1. Chapter 6
Event Patterns, Rules, and
2. Topics covered in this Chapter
Familiar kinds of pattern searching
A strawman event pattern language
Event pattern rules
Event pattern constraints
Capturing business rules as event patterns
3. 6.1 Common Kinds of Pattern
● We need to be able to describe a pattern of events
that we are interested in and quickly find the sets of
events that match the pattern.
● To do this, we first need a precise method to describe
● One way is to write the pattern in a computer language
called an event pattern language(EPL).
4. 6.1 Common Kinds of Pattern
● Another way, which many of us are familiar with, is to
use a graphical user interface(GUI) such as those
provided in popular Web search engines.
○ Unfortunately, search GUIs usually allow only very simple
patterns to be described
5. 6.1 Common Kinds of Pattern
● Pattern matching applied to other kinds of object than
events, such as strings and files, has been around a lot
longer than the Internet.
6. 6.1 Common Kinds of Pattern
● In CEP we need to specify sets of events that have
certain common data in some of the events and also
have specific timing, causal, and aggregation
relationships between events.
● The need to specify sets of events that have parts in
common and specific relativities is a step beyond
● A pattern language in which we can express such
pattherns will necessarily be more complex than string
7. 6.2 Event Patterns
● An event pattern is a template that matches certain
sets of events - the sets you want to find.
● It describes precisely not only the events but also their
causal dependencies, timing, data parameters, and
● So an event pattern is a template for posets.
8. 6.2 Event Patterns Example
All orders from customer C in the last month
● To see if an order matches this pattern, we must look at
the data in the order to see if the customer is C and the
time bound is met.
9. 6.2 Event Patterns Example
All orders from frequent customers in the last
● The second pattern is similar to the first one, except
that instead of searching the data in an order to see
if the customer is C, we must evaluate the context
of the customer.
● for example, by searching a database to see if the
customer is part of the state in which the matching take
10. 6.2 Event Patterns Example
Filter Pattern 1/2
All orders from customers in response to a discount
● We interpret “in response to” as a causal relationship.
● The pattern picks out from the set of all order events
those orders that are caused by the announcement.
● It acts as a filter using the causal relationship between
an order event and the announcement event to reduce
the space of events to a small part of the incoming
11. 6.2 Event Patterns Example
Filter Pattern 2/2
12. 6.2 Event Patterns Example
Complex Pattern 1/2
All orders from customers at the regular price that have led to the
customer requesting a reduced price in response to the discount
● The fourth pattern is more complicated.
● Matching this pattern uses relationships between three
events: the order, the announcement, and the request in
the poset of incoming events.
● This kind of pattern is beyond the power of expression
of most event pattern languages.
13. 6.2 Event Patterns Example
Complex Pattern 2/2
14. 6.3 A Strawman Pattern Language
● A Strawman Pattern Language: STRAW-EPL
● This is not a powreful event pattern language.
● STRAW-EPL can be used to specify patterns with three
relational operators: and, or, ->(causes)
● Some examples
○ A and B and C: Matches a set of three events, A, B, C
○ A or B or C: Matches any one of A, B, or C
○ A -> B: Matches pairs of events A, B where A causes B
15. 6.3 A Strawman Pattern Language
Four Elements of STRAW-EPL 1/2
● Variables are declared with their types:
○ A variable M of type Message: Message M;
○ A variable T of type Time: Time T;
● Event types have a name and a parameter list of
variables and their types:
○ A Send event: Send(Message M, Bit B, Timt T);
○ A ReSend event: ReSend(Message M, Bit B, Time T);
16. 6.3 A Strawman Pattern Language
Four Elements of STRAW-EPL 2/2
● A pattern is a set of event templates together with
relationships between the event templates:
○ A Send and Resend with the same message and bit,, and
possibly different timestamps: Send(M, B, T1) and ReSend(M,
● A context condition is a test that must be true when the
pattern is matched:
○ The time between the Send and ReSend event must
be less than a bound: 0 < T2 - T1 < 10;
17. 6.3.1 Pattern Matching
● Each match of a pattern is a poset that is an instance of
the pattern constructed by replacing variables in the
pattern with the values.
● A variable must be replaced by the same value
wherever it occurs in the pattern.
