Skip to content

Event Analytics

Idea

The Event Analytics Service provides essential functionalities for a data-driven analysis of event data. It enables the user to use statistical analysis to get a better understanding of what is happening inside the system.

The services can be used to drive the following use cases:

  • Alarm management
  • System troubleshooting
  • Root cause analysis: identification of the root causes of faults or problems

Access

For accessing this service you need to have the respective roles listed in Analytics Services roles and scopes.

Basics

Almost all programmable devices emit event data, each event being represented by a text message with a corresponding timestamp. Event data can be leveraged in order to create economic value. By analyzing it, we can extract additional knowledge and uncover useful patterns and hidden relationships between the emitted events. In return, it can not only help us to better understand the system's behavior and dynamics, but also drastically increase the effectiveness of system management and support reasoning.

The Event Analytics Service processes event data sets as tuples of the data types time and string. For optimal performance of the Event Analytics Service it is recommended to limit the data volume to 1 MB and at most 1000 events.

Event Count

The Event Analytics Services provide functionality to divide a given dataset into time intervals of a user defined length (e.g. 10 s) and count the number of events per interval. The result lists each interval's start and end time as well as the number of events in this interval. The intervals with the highest event density could be further analyzed.

Event Filter

Event Filter allows the user to reduce a dataset to its most meaningful state by specifying a list of events to remove. Typically, one would remove events with the following characteristics:

  • Already known to be harmful, and thus do not provide additional information
  • Already known to be harmless, and thus do not provide additional information
  • Coming from an interfering process, and thus can be considered noise

Duplicate Events Removal

The Event Analytics Service can detect and remove duplicate events of a given dataset. These can be two successive events caused by the same sensor or identical successive events collected by parallel threads. The user can define the width of a sliding window (e.g.: 10 s), in which duplicate events shall be detected. The service moves this window along the given dataset, determines all duplicate events, and reduces the dataset by removing them.

Pattern Matching

The Pattern Matching searches for user defined patterns in an event list. The service moves a sliding window along the given dataset and detects, which events match with the given patterns. The user defines the width of this sliding window as well as a list of events to be ignored in this process. The result lists the user defined patterns along with the matched events and the time window, in which they occur.

Top Events

The Event Analytics Services provide functionality to group events with identical event text and count the occurrences. The result lists the different events with their number of occurrences in descending order. It can be used to save time in the analysis of large log files, when looking for most frequently occurring events.

Features

The Event Analytics API exposes its endpoints for realizing the following tasks:

  • Find most frequently occurring events within the complete input dataset.
  • Reduce the dataset to the most meaningful by removing the specified events.
  • Partition input event sequence into segments and count all event occurrences in each segment.
  • Partition input dataset into multiple segments and remove duplicate events within each segment.
  • Match the patterns on the events input list.

Example Scenario

The manager of a brewery wants to get deeper insight into the factory's production line to find possible reasons for repeatedly occurring unexpected downtimes.

The manager collects all available event data between successively occurring downtimes, feeds these into the Event Analytics API and evaluates the analysis.

Any questions left?

Ask the community


Except where otherwise noted, content on this site is licensed under the MindSphere Development License Agreement.