Event processing method, system, electronic device, and computer-readable medium

Abstract

The present application discloses an event processing method, system, electronic device, and computer-readable medium. When the system includes at least a first computing node and a second computing node, the working principle of the system is as follows: after obtaining the event to be processed, the first computing node first performs group key extraction processing on the event to be processed using a rule matching granularity key extractor corresponding to at least one candidate rule to obtain the group key of the event to be processed; then the first computing node sends the event to be processed and the group key to the second computing node, so that the second computing node can subsequently process the event to be processed based on the group key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule, so as to achieve the purpose of running multiple CEP rules simultaneously in the system, thereby effectively improving the event processing performance of the system.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an event processing method, system, electronic device, and computer-readable medium. Background Art

[0002] Complex Event Processing (CEP) is an analysis technology based on event streams in a dynamic environment. Events here are usually meaningful state changes. By analyzing the relationship between events, using filtering, association, aggregation and other technologies, and formulating query rules based on the temporal relationship and aggregation relationship between events, we can continuously query the event sequence that meets the requirements from the event stream, and finally analyze more complex compound events.

[0003] In addition, CEP can generally involve three aspects: event sequence matching, event combination matching, and event window aggregation. Among them, the event sequence matching refers to finding a certain event sequence from a disorganized event stream (for example, a sequence of a first event followed by a preset number of second events, followed by a third event once). The event combination matching refers to finding a certain event combination from the event stream (for example, a combination of the first event or the second event). The event window aggregation refers to whether the first event exists among the N adjacent events continuously extracted from the event stream. N is a positive integer, and N represents the window size.

[0004] In addition, in some application fields, the event stream can usually be analyzed and processed with the help of pre-configured CEP rules. Among them, CEP rules can usually include three core elements: rule matching granularity, rule matching logic, and rule matching result processing logic. The rule matching granularity is usually used to aggregate events with the same attributes for analysis (for example, events occurring at the same location, the price of the same stock, etc.), so that the rule matching granularity can indicate which attribute (for example, location or stock identification, etc.) is used to group the event stream. The rule matching logic refers to the logic for sequence matching for event sequences (for example, from the event sequence of "event 1→event 2→event 4→event 9→event 1", detect whether there is a sequence of "event 2→event 4→event 1"). The rule matching result processing logic refers to the logic for processing the results determined based on the rule matching logic (for example, after matching the sequence of "event 2→event 4→event 1", calculate the time interval between event 2→event 1, etc.).

[0005] However, due to defects in the execution process of CEP rules in some execution systems (for example, Flink system), the event processing performance of the system is not very good. Summary of the invention

[0006] In order to solve the above technical problems, the present application provides an event processing method, system, electronic device, and computer-readable medium, which can improve event processing performance.

[0007] In order to achieve the above objectives, the technical solutions provided by this application are as follows:

[0008] The present application provides an event processing method, the method is applied to an event processing system, the event processing system includes a first computing node and a second computing node;

[0009] The method comprises:

[0010] After obtaining the event to be processed, the first computing node uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain a group key of the event to be processed;

[0011] The first computing node sends the event to be processed and the grouping key to the second computing node;

[0012] The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule.

[0013] In a possible implementation, the first computing node includes at least one first computing unit; the first computing unit includes a rule matching granularity key extractor corresponding to the at least one candidate rule; the second computing node includes at least one second computing unit; the second computing unit includes a rule matching logic executor corresponding to the at least one candidate rule and a rule matching result processing logic executor corresponding to the at least one candidate rule;

[0014] The first computing node uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed, including:

[0015] The first target unit in the at least one first computing unit uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed;

[0016] The first computing node sends the event to be processed and the grouping key to the second computing node, including:

[0017] The first target unit sends the event to be processed and the grouping key to a second target unit in the at least one second computing unit;

[0018] The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule, including:

[0019] The second target unit processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule.

[0020] In one possible implementation, the second target unit has processed at least one event to be referenced within a historical time period; the grouping key of the event to be referenced is the same as the grouping key of the event to be processed; and the end time of the historical time period is no later than the acquisition time of the event to be processed.

[0021] In a possible implementation manner, the method further includes:

[0022] The first computing node uses the rule event filter corresponding to the at least one candidate rule to filter the event to be processed to obtain a filtering result of the event to be processed;

[0023] The first computing node uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed, including:

[0024] If the screening processing result indicates that the event to be processed satisfies the event screening condition corresponding to the target rule in the at least one candidate rule, the first computing node uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed;

[0025] The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule, including:

[0026] The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

[0027] In a possible implementation, the first computing node includes at least one first computing unit; the first computing unit includes a rule event filter corresponding to the at least one candidate rule and a rule matching granularity key extractor corresponding to the at least one candidate rule; the second computing node includes at least one second computing unit; the second computing unit includes a rule matching logic executor corresponding to the at least one candidate rule and a rule matching result processing logic executor corresponding to the at least one candidate rule;

[0028] The first computing node uses the rule event filter corresponding to the at least one candidate rule to filter the event to be processed to obtain a filtering result, including:

[0029] The third target unit in the at least one first computing unit uses the rule event filter corresponding to the at least one candidate rule to filter the event to be processed to obtain a filtering result;

[0030] The first computing node uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed, including:

[0031] The third target unit uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed;

[0032] The first computing node sends the event to be processed and the grouping key to the second computing node, including:

[0033] The third target unit sends the event to be processed and the group key to the second target unit in the at least one second computing unit;

[0034] The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule, including:

[0035] The second target unit processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

[0036] In one possible implementation, the second target unit has processed at least one event to be referenced within a historical time period; the grouping key of the event to be referenced is the same as the grouping key of the event to be processed, and the screening processing result of the event to be referenced is the same as the screening processing result of the event to be processed; and the end time of the historical time period is no later than the acquisition time of the event to be processed.

[0037] In a possible implementation, the number of the target rules is M, where M is a positive integer.

