Event content filtering method, device, apparatus, and storage medium

Abstract

The application relates to an event content filtering method, device and equipment and a storage medium. The method comprises the following steps: extending an expression supporting only event context attribute filtering to obtain an extended expression of an event query language; converting the extended expression to obtain a standard expression when the extended expression is evaluated; extracting a field value in event content; writing the extracted value into an extended attribute of the event; using a parser and an evaluator to calculate a result value of the standard expression; and performing event matching by using the result value of the standard expression to realize the filtering operation of the event content. The application can realize that the event query language supports event content filtering.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a method, apparatus, device, and storage medium for filtering event content. Background Technology

[0002] Currently, CloudEvents defines an event subscription specification. In this specification, event consumers can set various filters when subscribing to events to filter out desired events. Currently, these filters only define filtering based on event context attributes, i.e., using CloudEvents SQL expressions to match event context attributes for filtering. However, in real-world business scenarios, there is a need to filter based on event content, which the current CloudEvents SQL cannot do.

[0003] Therefore, providing a technical solution for filtering event content in CloudEvents SQL has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of the above, this application provides a method, apparatus, device and storage medium for filtering event content, the purpose of which is to solve the above-mentioned technical problems.

[0005] Firstly, this application provides a method for filtering event content, the method comprising:

[0006] The expression that only supports filtering of event context attributes is extended to obtain an extended expression for the event query language, wherein the value identifier of the extended expression is represented using dot notation;

[0007] Convert the extended expressions of the Event Query Language into standard expressions of the Event Query Language, wherein the Event Query Language is used to query and / or filter events;

[0008] The standard expression is evaluated to obtain its result value, which is then used for event matching to filter event content.

[0009] Preferably, the step of expanding the expression that only supports filtering based on event context attributes to obtain an expanded expression for the event query language includes:

[0010] The syntax of the value identifier of the expression that only supports filtering of event context attributes is extended to obtain the extended expression of the event query language.

[0011] Preferably, the conversion of the extended expression of the event query language into a standard expression of the event query language includes:

[0012] Find the value identifier represented by each dot notation in the extended expression;

[0013] Generate extended attribute names that conform to the attribute naming conventions for each value identifier;

[0014] Save the mapping relationship between the extended attribute names and the dot notation;

[0015] Based on the mapping relationship, the dot notation in the extended expression is replaced with the extended attribute name to obtain the standard expression of the event query language.

[0016] Preferably, the method further includes:

[0017] If the extended expression does not contain dot notation, then the extended expression will be used as the standard expression of the event query language.

[0018] Preferably, the step of evaluating the standard expression to obtain the result value of the standard expression includes:

[0019] The original event is copied to obtain a cloned event. The target value of the data node is extracted from the event content of the cloned event according to the dot notation, wherein the data node is used to store the specific data of the event.

[0020] Write the target value into the extended properties of the clone event;

[0021] Parse the standard expression to obtain an abstract expression of the standard expression;

[0022] The result value of the standard expression is obtained by evaluating the clone event that contains the target value in the extended attribute and the abstract expression.

[0023] Preferably, extracting the target value of the data node from the event content of the cloned event according to the dot notation includes:

[0024] If the event content is in JSON format, then access the path of the data node in the event content and extract the target value of the data node based on the path.

[0025] Preferably, the step of evaluating the clone event containing the target value in the extended attribute and the abstract expression to obtain the result value of the standard expression includes:

[0026] The clone event, which contains the target value in the extended attribute, is used as input to the abstract expression for evaluation, resulting in the value of the standard expression.

[0027] Secondly, this application provides an event content filtering device, the device comprising:

[0028] Extension module: Used to extend expressions that only support event context attribute filtering to obtain extended expressions for the event query language, wherein the value identifier of the extended expression is represented using dot notation;

[0029] Conversion module: Used to convert extended expressions of the Event Query Language into standard expressions of the Event Query Language, wherein the Event Query Language is used to query and / or filter events;

[0030] Evaluation module: Used to evaluate the standard expression to obtain the result value of the standard expression, and use the result value of the standard expression to perform event matching in order to achieve the filtering operation of event content.