● The process of replacing variables in a pattrn with
values is called matching.
18. 6.3.2 Writing Patterns in STRAW-EPL
● Patterns in STRAW-EPL are written in a tabular format.
● The table gives the name of the pattern and each of its
● The tabular format declares
○ the variables(also called placeholders) in the pattern
together with their types,
○ the types of events in the pattern,
○ the relational operators used in the pattern,
○ the pattern,
○ and the context test.
19. 6.3.2 Writing Patterns in STRAW-EPL
Example Pattern: Data Transfer
Pattern: Data Transfer
Data D, Bit B, Time T, Time T1, Time T2
Send(Data D, Bit B, Time T)
Receive(Data D, Bit B, Time T)
Ack(Bit B, Timt T)
RecAck(Bit B, Time T)
Send(D, B, T1) -> Receive(D, B, T) -> Ack(B, T) -> RecAck
T2 - T1 < 10 secs
20. 6.3.2 Writing Patterns in STRAW-EPL
Example Pattern: StockTrade Messsage Test
Pattern: StockTrade Message Test
Subject S, Message M, String Id, Time T, Time T1, Time T2
Publish(Subject S, String Id, Message M, Time T)
Receive(Subject S, String Id, Message M, Time T)
Publish(S, Id, M, T) and Receive(S, Id, M, T)
T2 - T1 < 35 mins and S = “StockTrade”
21. 6.4 Event Pattern Rules 1/3
● An event pattren rule is reactive rule that specifies an
action to be taken whenever an event pattern is
● An event pattern rule implies a causal relationship
between the events that trigger it by matching its pattern
and the events that are created when the rule executes
● A reactive rule has two parts:
○ A trigger, which is an event pattern
○ An action, which is an event that is created
whenever the trigger matches
22. 6.4 Event Pattern Rules 2/3
● The causal implication is, whenever an event pattern
rule is triggered by a poset of events, the event it
creates is caused by the triggering events.
● The triggering events are causal ancestors of the new
23. 6.4 Event Pattern Rules 3/3
● Reactive rules can be either sequential or parallel.
○ A sequential rule implies that all its triggerings take
place in a sequence, one after the other.
○ A parallel rule implies that its triggerings take place
independently, as if executed by new threads of
24. 6.4 Event Pattern Rules 1/2
Example Rule: Warning of late network data transfer
Node N1, N2, Data D, Bit B, Time T1, T2, T3, T4
Send(Node N1,Node N2, Data D, Bit B, Time T1)
Receive(Node N1,Node N2, Data D, Bit B, Time T1)
Ack(Node N1,Node N2, Bit B, Timt T1)
RecAck(Node N1, Node N2, Bit B, Time T)
Warning(Node N1, Node N2, Time T1, Time T2)
Relational operators ->(causes)
Send(N1, N2, D, B, T1) -> Receive(N2, N1, D, B, T2) ->
Ack(N2, N1, B, T3) -> RecAck (N1, N2, B, T4)
T4 - T1 < 1 hour
create Warning(N1, N2, T1, T4)
25. 6.4 Event Pattern Rules 2/2
Example Rule: Warning of late network data transfer
26. 6.5 Constraints 1/3
● A constraints expresses a condition that must be
satisfied by the events observed in a system.
● Constraints can be used to specify not only how a target
system should behave, but also how its user should use
● Our strawman constraints express a very simple of
condition called never constraints.
● A never constraint consists of the following:
○ The temporal operator never
○ A STRAW-EPL pattern
27. 6.5 Constraints 2/3
Never Confirm and Then Cancel an Order
Customer Id, Item I, OrderNo N, Dollars Price, Time T1, Time T2
Confirm(Customer Id, OrderNo N, Item I, Dollars Price, Time T1)
Deny(Customer Id, OrderNo N, Item I, Dollars Price, Time T1)
Confirm(Id, N, I, Price, T1) and Deny(Id, N, I, Price, T2)
T1 <= T2
28. 6.5 Constraints 3/3
● The purpose of a rule is to create new events in
response to situations.
● The purpose of a constraints is different, simply to
monitor for a situation.
● Typically, a constraint is used to express a requirement
on system behavior that is not guaranteed by the