[0038] In a possible implementation manner, the event processing system further includes a rule updating unit;

[0039] The method further comprises:

[0040] After acquiring the rule event filter corresponding to the rule to be used, the rule updating unit sends the rule event filter corresponding to the rule to be used to each of the first computing units; each of the first computing units updates the rule event filter corresponding to the at least one candidate rule using the rule event filter corresponding to the rule to be used;

[0041] After obtaining the rule matching granularity key extractor corresponding to the rule to be used, the rule updating unit sends the rule matching granularity key extractor corresponding to the rule to be used to each of the first computing units; each of the first computing units updates the rule matching granularity key extractor corresponding to the at least one candidate rule using the rule matching granularity key extractor corresponding to the rule to be used;

[0042] After acquiring the rule matching logic executor corresponding to the rule to be used, the rule updating unit sends the rule matching logic executor corresponding to the rule to be used to each of the second computing units; each of the second computing units updates the rule matching logic executor corresponding to the at least one candidate rule using the rule matching logic executor corresponding to the rule to be used;

[0043] After obtaining the rule matching result processing logic executor corresponding to the rule to be used, the rule updating unit sends the rule matching result processing logic executor corresponding to the rule to be used to each second computing unit; each second computing unit uses the rule matching result processing logic executor corresponding to the rule to be used to update the rule matching result processing logic executor corresponding to the at least one candidate rule.

[0044] The present application also provides an event processing system, the event processing system comprising a first computing node and a second computing node;

[0045] The first computing node is used to, after acquiring the event to be processed, perform group key extraction processing on the event to be processed using a rule matching granularity key extractor corresponding to at least one candidate rule to obtain the group key of the event to be processed;

[0046] The first computing node is further configured to send the event to be processed and the grouping key to the second computing node;

[0047] The second computing node is used to process the event to be processed according to the grouping key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule.

[0048] The present application also provides an electronic device, the device comprising: a processor and a memory;

[0049] The memory is used to store instructions or computer programs;

[0050] The processor is used to execute the instructions or computer programs in the memory so that the electronic device executes the event processing method provided in the present application.

[0051] The present application also provides a computer-readable medium, in which instructions or computer programs are stored. When the instructions or computer programs are executed on a device, the device executes the event processing method provided by the present application.

[0052] The present application provides a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program codes for executing the event processing method provided by the present application.

[0053] Compared with the prior art, this application has at least the following advantages:

[0054] For the event processing system provided in the present application (for example, the Flink system), when the system includes at least a first computing node and a second computing node, the system can use these two nodes to complete the CEP processing process for the event stream, and the working principle of the system is as follows: after obtaining the event to be processed (for example, a newly generated event in the event stream), the first computing node first uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; then the first computing node sends the event to be processed and the group key to the second computing node, so that the second computing node can subsequently process the event to be processed based on the group key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule, so as to achieve the purpose of running multiple CEP rules in the system at the same time, thereby effectively improving the event processing performance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0056] Figure 1 A schematic diagram of an NFA provided in an embodiment of the present application;

[0057] Figure 2 A schematic diagram of the working principle of an event processing system provided in an embodiment of the present application;

[0058] Figure 3 A flowchart of an event processing method provided in an embodiment of the present application;

[0059] Figure 4 A schematic diagram of the working principle of another event processing system provided in an embodiment of the present application;

[0060] Figure 5 A schematic diagram of the structure of an event processing system provided in an embodiment of the present application;

[0061] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to better understand the technical solution of the present application, some technical terms involved in the present application are introduced below.

[0063] A nondeterministic finite automaton (NFA) is a finite state automaton that can have multiple possible next states for each state and input symbol pair. In addition, NFA can be used to implement the rule matching logic configured for a CEP rule. The specific implementation process can be: for the rule matching logic configured for a CEP rule, the rule matching logic can be parsed and compiled to obtain a series of state vertices and edges of state transfer between these vertices, so that these vertices and edges can be used to construct the NFA corresponding to the CEP rule (for example, Figure 1 As an example, when the CEP matching rule is the rule of "complete event 1, then complete event 2", the NFA generated based on the CEP matching rule is Figure 1 The NFA shown in the figure has the following specific meaning: after obtaining event 1, the state machine jumps to the state of completing event 1. At this time, the state machine has two jump modes (non-deterministic): after obtaining other events (not event 2), the state machine keeps the current state unchanged; but after obtaining event 2, the state machine jumps to the state of successful matching, so that the matching can be completed.

[0064] Flink refers to a framework and distributed processing engine, and Flink can be used for stateful computations on unbounded and bounded data streams. In addition, Flink is designed to run in all common cluster environments, performing computations at in-memory execution speeds and at any scale. In addition, Flink can be used to implement CEP rules.

[0065] Flink CEP refers to the complex event processing library in Flink, so that Flink can implement analysis and processing based on a series of behavioral information (events) based on the complex event processing library. For example, by analyzing the relationship between events: timing relationship, time interval, progressive relationship, and aggregation relationship, it can continuously query the event sequence that meets the requirements from the event stream, and finally obtain more complex composite events.

[0066] Based on the relevant contents of the above technical terms, the relevant contents of the technical solution of this application are introduced below.

[0067] In fact, for the Flink system, in some application scenarios, the system can implement CEP rules in the way of "one CEP rule corresponds to one Flink task". For ease of understanding, the following is combined with Figure 2 Provide explanation.

[0068] As an example, Figure 2As shown, the specific process of executing the CEP rule by the Flink system includes the following steps 1 to 6.

[0069] Step 1: Relevant personnel develop Flink code to define the rule matching granularity, rule matching logic, and rule matching result processing logic of a CEP rule.

[0070] Step 2: Compile the Flink code to obtain the event grouping key extractor, NFA component, and rule matching result processing function corresponding to the CEP rule, and submit the event grouping key extractor, NFA component, and rule matching result processing function as a Flink task. The event grouping key extractor is used to perform grouping key extraction processing for an event according to the rule matching granularity of the CEP rule; the NFA component is used to implement the rule matching logic of the CEP rule; and the rule matching result processing function is used to process the matching result determined based on the rule matching logic.

[0071] Step 3: When the Flink system is executing the above Flink task, the system continuously reads events from the event stream, calls the above event grouping key extractor to extract the grouping key corresponding to each event, and constructs the corresponding tuple <the event, the grouping key corresponding to the event> based on the grouping key corresponding to the event and the event.

[0072] Step 4: Hash group the above events according to the grouping key corresponding to the event, and send the events with the same grouping key to the same CEP rule calculation unit for rule matching calculation. The CEP rule calculation unit includes the above NFA component and the rule matching result processing function.

[0073] Step 5: After the CEP rule calculation unit receives the above event, the above NFA component processes the event according to the above rule matching logic and saves the matched intermediate result.

[0074] Step 6: When the NFA component above determines that the match is completed, the rule matching result processing function is called to process the stored matching results to obtain the event processing result for the event stream.