[0031] Thirdly, this application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0032] Memory, used to store computer programs;

[0033] When a processor executes a program stored in memory, it implements the method for filtering event content as described in any embodiment of the first aspect.

[0034] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method for filtering event content as described in any embodiment of the first aspect.

[0035] The technical solutions provided in this application have the following advantages compared with the prior art:

[0036] This application extends expressions that only support filtering based on event context attributes to create extended expressions for the event query language. When evaluating these extended expressions, they are transformed into standard expressions. Then, field values ​​are extracted from the event content and written into the event's extended attributes. A parser and evaluator are used to calculate the result of the standard expression, which is then used for event matching. This enables the event query language to support event content filtering. Compared to existing CloudEvents SQL solutions that only support filtering based on event context attributes, this application supports event content filtering, thus meeting the needs of real-world business applications for filtering based on event content. Attached Figure Description

[0037] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a flowchart illustrating an embodiment of the event content filtering method of this application;

[0040] Figure 2 This is a schematic diagram of the process framework of the event content filtering method in the embodiments of this application;

[0041] Figure 3 A schematic diagram of a module for an embodiment of the event content filtering device of this application;

[0042] Figure 4 This is a schematic diagram of an embodiment of the electronic device of this application;

[0043] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0045] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0046] This application provides a method for filtering event content. (See reference...) Figure 1 The diagram shown is a flowchart illustrating an embodiment of the event content filtering method of this application. This method can be executed by an electronic device, which can be implemented in software and / or hardware. The event content filtering method includes:

[0047] Step S10: Expand the expression that only supports event context attribute filtering to obtain an expanded expression for the event query language, wherein the value identifier of the expanded expression is represented using dot notation;

[0048] Step S20: Convert the extended expression of the event query language into a standard expression of the event query language, wherein the event query language is used to query and / or filter events;

[0049] Step S30: Evaluate the standard expression to obtain the result value of the standard expression, and use the result value of the standard expression to perform event matching in order to achieve the filtering operation of event content.

[0050] CloudEvents events consist of two parts: context properties and event content (i.e., data). The context properties include the required attributes id (event ID), specversion (specification version), source (event source), and type (event type), as well as custom extended attributes. CloudEvents event content can be in various formats, but the specific implementation of CloudEvents must support JSON format, a lightweight data exchange format widely used in web services.

[0051] CloudEvents also defines an event subscription specification. In this specification, event consumers can set various filters when subscribing to events to filter out desired events. Currently, these filters only define filtering based on event context attributes. One type is the SQL filter, which uses CloudEvents SQL expressions to match events; if the expression evaluates to true, the event is considered a match. CloudEvents SQL (CESQL, referred to as Event Query Language in this application) is a specification defined by the CloudEvents project. It is an expression language, syntactically similar to the WHERE clause of Structured Query Language in relational databases. CESQL is used to determine whether a CloudEvents event satisfies the expression. Currently, CESQL value identifiers can only use event context attribute names; therefore, if used for event subscription filtering, filtering by event context attributes is only supported.

[0052] To address this, this application extends expressions that only support event context attribute filtering using dot notation, resulting in extended expressions for the event query language. When evaluating these extended expressions, the CESQL extended expressions are rewritten to obtain standard CESQL expressions. Then, field values ​​from the event content are extracted using dot notation and written into the event's extended attributes. Finally, the parser and evaluator of the CloudEvents SDK are used to calculate the result. The result is either true or false; if true, the event is considered a match; if false, it is considered a mismatch, thus enabling CESQL to support event content filtering.

[0053] The following is a JSON representation of a CloudEvents event:

[0054]

[0055]

[0056] In CloudEvents, id, specversion, source, and type are required attributes, datacontenttype is an optional attribute, rmqkey, rmqid, and rmqtag are extended attributes, and data is the content of the event.

