Presentation from ZeroNights 2015 devoted to Esper library and the features it has to perform complex security event processing (correlating). Basic and advanced features was considered and custom made correlation engine which able to work together with logstash was presented