[0075] Based on the above Figure 2From the relevant content, we can know that for the Flink system, because the system will independently develop and deploy a set of rule matching codes for each business scenario based on the rule requirements of each business scenario, this will lead to relatively low development efficiency of the system; and because the system executes CEP rules in the manner of "1 CEP rule corresponds to 1 Flink task", as the number of CEP rules increases, the number of Flink tasks will become very large, which will bring huge task operation and maintenance costs to the system, all of which are likely to affect the event processing performance of the system.

[0076] Based on the relevant content of the above-mentioned Flink system, in order to solve the technical problems shown in the background technology part, an embodiment of the present application provides an event processing method applied to an event processing system (for example, a Flink system). When the event processing system includes at least a first computing node and a second computing node, the method includes: after obtaining the event to be processed (for example, a newly generated event in the event stream), the first computing node first uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; then the first computing node sends the event to be processed and the group key to the second computing node, so that the second computing node can subsequently process the event to be processed according to the group key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule, so as to achieve the purpose of running multiple CEP rules in the system at the same time, thereby effectively improving the event processing performance of the system.

[0077] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0078] In order to better understand the technical solution provided by this application, the event processing method provided by this application is described below with reference to some drawings. Figure 3 As shown, when the event processing system includes a first computing node and a second computing node, the event processing method applied to the event processing system provided in the embodiment of the present application includes the following S1-S3.

[0079] S1: After obtaining an event to be processed, the first computing node uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain a group key of the event to be processed.

[0080] Among them, the event processing system is used to perform event processing on the event stream according to some CEP rules; and the embodiment of the present application does not limit the event processing system, for example, it can be a Flink system.

[0081] In addition, the event processing system may include at least a first computing node and a second computing node. The first computing node is at least used to determine a grouping key of an event; and the embodiment of the present application does not limit the first computing node, for example, it may be Figure 4 The node with event preprocessing function in the Flink system shown in FIG. The second computing node is used to perform some processing on the event according to the grouping key determined by the first computing node (for example, processing based on rule matching logic, and processing based on rule matching result processing logic, etc.); and the embodiment of the present application does not limit the second computing node, for example, it can be Figure 4 The node with CEP rule matching function in the Flink system shown. It should be noted that in order to better understand the event processing system, the following is explained in conjunction with the relevant content of the event processing method provided by this application (for example, S1-S3 or steps 11-14 below).

[0082] The pending event refers to an event obtained from the event stream; and the embodiments of the present application do not limit the pending event. For example, in some application scenarios (for example, when real-time processing is performed on events in the event stream), the pending event may refer to a newly generated event in the event stream. It should be noted that the embodiments of the present application do not limit the method for obtaining the above-mentioned pending events.

[0083] The i-th candidate rule refers to the CEP rule pre-configured for the Flink system (for example, Figure 4 Rule A or Rule B shown). Wherein, i is a positive integer, i≤I, I is a positive integer, and I represents the number of the above “at least one candidate rule”.

[0084] The rule matching granularity key extractor corresponding to the i-th candidate rule refers to the rule matching granularity key extractor obtained by compiling (or parsing) the i-th candidate rule, so that the "rule matching granularity key extractor corresponding to the i-th candidate rule" is used to extract the grouping key of an event according to the rule matching granularity configured for the i-th candidate rule (that is, Figure 4 The “matching granularity key” shown in the figure) is used to make the grouping key represent a certain attribute of the event, so that some processing (such as hash grouping processing, etc.) can be performed based on the grouping key later. Wherein, i is a positive integer, i≤I, and I is a positive integer.

[0085] The above “grouping key of the event to be processed” refers to the extraction and processing result of the grouping key of the event to be processed, so that the “grouping key of the event to be processed” can represent a certain attribute of the event, so that some processing (for example, hash grouping processing, etc.) can be performed on the event to be processed based on the “grouping key of the event to be processed”. It should be noted that the embodiment of the present application does not limit the determination process of the above “grouping key of the event to be processed”.

[0086] In fact, in order to better improve the event processing effect, the embodiment of the present application also provides a possible implementation of the above-mentioned first computing node. In this implementation, the first computing node includes at least one first computing unit, and each first computing unit includes the above-mentioned "rule matching granularity key extractor corresponding to at least one candidate rule" (for example, the extractor is pre-stored in each first computing unit), so that each first computing unit can be used to determine the grouping key of an event.

[0087] Based on this, the embodiment of the present application also provides a possible implementation of S1 above. In this implementation, when the first computing node above includes at least one first computing unit, S1 can be specifically as follows: after obtaining the event to be processed, the first target unit in the at least one first computing unit uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed, and obtains the group key of the event to be processed. Among them, the first target unit refers to the first computing unit used to perform group key extraction processing on the event to be processed; and the embodiment of the present application does not limit the determination process of the first target unit. For example, it can be implemented by any existing or future method that can select a computing unit for data processing from a distributed system.

[0088] Based on the relevant content of S1 above, it can be known that for an event processing system including a first computing node, when the first computing node includes a plurality of first computing units (for example, Figure 4 When the first computing node obtains the event to be processed, the first target unit (for example, Figure 4 The computing unit-1 or computing unit-2 shown in the figure), and the first target unit uses the rule matching granularity key extractor corresponding to at least one candidate rule stored therein to perform group key extraction processing on the event to be processed, and obtains the group key of the event to be processed, so that the group key can represent a certain attribute of the event, so that some processing (for example, hash group processing, etc.) can be performed on the event to be processed based on the "group key of the event to be processed".

[0089] S2: The first computing node sends the event to be processed and the grouping key of the event to be processed to the second computing node.

[0090] In an embodiment of the present application, for a processing system including a first computing node and a second computing node, after the first computing node determines the grouping key of the event to be processed, the first computing node can send the tuple <the event to be processed, the grouping key of the event to be processed> to the second computing node, so that the second computing node can implement some processing processes for the event to be processed based on the grouping key (for example, a processing process based on rule matching logic, and a processing process based on rule matching result processing logic).

[0091] In fact, in order to better improve the event processing effect, the embodiment of the present application also provides a possible implementation of the second computing node above, in which the second computing node includes at least one second computing unit (for example, Figure 4 The computing units -3 and -4 shown in the figure), and each second computing unit includes the following "rule matching logic executor corresponding to at least one candidate rule" and the following "rule matching result processing logic executor corresponding to at least one candidate rule" (for example, these two executors are pre-stored in each second computing unit), so that each second computing unit can be used to perform a corresponding processing process for an event (for example, a processing process based on rule matching logic, and a processing process based on rule matching result processing logic).