[0057] The following is a CESQL example:

[0058] The rmqtag property of the EXISTS rmqtag event exists;

[0059] The type and source properties of the event are equal to the specified string values;

[0060] The type, source, and rmqtag attributes of the event are equal to the specified string values;

[0061] In the above example, the event property names are called value identifiers in CESQL.

[0062] This application uses dot notation to represent fields in event content, a syntax for accessing object properties. When the CloudEvents event content is in JSON format, dot notation provides a path to access a specific data node in the JSON, following which the value of that data node can be obtained.

[0063] Taking the CloudEvents event mentioned above as an example, the table below shows the data node values ​​corresponding to different dot notation, as well as the JSON type of the data node:

[0064] data.eventType 2 numerical values data.source PGC_AUDIT String data.isNotify true Boolean data.locations.0.name Seattle String data.locations.3.name Olympia String data.onlineOfflineStatus.2 true Boolean data.onlineOfflineStatus.6 false Boolean

[0065] By extending expressions that only support filtering based on event context attributes, extended expressions for the event query language can be obtained, allowing CESQL value identifiers to use dot notation to represent fields in the event content. Specifically, extending expressions that only support filtering based on event context attributes to obtain extended expressions for the event query language includes:

[0066] The syntax of the value identifier of the expression that only supports filtering of event context attributes is extended to obtain the extended expression of the event query language.

[0067] Because value identifiers in CESQL must follow the naming conventions of CloudEvents property names—that is, they can only consist of lowercase letters and numbers, and their length cannot exceed 20 characters—it is clear that dot notation does not conform to this naming convention. Dot notation contains the character "." and its length easily exceeds 20 characters. Therefore, the CESQL value identifier syntax needs to be extended to obtain extended expressions for the event query language.

[0068] The following is an example of CESQL using dot notation (referred to as an extended expression in this application):

[0069] In this example, `data.isNotify = true` means that the `isNotify` value in the event content is true.

[0070] The example data.episodeTypeV2 = 'PPC' OR data.episodeTypeV2 = 'PUGC' indicates that the episodeTypeV2 value in the event content is either PPC or PUGC.

[0071] The example `data.onlineOfflineStatus.6 = false AND source = 'my-source'` indicates that both the event attribute and the event content filter condition exist simultaneously.

[0072] Because the extended expressions using dot notation are not standard CESQL expressions, directly evaluating them using the CloudEvents SDK will result in syntax parsing errors. Therefore, the extended expressions need to be rewritten into standard expressions for evaluation. For example, the CESQL extended expressions need to be converted into standard CESQL expressions, and then evaluated using the CloudEvents SDK's standard parser and evaluator. Specifically, converting the event query language's extended expressions into standard event query language expressions includes:

[0073] Find the value identifier represented by each dot notation in the extended expression;

[0074] Generate extended attribute names that conform to the attribute naming conventions for each value identifier;

[0075] Save the mapping relationship between the extended attribute names and the dot notation;

[0076] Based on the mapping relationship, the dot notation in the extended expression is replaced with the extended attribute name to obtain the standard expression of the event query language.

[0077] Find the value identifiers represented by dot notation in the CESQL extended expression, that is, find the CESQL value identifiers prefixed with "data." For each different value identifier represented by dot notation, generate a corresponding extended attribute name that conforms to the CloudEvents attribute naming convention, and save the mapping relationship between dot notation and extended attribute name. For each dot notation in the CESQL extended expression, the corresponding extended attribute name can be obtained by looking up the mapping relationship. Replace the dot notation with the extended attribute name. After the replacement is completed, the CESQL standard expression can be obtained.

[0078] Furthermore, the method also includes:

[0079] If the extended expression does not contain dot notation, then the extended expression will be used as the standard expression of the event query language.

[0080] If the CESQL extended expression does not contain dot notation, the resulting CESQL standard expression is the same as the original expression, and the mapping relationship is empty.

