Real-time processing of data streams received from instrumented software
An analysis system receives data streams generated by instances of instrumented software executing on external systems. The analysis system evaluates an expression using data values of the data streams over a plurality of time intervals. For example, the analysis system may aggregate data values of data streams for each time interval. The analysis system determines whether or not a data stream is considered for a time interval based on when the data value arrives during the time interval. The analysis system determines a maximum expected delay value for each data stream being processed. The analysis system evaluates the expression using data values that arrive before their maximum expected delay values. The analysis system also determines a failure threshold value for a data stream. If a data value of a data stream fails to arrive before the failure threshold value, the analysis system marks the data stream as dead.
1. A computer-implemented method for processing data generated by instrumented software, the method comprising: determining, for a time interval of a plurality of time intervals, a failure threshold value for a data stream based on a type of a data source sending the data stream, the failure threshold value indicating that the instrumented software sending the data stream has failed; monitoring the data stream for data values for the time interval; marking the data stream as dead data if the data values from the data stream fail to arrive before the failure threshold value; excluding the data stream from sets of data streams considered for subsequent time intervals until a next data value arrives for the data stream; marking the data stream as alive when the next data value of the data stream is received; evaluating an expression using the data values of the data stream, the expression processing the data values of the data stream; and sending a result of evaluating the expression for presentation through a user interface.
2. The computer-implemented method of claim 1 , further comprising: storing data values of data streams that arrive after a maximum expected delay value in a persistent data store.
3. The computer-implemented method of claim 1 , further comprising: determining, for the time interval of the plurality of time intervals, a maximum expected delay value for the data stream.
4. The computer-implemented method of claim 1 , further comprising: excluding the data stream marked dead from the set of data streams monitored for arrival of data values for one or more subsequent time intervals.
5. The computer-implemented method of claim 1 , further comprising: receiving a specification of the expression for processing data values of a plurality of data streams associated with the time interval.
6. The computer-implemented method of claim 1 , further comprising: configuring results of evaluation of the expression for presentation by a real-time chart that is updated for every time interval.
7. The computer-implemented method of claim 1 , further comprising: receiving, by an analysis system, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on an external system.
8. The computer-implemented method of claim 1 , wherein the expression aggregates the data values of the set of data streams, the data values associated with the time interval.
9. The computer-implemented method of claim 1 , wherein a maximum expected delay value is determined based on historical arrival delays of data values of the data stream.
10. The computer-implemented method of claim 1 , wherein a maximum expected delay value for the time interval is determined based on an arrival delay of the data value of the data stream for a previous time interval.
11. A system for processing data generated by instrumented software, the system comprising: at least one memory having instructions stored thereon; and at least one processor configured to execute the instructions, wherein the at least one processor is configured to: determine, for a time interval of a plurality of time intervals, a failure threshold value for a data stream, based on a type of a data source sending the data stream, the failure threshold value indicating that the instrumented software sending the data stream has failed; monitor the data stream for data values for the time interval; mark the data stream as dead data if the data values from the data stream fail to arrive before the failure threshold value; exclude the data stream from sets of data streams considered for subsequent time intervals until a next data value arrives for the data stream; mark the data stream as alive when the next data value of the data stream is received; evaluate an expression using the data values of the data stream, the expression processing the data values of the data stream; and send a result of evaluating the expression for presentation through a user interface.
12. The system of claim 11 , further configured to: store data values of data streams that arrive after a maximum expected delay value in a persistent data store.
13. The system of claim 11 , further configured to: determine, for the time interval of the plurality of time intervals, a maximum expected delay value for the data stream.
14. The system of claim 11 , further configured to: exclude the data stream marked dead from the set of data streams monitored for arrival of data values for one or more subsequent time intervals.
15. The system of claim 11 , further configured to: receive a specification of the expression for processing data values of a plurality of data streams associated with the time interval.
16. The system of claim 11 , further configured to: configure results of evaluation of the expression for presentation by a real-time chart that is updated for every time interval.
17. The system of claim 11 , further configured to: receive, by an analysis system, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on an external system.
18. The system of claim 11 , wherein the expression aggregates the data values of the set of data streams, the data values associated with the time interval.
19. The system of claim 11 , wherein a maximum expected delay value is determined based on historical arrival delays of data values of the data stream.
20. The system of claim 11 , wherein a maximum expected delay value for the time interval is determined based on an arrival delay of the data value of the data stream for a previous time interval.
21. A non-transitory computer-readable storage medium comprising instructions stored thereon, which when executed by one or more processors, cause the one or more processors to perform operations for processing data generated by instrumented software, comprising: determining, for a time interval of a plurality of time intervals, a failure threshold value for a data stream, based on a type of a data source sending the data stream, the failure threshold value indicating that the instrumented software sending the data stream has failed; monitoring the data stream for data values for the time interval; marking the data stream as dead data if the data values from the data stream fail to arrive before the failure threshold value; excluding the data stream from sets of data streams considered for subsequent time intervals until a next data value arrives for the data stream; marking the data stream as alive when the next data value of the data stream is received; evaluating an expression using the data values of the data stream, the expression processing the data values of the data stream; and sending a result of evaluating the expression for presentation through a user interface.
22. The non-transitory computer-readable storage medium of claim 21 , further configured for: storing data values of data streams that arrive after a maximum expected delay value in a persistent data store.
23. The non-transitory computer-readable storage medium of claim 21 , further configured for: determining, for the time interval of the plurality of time intervals, a maximum expected delay value for the data stream.
24. The non-transitory computer-readable storage medium of claim 21 , further configured for: excluding the data stream marked dead from the set of data streams monitored for arrival of data values for one or more subsequent time intervals.
25. The non-transitory computer-readable storage medium of claim 21 , further configured for: receiving a specification of the expression for processing data values of a plurality of data streams associated with the time interval.
26. The non-transitory computer-readable storage medium of claim 21 , further configured for: configuring results of evaluation of the expression for presentation by a real-time chart that is updated for every time interval.
27. The non-transitory computer-readable storage medium of claim 21 , further configured for: receiving, by an analysis system, from one or more external systems, information identifying a plurality of data streams, each data stream generated by an instance of instrumented software executing on an external system.
28. The non-transitory computer-readable storage medium of claim 21 , wherein the expression aggregates the data values of the set of data streams, the data values associated with the time interval.
29. The non-transitory computer-readable storage medium of claim 21 , wherein a maximum expected delay value is determined based on historical arrival delays of data values of the data stream.
30. The non-transitory computer-readable storage medium of claim 21 , wherein a maximum expected delay value for the time interval is determined based on an arrival delay of the data value of the data stream for a previous time interval.