[0092] Based on this, the embodiment of the present application also provides a possible implementation of S2 above. In this implementation, when the first computing node above includes at least one first computing unit, and the second computing node above includes at least one second computing unit, S2 can be specifically: after the first target unit in these first computing units determines the grouping key of the event to be processed, the first target unit sends the event to be processed and the grouping key of the event to be processed to the second target unit in the at least one second computing unit, so that the second target unit can subsequently implement some processing processes for the event to be processed based on the grouping key (for example, a processing process based on rule matching logic, and a processing process based on rule matching result processing logic, etc.). Among them, the second target unit refers to a second computing unit used to perform subsequent processing processes for the event to be processed; and the embodiment of the present application does not limit the determination process of the second target unit. For example, it can be implemented by any existing or future method that can select a computing unit for data processing from a distributed system.

[0093] In fact, in some application scenarios, for at least one second computing unit mentioned above, if these second computing units can access a certain storage space, the result obtained by performing rule matching processing on each event (that is, Figure 4 The intermediate matching results shown in the figure are stored in the storage space so that the second computing units can obtain these results from the storage space. Therefore, in order to improve the flexibility of event processing, different events in an event sequence that conforms to a certain CEP rule can be matched by different second computing units. Based on this, the embodiment of the present application provides a possible implementation of the second target unit above. In this implementation, the second target unit can be any second computing unit, so that the second target unit can complete the subsequent execution process of a CEP rule with the help of the content stored in the storage space.

[0094] In addition, in some application scenarios (for example, Flink system), for at least one of the second computing units above, if these second computing units can only access the storage space corresponding to themselves, in order to better meet the needs of CEP itself, all events with the same grouping key can be sent to the same second computing unit for subsequent processing. Based on this, the embodiment of the present application also provides another possible implementation of the second target unit above, in which the second target unit has processed at least one event to be referenced within a historical time period. Among them, the event to be referenced refers to an event that has been processed by the second computing node and belongs to the same hash group as the event to be processed. It can be seen that the grouping key of the event to be referenced is the same as the grouping key of the event to be processed (that is, these events to be referenced belong to the same hash group as the event to be processed).

[0095] In addition, the embodiments of the present application do not limit the above historical time period. For example, the end time of the historical time period is no later than the acquisition time of the event to be processed, so that the historical time period can refer to the time period before triggering the event processing process for the event to be processed.

[0096] In addition, the embodiment of the present application does not limit the implementation method of the above step "the first target unit sends the event to be processed and the grouping key of the event to be processed to the second target unit in the at least one second computing unit". For example, it can be specifically: after the first target unit determines the grouping key of the event to be processed, the first target unit can first perform hash grouping processing on the event to be processed according to the grouping key to obtain a group to be used (that is, the hash group to which the event to be processed belongs), so that the group to be used includes at least one of the above-mentioned referenced events and the event to be processed, so that the group to be used can represent some events with the same grouping key; then, the first target unit determines the second target unit that has processed these referenced events from these second computing units based on the group to be used; finally, the first target unit sends the event to be processed and the grouping key of the event to be processed to the second target unit, so that the second target unit can subsequently implement some processing processes for the event to be processed based on the grouping key.

[0097] S3: The second computing node processes the event to be processed according to the grouping key of the event to be processed, the rule matching logic executor corresponding to at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule.

[0098] The rule matching logic executor corresponding to the i-th candidate rule refers to the rule matching logic executor (e.g., NFA) obtained by compiling (or parsing) the i-th candidate rule, so that the "rule matching logic executor corresponding to the i-th candidate rule" is used to perform event matching processing on an event according to the rule matching logic configured for the i-th candidate rule. Wherein, i is a positive integer, i≤I, and I is a positive integer.

[0099] The rule matching result processing logic executor corresponding to the i-th candidate rule refers to the rule matching result processing logic executor (e.g., rule matching result processing function) obtained by compiling (or parsing) the i-th candidate rule, so that the “rule matching result processing logic executor corresponding to the i-th candidate rule” is used to process some event matching results (e.g., Figure 4 The "intermediate matching result" shown in the figure is processed. Wherein, i is a positive integer, i≤I, and I is a positive integer.

[0100] In fact, in order to better improve the event processing effect, the embodiment of the present application also provides a possible implementation of S3 above. In this implementation, when the second computing node above includes at least one second computing unit, S3 can be specifically: when the second target unit in these second computing units obtains the event to be processed and the grouping key of the event to be processed, the second target unit processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to at least one candidate rule above, and the rule matching result processing logic executor corresponding to the at least one candidate rule. It should be noted that the embodiment of the present application is not limited to the processing process of the event to be processed using these two executors. It can be implemented using any existing or future processing process of an event using these two executors corresponding to a CEP rule.

[0101] Based on the relevant contents of S1 to S3 above, it can be known that for the event processing method applied to an event processing system (for example, a Flink system) provided in an embodiment of the present application, when the event processing system includes at least a first computing node and a second computing node, the method includes: after obtaining the event to be processed (for example, a newly generated event in the event stream), the first computing node first uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; then the first computing node sends the event to be processed and the group key to the second computing node, so that the second computing node can subsequently process the event to be processed based on the group key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule, so as to achieve the purpose of running multiple CEP rules simultaneously in the system, thereby effectively improving the event processing performance of the system.

[0102] In fact, in order to better improve the event processing performance, the embodiment of the present application also provides a possible implementation of the above event processing method. In this implementation, the method may specifically include the following steps 11 to 14.

[0103] Step 11: After obtaining the event to be processed, the first computing node uses a rule event filter corresponding to at least one candidate rule to filter the event to be processed to obtain a filtering result of the event to be processed.

[0104] The rule event filter corresponding to the i-th candidate rule refers to the rule event filter obtained by compiling (or parsing) the i-th candidate rule, so that the "rule event filter corresponding to the i-th candidate rule" is used to filter out the events concerned by the i-th candidate rule (that is, events that meet the event screening conditions) from the event stream according to the event screening conditions configured for the i-th candidate rule, so that the i-th candidate rule can be used to process the events concerned in the future (for example, group key extraction processing, processing based on rule matching logic, and processing based on rule matching result processing logic, etc.). Wherein, i is a positive integer, i≤I, and I is a positive integer.

[0105] The above “filtering and processing results of events to be processed” are used to describe which candidate rules’ event filtering conditions are satisfied by the event to be processed, so that the “filtering and processing results of events to be processed” can indicate which candidate rules’ events to be processed belong to, so that the event to be processed can be processed using these candidate rules that pay attention to the event to be processed.