[0081] After obtaining the standard expression, the standard expression is evaluated using the standard parser and evaluator of the CloudEvents SDK to obtain its result value. This result value is then used for event matching to filter event content. Specifically, evaluating the standard expression to obtain its result value includes:

[0082] The original event is copied to obtain a cloned event. The target value of the data node is extracted from the event content of the cloned event according to the dot notation, wherein the data node is used to store the specific data of the event.

[0083] Write the target value into the extended properties of the clone event;

[0084] Parse the standard expression to obtain an abstract expression of the standard expression;

[0085] The result value of the standard expression is obtained by evaluating the clone event that contains the target value in the extended attribute and the abstract expression.

[0086] The original event refers to the original event received from the event source. When filtering or selecting the original event, the original event can be copied first, and then the CloudEvents SQL expression can be matched and processed based on the copied clone event to keep the original event unchanged for subsequent processing or distribution.

[0087] For each pair in the mapping relationship between dot notation and extended attribute name (using the variable `dotNotation` to represent the dot notation and the variable `extName` to represent the extended attribute name), the target value of the data node is extracted from the event content based on `dotNotation` (in Go, the `gobag` package can be used), and this target value is written into the extended attribute `extName` of the cloned event. The CESQL standard expression is parsed using the CloudEvents SDK parser to obtain an abstract expression of the standard expression. The result of the standard expression is obtained by evaluating the cloned event with the target value written in the extended attribute and the abstract expression. Specifically, the result of evaluating the standard expression by evaluating the cloned event with the target value written in the extended attribute and the abstract expression includes:

[0088] The cloned event with the target value written in the extended attribute is used as input to the abstract expression for evaluation, resulting in the standard expression. In other words, by using the CloudEvents SDK evaluator to evaluate the cloned event with the extended attribute as input to the internal abstract expression, the standard expression can be obtained.

[0089] Furthermore, the target values ​​of data nodes are extracted from the event content of the cloned event using dot notation, including:

[0090] If the event content is in JSON format, then access the path of the data node in the event content and extract the target value of the data node based on the path.

[0091] When the CloudEvents event content is in JSON format, dot notation provides a path to access a specific data node in the JSON, so the target value of that data node can be found and extracted from the event content by following this path.

[0092] Reference Figure 2 The diagram illustrates the flowchart of the event content filtering method in this embodiment. The CESQL extended expression is rewritten into a CESQL standard expression. A clone event is obtained by copying the original event. The target value, found according to the mapping relationship, is written into the extended attribute of the clone event, ensuring that the target value is written into the extended attribute. The CloudEvents SDK parser parses the CESQL standard expression to obtain an abstract expression. The clone event with the target value written into its extended attribute is used as input to this abstract expression. The CloudEvents SDK evaluator evaluates the abstract expression to obtain the result value. The result value is either true or false. If the result value is true, the event is considered a match; if the result value is false, the event is considered a mismatch.

[0093] Reference Figure 3 The diagram shown is a functional module schematic of the event content filtering device 100 of this application.

[0094] The event content filtering device 100 described in this application can be installed in an electronic device. Depending on the functions implemented, the event content filtering device 100 may include an expansion module 110, a conversion module 120, and an evaluation module 130. The module described in this application can also be called a unit, referring to a series of computer program segments that can be executed by the processor of an electronic device and perform a fixed function, stored in the memory of the electronic device.

[0095] In this embodiment, the functions of each module / unit are as follows:

[0096] Extension module 110: used to extend expressions that only support event context attribute filtering to obtain extended expressions for the event query language, wherein the value identifier of the extended expression is represented using dot notation;

[0097] Conversion module 120: used to convert extended expressions of the event query language into standard expressions of the event query language, wherein the event query language is used to query and / or filter events;

[0098] Evaluation module 130: Used to evaluate the standard expression to obtain the result value of the standard expression, and use the result value of the standard expression to perform event matching in order to achieve the filtering operation of event content.

