein events within the set of events are notable events generated by passing machine data events through the streaming data processor to determine whether the machine data events satisfy criteria for generating the notable events.
17. The one or more non-transitory computer-readable media of claim 13 , wherein the computer-executable instructions are represented as a processing pipeline implemented on the streaming data processor.
18. The one or more non-transitory computer-readable media of claim 13 , wherein execution of the computer-executable instructions further cause the computing system to:
detect that the existing episode satisfies criteria of an action rule indicating an action to be taken by the system on satisfaction of the criteria; and
execute the action, wherein the action comprises at least one of transmitting an alert or programmatically altering operation of the other computing system.
19. The one or more non-transitory computer-readable media of claim 13 , wherein comparing attributes of the individual event to aggregate attributes of the existing episode comprises passing the attributes of the individual event through a trained machine learning (ML) model.
20. The one or more non-transitory computer-readable media of claim 13 , wherein comparing attributes of the individual event to aggregate attributes of the existing episode comprises passing the attributes of the individual event through a trained machine learning (ML) model generated based on a clustering algorithm.