[0106] In fact, in order to better improve the event processing effect, the embodiment of the present application also provides a possible implementation method of the above-mentioned first computing node. In this implementation method, the first computing node includes at least one first computing unit, and each first computing unit includes the above-mentioned "rule event filter corresponding to at least one candidate rule" and the above-mentioned "rule matching granularity key extractor corresponding to at least one candidate rule" (for example, the extractor and the filter are pre-stored in each first computing unit), so that each first computing unit can not only be used to determine the grouping key of an event, but also can be used to perform screening processing on an event, so as to avoid the above-mentioned event processing system from executing some meaningless processing processes as much as possible.

[0107] Based on this, the embodiment of the present application also provides a possible implementation of the above step 11. In this implementation, when the above first computing node includes at least one first computing unit, step 11 can be specifically as follows: after obtaining the event to be processed, the third target unit in the at least one first computing unit uses the rule event filter corresponding to the above at least one candidate rule to filter the event to be processed to obtain the filtering result. Among them, the third target unit refers to the first computing unit used to perform event filtering and group key extraction processing on the event to be processed; and the embodiment of the present application does not limit the determination process of the third target unit. For example, it can be implemented by any existing or future method that can select a computing unit for data processing from a distributed system.

[0108] Based on the relevant contents of step 11 above, it can be known that for an event processing system including a first computing node, when the first computing node includes a plurality of first computing units (for example, Figure 4 When the computing unit -1 and computing unit -2 are shown in the figure, after the first computing node obtains the event to be processed, a third target unit can be determined from these first computing units, and the third target unit uses the rule event filter corresponding to at least one candidate rule stored therein to filter and process the event to be processed, and obtains the filtering and processing result of the event to be processed, so that the filtering and processing result can indicate which candidate rules the event to be processed belongs to, so that only the candidate rules that pay attention to the event to be processed need to be used to process the event to be processed later, and there is no need to execute the candidate rules that do not pay attention to the event to be processed to process the event to be processed, thereby effectively saving computing resources.

[0109] Step 12: If the screening processing result indicates that the event to be processed satisfies the event screening condition corresponding to the target rule in at least one candidate rule, the first computing node uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed.

[0110] The target rule refers to a candidate rule that focuses on the above pending event, so that the target rule is used to perform CEP matching processing on the pending event in the future; and the embodiment of the present application does not limit the number of the target rules, for example, it can be M. M is a positive integer. That is, the target rule can be one or more.

[0111] In addition, the relevant content of the step 12 above "the first computing node uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed" is similar to the relevant content of S1 above. For ease of understanding, it is explained below with examples.

[0112] As an example, when the first computing node above includes at least one first computing unit, step 12 can specifically be: after the third target unit among these first computing units determines the screening processing result of the event to be processed, if the screening processing result indicates that the event to be processed satisfies the event screening condition corresponding to the target rule in at least one candidate rule, then the third target unit uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed.

[0113] Step 13: The first computing node sends the event to be processed and the grouping key of the event to be processed to the second computing node.

[0114] It should be noted that the relevant content of step 13 is similar to the relevant content of S2 above. For ease of understanding, it is explained below with examples.

[0115] As an example, when the first computing node above includes at least one first computing unit, and the second computing node above includes at least one second computing unit, step 13 may specifically be: after the third target unit in the first computing units determines the grouping key of the event to be processed, the third target unit sends the event to be processed and the grouping key to the second target unit in the at least one second computing unit. For the relevant content of the second target unit, please refer to S2 above.

[0116] In fact, in order to better improve the event processing effect, the embodiment of the present application also provides a possible implementation of the second target unit above, in which the second target unit has processed at least one event to be referenced in the historical time period. Among them, the grouping key of the event to be referenced is the same as the grouping key of the event to be processed (that is, these events to be referenced and the event to be processed belong to the same hash group), and the screening processing result of the event to be referenced is the same as the screening processing result of the event to be processed (that is, these events to be referenced and the event to be processed all meet the event screening conditions corresponding to the same CEP rule).

[0117] Step 14: The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

[0118] It should be noted that the relevant content of step 14 is similar to the relevant content of S3 above. For ease of understanding, it is explained below with examples.

[0119] As an example, when the second computing node above includes at least one second computing unit, step 14 can be specifically as follows: after the second target unit among these second computing units obtains the event to be processed and the grouping key of the event to be processed, the second target unit processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

[0120] Based on the relevant contents of steps 11 to 14 above, it can be known that for the event processing system (for example, the Flink system) provided in the embodiment of the present application, when the event processing system includes at least a first computing node, the first computing node can be used not only to perform group key determination processing for an event, but also to filter out CEP rules that focus on the event from all CEP rules, so that only these CEP rules that focus on the event can be used to process the event subsequently, thereby reducing the occurrence of invalid processing processes, thereby effectively improving the event processing performance of the system.

[0121] In fact, in order to better improve the event processing performance, the embodiment of the present application also provides a possible implementation of the above event processing system, in which the event processing system not only includes the above first computing node and the second computing node, but also includes a rule updating unit. The rule updating unit is used to update the CEP rules stored in the event processing system in response to the rule updating operation triggered by the user (for example, storing a new CEP rule in the event processing system, or using a new CEP rule to update a CEP rule stored in the event processing system, etc.). The rule updating operation is used to input a new CEP rule into the event processing system.

[0122] In addition, the embodiment of the present application does not limit the working principle of the above rule update unit. For example, it can be specifically: after the rule update unit receives the rule to be used submitted by the user, the rule update unit can compile (or parse) the rule to be used to obtain at least one component corresponding to the rule to be used, and the rule update unit broadcasts and stores these components to each computing unit in the corresponding computing node. The rule to be used refers to a new CEP rule configured by the user.

[0123] The above "at least one component" may include at least one of the rule event filter corresponding to the rule to be used above, the rule matching granularity key extractor corresponding to the rule to be used, the rule matching logic executor corresponding to the rule to be used, and the rule matching result processing logic executor corresponding to the rule to be used.

[0124] The above-mentioned "rule event filter corresponding to the rule to be used" refers to the rule event filter obtained by compiling (or parsing) the rule to be used, so that the "rule event filter corresponding to the rule to be used" is used to filter out the events concerned by the rule to be used (that is, the events that meet the event filtering conditions) from the event stream according to the event filtering conditions configured for the rule to be used, so that the rule to be used can be used to process the events concerned subsequently (for example, group key extraction processing, processing based on rule matching logic, and processing based on rule matching result processing logic, etc.).