[0099] In one embodiment, the expansion of the expression that only supports filtering based on event context attributes to obtain an expanded expression for the event query language includes:

[0100] The syntax of the value identifier of the expression that only supports filtering of event context attributes is extended to obtain the extended expression of the event query language.

[0101] In one embodiment, converting the extended expression of the Event Query Language into a standard expression of the Event Query Language includes:

[0102] Find the value identifier represented by each dot notation in the extended expression;

[0103] Generate extended attribute names that conform to the attribute naming conventions for each value identifier;

[0104] Save the mapping relationship between the extended attribute names and the dot notation;

[0105] Based on the mapping relationship, the dot notation in the extended expression is replaced with the extended attribute name to obtain the standard expression of the event query language.

[0106] In one embodiment, the conversion module 120 is further configured to:

[0107] If the extended expression does not contain dot notation, then the extended expression will be used as the standard expression of the event query language.

[0108] In one embodiment, evaluating the standard expression to obtain its result value includes:

[0109] The original event is copied to obtain a cloned event. The target value of the data node is extracted from the event content of the cloned event according to the dot notation, wherein the data node is used to store the specific data of the event.

[0110] Write the target value into the extended properties of the clone event;

[0111] Parse the standard expression to obtain an abstract expression of the standard expression;

[0112] The result value of the standard expression is obtained by evaluating the clone event that contains the target value in the extended attribute and the abstract expression.

[0113] In one embodiment, extracting the target value of the data node from the event content of the cloned event according to the dot notation includes:

[0114] If the event content is in JSON format, then access the path of the data node in the event content and extract the target value of the data node based on the path.

[0115] In one embodiment, evaluating the clone event containing the target value in the extended attribute and the abstract expression to obtain the result value of the standard expression includes:

[0116] The clone event, which contains the target value in the extended attribute, is used as input to the abstract expression for evaluation, resulting in the value of the standard expression.

[0117] Reference Figure 4 The diagram shown is a schematic representation of a preferred embodiment of the electronic device of this application.

[0118] The electronic device includes a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0119] Memory 113 is used to store computer programs, such as event content filtering programs;

[0120] In some embodiments, the processor 111 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 111 is typically used to control the overall operation of the electronic device, such as performing data interaction or communication-related control and processing. In this embodiment, the processor 111 is used to run program code stored in the memory 113 or process data, such as running program code for an event content filtering program.

[0121] The communication interface 112 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The communication interface 112 may also be used to establish a communication connection between the electronic device and other electronic devices.

[0122] The memory 113 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 113 may be an internal storage unit of the electronic device, such as the hard disk or memory of the electronic device. In other embodiments, the memory 113 may also be an external storage device of the electronic device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. of the electronic device. Of course, the memory 113 may include both internal storage units and external storage devices of the electronic device. In this embodiment, the memory 113 is typically used to store the operating system and various computer programs installed on the electronic device, such as program code for event content filtering programs. In addition, the memory 113 may also be used to temporarily store various types of data that have been output or will be output.

[0123] Figure 4 Only an electronic device with components 111-114 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0124] In one embodiment of this application, when the processor 111 executes a program stored in the memory 113, it implements the event content filtering method provided in any of the foregoing method embodiments, including:

[0125] The expression that only supports filtering of event context attributes is extended to obtain an extended expression for the event query language, wherein the value identifier of the extended expression is represented using dot notation;

[0126] Convert the extended expressions of the Event Query Language into standard expressions of the Event Query Language, wherein the Event Query Language is used to query and / or filter events;

[0127] The standard expression is evaluated to obtain its result value, which is then used for event matching to filter event content.

[0128] For a detailed explanation of the above steps, please refer to the above. Figure 1 This document describes a flowchart illustrating an embodiment of a method for filtering event content.