[0125] The above-mentioned "rule matching granularity key extractor corresponding to the rule to be used" refers to the rule matching granularity key extractor obtained by compiling (or parsing) the rule to be used, so that the "rule matching granularity key extractor corresponding to the rule to be used" is used to extract the grouping key of an event according to the rule matching granularity configured for the rule to be used, so that the grouping key can represent a certain attribute of the event, so that some processing can be performed based on the grouping key later (for example, hash grouping processing, etc.).

[0126] The above-mentioned “rule matching logic executor corresponding to the rule to be used” refers to the rule matching logic executor (for example, NFA) obtained by compiling the rule to be used, so that the “rule matching logic executor corresponding to the rule to be used” is used to perform event matching processing for an event according to the rule matching logic configured for the rule to be used.

[0127] The above “rule matching result processing logic executor corresponding to the rule to be used” refers to the rule matching result processing logic executor (for example, rule matching result processing function) obtained by compiling (or parsing) the rule to be used, so that the “rule matching result processing logic executor corresponding to the rule to be used” is used to process some event matching results (for example, Figure 4 The “intermediate matching result” shown in the figure is processed.

[0128] In order to better understand the above rule updating unit, an example is provided below for explanation.

[0129] As an example, in a possible implementation, when the above event processing system includes a rule updating unit, a first computing node and a second computing node, the first computing node includes at least one first computing unit, and the second computing node includes at least one second computing unit, the event processing method includes not only some of the above steps (for example, S1-S3 or steps 11-14), but may also include the following steps 21-24. It should be noted that the embodiment of the present application does not limit the execution time of the steps 21-24.

[0130] Step 21: After obtaining the rule event filter corresponding to the rule to be used, the above rule updating unit sends the rule event filter corresponding to the rule to be used to each first computing unit, so that each first computing unit uses the rule event filter corresponding to the rule to be used to update the rule event filter corresponding to at least one candidate rule.

[0131] It should be noted that the embodiment of the present application does not limit the implementation method of "the first computing unit uses the rule event filter corresponding to the rule to be used to update the rule event filter corresponding to at least one candidate rule" in step 21 above. For example, in some application scenarios (for example, when the historical version of the rule to be used is not stored in the first computing unit), the rule event filter corresponding to the rule to be used can be directly stored in the first computing unit, so that the rule event filter corresponding to at least one candidate rule stored in the first computing unit includes the rule event filter corresponding to the rule to be used. For example, in other application scenarios (for example, when the historical version of the rule to be used is already stored in the first computing unit), the rule event filter corresponding to the rule to be used can be used to replace the rule event filter corresponding to the historical rule stored in the first computing unit, so that the rule event filter corresponding to at least one candidate rule stored in the first computing unit includes the rule event filter corresponding to the rule to be used, but does not include the rule event filter corresponding to the historical rule. Among them, the historical rule refers to the historical version of the rule to be used.

[0132] Step 22: After obtaining the rule matching granularity key extractor corresponding to the rule to be used, the above rule updating unit sends the rule matching granularity key extractor corresponding to the rule to be used to each first computing unit, so that each first computing unit uses the rule matching granularity key extractor corresponding to the rule to be used to update the rule matching granularity key extractor corresponding to at least one candidate rule.

[0133] It should be noted that the implementation of step 22 is similar to the implementation of step 21 above.

[0134] Step 23: After obtaining the rule matching logic executor corresponding to the rule to be used, the above rule updating unit sends the rule matching logic executor corresponding to the rule to be used to each second computing unit, so that each second computing unit uses the rule matching logic executor corresponding to the rule to be used to update the rule matching logic executor corresponding to at least one candidate rule.

[0135] It should be noted that the implementation of step 23 is similar to the implementation of step 21 above.

[0136] Step 24: After obtaining the rule matching result processing logic executor corresponding to the rule to be used, the above rule updating unit sends the rule matching result processing logic executor corresponding to the rule to be used to each second computing unit, so that each second computing unit uses the rule matching result processing logic executor corresponding to the rule to be used to update the rule matching result processing logic executor corresponding to at least one candidate rule.

[0137] It should be noted that the implementation of step 24 is similar to the implementation of step 21 above.

[0138] Based on the relevant contents of steps 21 to 24 above, it can be known that for an event processing system (for example, a Flink system) including the above rule update unit, the rule update unit can broadcast and store each component corresponding to a new CEP rule to all computing units of the corresponding computing nodes in the system, thereby realizing dynamic update processing of the CEP rules without restarting the task, thereby better improving the event processing performance of the system.

[0139] Based on the event processing method provided in the embodiment of the present application, the embodiment of the present application also provides an event processing system. Figure 5 Explain and illustrate. Figure 5 This is a schematic diagram of the structure of an event processing system provided in an embodiment of the present application. It should be noted that for the technical details of the event processing system provided in an embodiment of the present application, please refer to the relevant content of the event processing method above.

[0140] like Figure 5 As shown, the event processing system 500 provided in the embodiment of the present application includes a first computing node 501 and a second computing node 502;

[0141] The first computing node 501 is used to, after acquiring the event to be processed, perform group key extraction processing on the event to be processed using a rule matching granularity key extractor corresponding to at least one candidate rule to obtain the group key of the event to be processed;

[0142] The first computing node 501 is further configured to send the event to be processed and the grouping key to the second computing node;

[0143] The second computing node 502 is used to process the event to be processed according to the grouping key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule.

[0144] In a possible implementation, the first computing node 501 includes at least one first computing unit; the first computing unit includes a rule matching granularity key extractor corresponding to the at least one candidate rule; the second computing node 502 includes at least one second computing unit; the second computing unit includes a rule matching logic executor corresponding to the at least one candidate rule and a rule matching result processing logic executor corresponding to the at least one candidate rule;

[0145] The first target unit in the at least one first computing unit is used to perform group key extraction processing on the event to be processed by using a rule matching granularity key extractor corresponding to at least one candidate rule to obtain a group key of the event to be processed;

[0146] The first target unit is further used to send the event to be processed and the grouping key to a second target unit in the at least one second computing unit;

[0147] The second target unit is used to process the event to be processed according to the grouping key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule.

[0148] In a possible implementation, the second target unit has processed at least one event to be referenced within a historical time period; the grouping key of the event to be referenced is the same as the grouping key of the event to be processed; and the end time of the historical time period is no later than the acquisition time of the event to be processed.

[0149] In a possible implementation manner, the first computing node 501 is further configured to filter the event to be processed by using the rule event filter corresponding to the at least one candidate rule to obtain a filtering result of the event to be processed;

[0150] The first computing node 501 is specifically configured to: if the screening processing result indicates that the event to be processed satisfies the event screening condition corresponding to the target rule in the at least one candidate rule, perform group key extraction processing on the event to be processed using the rule matching granularity key extractor corresponding to the target rule to obtain the group key of the event to be processed;

[0151] The second computing node 502 is specifically used to process the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

[0152] In a possible implementation, the first computing node 501 includes at least one first computing unit; the first computing unit includes a rule event filter corresponding to the at least one candidate rule and a rule matching granularity key extractor corresponding to the at least one candidate rule; the second computing node 502 includes at least one second computing unit; the second computing unit includes a rule matching logic executor corresponding to the at least one candidate rule and a rule matching result processing logic executor corresponding to the at least one candidate rule;

[0153] The third target unit in the at least one first computing unit is used to filter the event to be processed by using the rule event filter corresponding to the at least one candidate rule to obtain a filtering result;

[0154] The third target unit is further used to perform group key extraction processing on the event to be processed by using the rule matching granularity key extractor corresponding to the target rule to obtain the group key of the event to be processed;

[0155] The third target unit is further used to send the event to be processed and the grouping key to the second target unit in the at least one second computing unit;

[0156] The second target unit is used to process the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

[0157] In a possible implementation, the second target unit has processed at least one event to be referenced within a historical time period; the grouping key of the event to be referenced is the same as the grouping key of the event to be processed, and the screening processing result of the event to be referenced is the same as the screening processing result of the event to be processed; and the end time of the historical time period is no later than the acquisition time of the event to be processed.

[0158] In a possible implementation, the number of the target rules is M, where M is a positive integer.

[0159] In a possible implementation, the event processing system further includes a rule updating unit;

[0160] The rule updating unit is configured to, after acquiring the rule event filter corresponding to the rule to be used, send the rule event filter corresponding to the rule to be used to each of the first computing units;

[0161] Each of the first computing units is further configured to update the rule event filter corresponding to the at least one candidate rule using the rule event filter corresponding to the rule to be used;

[0162] The rule updating unit is further configured to, after acquiring the rule matching granularity key extractor corresponding to the rule to be used, send the rule matching granularity key extractor corresponding to the rule to be used to each of the first computing units;

[0163] Each of the first computing units is further configured to update a rule matching granularity key extractor corresponding to the at least one candidate rule using the rule matching granularity key extractor corresponding to the rule to be used;

[0164] The rule updating unit is further configured to, after acquiring the rule matching logic executor corresponding to the rule to be used, send the rule matching logic executor corresponding to the rule to be used to each of the second computing units;

[0165] Each of the second computing units is further used to update the rule matching logic executor corresponding to the at least one candidate rule using the rule matching logic executor corresponding to the rule to be used;

[0166] The rule updating unit is further configured to send the rule matching result processing logic executor corresponding to the rule to be used to each of the second computing units after acquiring the rule matching result processing logic executor corresponding to the rule to be used;

[0167] Each of the second computing units is further configured to update the rule matching result processing logic executor corresponding to the at least one candidate rule by using the rule matching result processing logic executor corresponding to the rule to be used.

[0168] Based on the relevant content of the above-mentioned event processing system 500, it can be known that for the event processing system 500 provided in the embodiment of the present application, when the system includes at least a first computing node and a second computing node, the system can use these two nodes to complete the CEP processing process for the event stream, and the working principle of the system is as follows: after obtaining the event to be processed (for example, a newly generated event in the event stream), the first computing node first uses a rule matching granularity key extractor corresponding to at least one candidate rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; then the first computing node sends the event to be processed and the group key to the second computing node, so that the second computing node can subsequently process the event to be processed according to the group key, the rule matching logic executor corresponding to the at least one candidate rule, and the rule matching result processing logic executor corresponding to the at least one candidate rule, so as to achieve the purpose of running multiple CEP rules in the system at the same time, thereby effectively improving the event processing performance of the system.

[0169] In addition, an embodiment of the present application also provides an electronic device, which includes a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory, so that the electronic device executes any implementation of the event processing method provided in the embodiment of the present application.

[0170] See also Figure 6 , which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0171] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0172] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0173] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0174] The electronic device provided by the embodiment of the present disclosure and the method provided by the above embodiment belong to the same inventive concept, and the technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0175] The embodiment of the present application also provides a computer-readable medium, in which instructions or computer programs are stored. When the instructions or computer programs are executed on a device, the device executes any implementation of the event processing method provided in the embodiment of the present application.

[0176] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0177] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0178] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0179] The computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device can execute the method.

[0180] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0181] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0182] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit / module does not, in some cases, constitute a limitation on the unit itself.

[0183] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0184] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0185] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0186] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0187] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0188] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0189] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An event processing method, characterized in that: The method is applied to an event processing system, the system is used to run multiple composite event processing CEP rules simultaneously, for any of the CEP rules, a rule matching granularity key extractor corresponding to the CEP rule, a rule matching logic executor corresponding to the CEP rule, and a rule matching result processing logic executor corresponding to the CEP rule are all obtained by parsing the CEP rule, the event processing system includes a first computing node and a second computing node; The method comprises: After acquiring the event to be processed, the first computing node uses the rule matching granularity key extractor corresponding to the multiple CEP rules to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; The first computing node sends the event to be processed and the grouping key to the second computing node; The second computing node processes the event to be processed according to the grouping key, the rule matching logic executors corresponding to the multiple CEP rules, and the rule matching result processing logic executors corresponding to the multiple CEP rules; The event processing system also includes a rule updating unit, which is used to: after receiving the rule to be used, parse the rule to be used to obtain a rule matching granularity key extractor corresponding to the rule to be used, a rule matching logic executor corresponding to the rule to be used, and a rule matching result processing logic executor corresponding to the rule to be used; broadcast and store the rule matching granularity key extractor corresponding to the rule to be used to the first computing node, and broadcast and store the rule matching logic executor corresponding to the rule to be used and the rule matching result processing logic executor corresponding to the rule to be used to the second computing node.