[0129] Furthermore, embodiments of this application also propose a computer-readable storage medium, which can be non-volatile or volatile. The computer-readable storage medium includes a data storage area and a program storage area. The program storage area stores a filtering program for event content. When executed by a processor, the event content filtering program performs the following operations:

[0130] The expression that only supports filtering of event context attributes is extended to obtain an extended expression for the event query language, wherein the value identifier of the extended expression is represented using dot notation;

[0131] Convert the extended expressions of the Event Query Language into standard expressions of the Event Query Language, wherein the Event Query Language is used to query and / or filter events;

[0132] The standard expression is evaluated to obtain its result value, which is then used for event matching to filter event content.

[0133] The specific implementation of the computer-readable storage medium in this application is largely the same as the specific implementation of the event content filtering method described above, and will not be repeated here.

[0134] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0135] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0136] It should be noted that the use of terms such as "first" and "second" in this application is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed in this application.

[0137] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0138] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for filtering event content, characterized in that, The method includes: The expression that only supports filtering of event context attributes is extended to obtain the extended expression of the event query language, wherein the value identifier of the extended expression is represented using dot notation; The extended expressions of the Event Query Language are converted into standard expressions of the Event Query Language, wherein the Event Query Language is used to query and / or filter events; The standard expression is evaluated to obtain its result value, and the result value is used for event matching to achieve event content filtering. The process of evaluating the standard expression to obtain its result includes: copying the original event to obtain a cloned event; extracting the target value of a data node from the event content of the cloned event using dot notation, wherein the data node is used to store the specific data of the event; writing the target value into the extended attributes of the cloned event; parsing the standard expression to obtain an abstract expression of the standard expression; and evaluating the cloned event with the target value written into its extended attributes and the abstract expression to obtain the result value of the standard expression.

2. The event content filtering method as described in claim 1, characterized in that, The expansion of expressions that only support filtering based on event context attributes yields extended expressions for the event query language, including: The syntax of the value identifier for expressions that only support filtering of event context attributes is extended to obtain extended expressions for the event query language.

3. The event content filtering method as described in claim 1, characterized in that, The process of converting extended expressions of the Event Query Language into standard expressions of the Event Query Language includes: Find the value identifier represented by each dot notation in the extended expression; Generate extended attribute names that conform to the attribute naming conventions for each value identifier; Save the mapping relationship between the extended attribute names and the dot notation; Based on the mapping relationship, the dot notation in the extended expression is replaced with the extended attribute name to obtain the standard expression of the event query language.

4. The event content filtering method as described in claim 3, characterized in that, The method further includes: If the extended expression does not contain dot notation, then the extended expression will be used as the standard expression of the event query language.

5. The event content filtering method as described in claim 1, characterized in that, The extraction of the target value of the data node from the event content of the cloned event based on the point representation method includes: If the event content is in JSON format, then access the path of the data node in the event content and extract the target value of the data node based on the path.

6. The event content filtering method as described in claim 1, characterized in that, The step of evaluating the clone event containing the target value in the extended attribute and the abstract expression to obtain the result value of the standard expression includes: The clone event, which contains the target value in the extended attribute, is used as input to the abstract expression for evaluation, resulting in the value of the standard expression.

7. An event content filtering device, characterized in that, The device includes: Extension module: Used to extend expressions that only support event context attribute filtering to obtain extended expressions for the event query language, wherein the value identifier of the extended expression is represented using dot notation; Conversion module: Used to convert extended expressions of the Event Query Language into standard expressions of the Event Query Language, wherein the Event Query Language is used to query and / or filter events; Evaluation module: used to evaluate the standard expression to obtain the result value of the standard expression, and use the result value of the standard expression to perform event matching in order to achieve the filtering operation of event content; The evaluation module is further configured to: copy the original event to obtain a clone event; extract the target value of the data node from the event content of the clone event according to the dot notation, wherein the data node is used to store the specific data of the event; write the target value into the extended attribute of the clone event; parse the standard expression to obtain the abstract expression of the standard expression; evaluate the clone event with the target value written in the extended attribute and the abstract expression to obtain the result value of the standard expression.

8. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method for filtering event content according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for filtering event content as described in any one of claims 1 to 6.

Images