2. The method according to claim 1, characterized in that The first computing node includes at least one first computing unit; the first computing unit includes a rule matching granularity key extractor corresponding to the multiple CEP rules; the second computing node includes at least one second computing unit; the second computing unit includes a rule matching logic executor corresponding to the multiple CEP rules and a rule matching result processing logic executor corresponding to the multiple CEP rules; The first computing node uses the rule matching granularity key extractors corresponding to the multiple CEP rules to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed, including: The first target unit in the at least one first computing unit uses the rule matching granularity key extractor corresponding to the multiple CEP rules to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; The first computing node sends the event to be processed and the grouping key to the second computing node, including: The first target unit sends the event to be processed and the grouping key to a second target unit in the at least one second computing unit; The second computing node processes the event to be processed according to the grouping key, the rule matching logic executors corresponding to the multiple CEP rules, and the rule matching result processing logic executors corresponding to the multiple CEP rules, including: The second target unit processes the event to be processed according to the grouping key, the rule matching logic executors corresponding to the multiple CEP rules, and the rule matching result processing logic executors corresponding to the multiple CEP rules.

3. The method according to claim 2, characterized in that The second target unit has processed at least one event to be referenced within a historical time period; the grouping key of the event to be referenced is the same as the grouping key of the event to be processed; and the end time of the historical time period is no later than the acquisition time of the event to be processed.

4. The method according to claim 1, characterized in that: The method further comprises: The first computing node uses the rule event filters corresponding to the multiple CEP rules to filter the events to be processed to obtain the filtering results of the events to be processed; The first computing node uses the rule matching granularity key extractors corresponding to the multiple CEP rules to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed, including: If the screening processing result indicates that the event to be processed satisfies the event screening condition corresponding to the target rule in the multiple CEP rules, the first computing node uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; The second computing node processes the event to be processed according to the grouping key, the rule matching logic executors corresponding to the multiple CEP rules, and the rule matching result processing logic executors corresponding to the multiple CEP rules, including: The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

5. The method according to claim 4, characterized in that The first computing node includes at least one first computing unit; the first computing unit includes a rule event filter corresponding to the plurality of CEP rules and a rule matching granularity key extractor corresponding to the plurality of CEP rules; The second computing node includes at least one second computing unit; the second computing unit includes a rule matching logic executor corresponding to the multiple CEP rules and a rule matching result processing logic executor corresponding to the multiple CEP rules; The first computing node uses the rule event filter corresponding to the multiple CEP rules to filter the event to be processed to obtain a filtering result, including: The third target unit in the at least one first computing unit uses the rule event filter corresponding to the multiple CEP rules to filter the event to be processed to obtain a filtering result; The first computing node uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed, including: The third target unit uses the rule matching granularity key extractor corresponding to the target rule to perform group key extraction processing on the event to be processed to obtain the group key of the event to be processed; The first computing node sends the event to be processed and the grouping key to the second computing node, including: The third target unit sends the event to be processed and the group key to the second target unit in the at least one second computing unit; The second computing node processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule, including: The second target unit processes the event to be processed according to the grouping key, the rule matching logic executor corresponding to the target rule, and the rule matching result processing logic executor corresponding to the target rule.

6. The method according to claim 5, characterized in that The second target unit has processed at least one event to be referenced within a historical time period; the grouping key of the event to be referenced is the same as the grouping key of the event to be processed, and the screening processing result of the event to be referenced is the same as the screening processing result of the event to be processed; the end time of the historical time period is not later than the acquisition time of the event to be processed; and / or, The number of the target rules is M, where M is a positive integer.

7. The method according to claim 5, characterized in that The rule updating unit is specifically used for: After acquiring the rule event filter corresponding to the rule to be used, sending the rule event filter corresponding to the rule to be used to each of the first computing units; Each of the first computing units updates the rule event filters corresponding to the plurality of CEP rules using the rule event filters corresponding to the to-be-used rules; After obtaining the rule matching granularity key extractor corresponding to the rule to be used, the rule matching granularity key extractor corresponding to the rule to be used is sent to each of the first computing units; each of the first computing units updates the rule matching granularity key extractors corresponding to the multiple CEP rules using the rule matching granularity key extractor corresponding to the rule to be used; After acquiring the rule matching logic executor corresponding to the rule to be used, sending the rule matching logic executor corresponding to the rule to be used to each second computing unit; Each of the second computing units updates the rule matching logic executors corresponding to the plurality of CEP rules using the rule matching logic executors corresponding to the to-be-used rules; After acquiring the rule matching result processing logic executor corresponding to the rule to be used, sending the rule matching result processing logic executor corresponding to the rule to be used to each second computing unit; Each of the second calculation units updates the rule matching result processing logic executors corresponding to the plurality of CEP rules using the rule matching result processing logic executors corresponding to the to-be-used rules.

8. An event processing system, characterized in that: The system is used to run multiple composite event processing CEP rules simultaneously. For any of the CEP rules, the rule matching granularity key extractor corresponding to the CEP rule, the rule matching logic executor corresponding to the CEP rule, and the rule matching result processing logic executor corresponding to the CEP rule are all obtained by parsing the CEP rule. The event processing system includes a first computing node and a second computing node. The first computing node is used to, after acquiring the event to be processed, perform group key extraction processing on the event to be processed using a rule matching granularity key extractor corresponding to a plurality of CEP rules to obtain the group key of the event to be processed; The first computing node is further configured to send the event to be processed and the grouping key to the second computing node; The second computing node is used to process the event to be processed according to the grouping key, the rule matching logic executors corresponding to the multiple CEP rules, and the rule matching result processing logic executors corresponding to the multiple CEP rules; The event processing system further includes a rule updating unit, which is used to: after receiving the rule to be used, parse the rule to be used to obtain a rule matching granularity key extractor corresponding to the rule to be used, a rule matching logic executor corresponding to the rule to be used, and a rule matching result processing logic executor corresponding to the rule to be used; The rule matching granularity key extractor corresponding to the rule to be used is broadcast and stored to the first computing node, and the rule matching logic executor corresponding to the rule to be used and the rule matching result processing logic executor corresponding to the rule to be used are broadcast and stored to the second computing node.

9. An electronic device, characterized in that: The device comprises: a processor and a memory; The memory is used to store instructions or computer programs; The processor is used to execute the instructions or computer programs in the memory so that the electronic device executes the method according to any one of claims 1 to 7.

10. A computer-readable medium, characterized in that The computer-readable medium stores instructions or computer programs, and when the instructions or computer programs are executed on a device, the device is enabled to execute the method according to any one of claims 1 to 7.

11. A computer program product, characterized in that It comprises a computer program carried on a non-transitory computer-readable medium, the computer program comprising a program code for executing the method according to any one of claims 1 to 7.

Images