Detailed description of the invention
Below in conjunction with the accompanying drawing in the embodiment of the present invention, the technical scheme in the embodiment of the present invention is carried out clearly
Chu, be fully described by, it is clear that described embodiment be only a part of embodiment of the present invention rather than
Whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art are not making creation
The every other embodiment obtained under property work premise, broadly falls into the scope of protection of the invention.
Current stream process software class SQL rule describe in, having keyword, can only retention periods (i.e.
Stream process window) in meet the data that condition is later.In embodiments of the present invention, the first keyword is added (e.g.,
Had keyword), can be to cause all data before and after the condition of reaching in retention periods.And can carry after had
Complex conditions expression formula, can be the conditional expression of single stream, it is also possible to be the conditional expression of multithread.
As it is shown in figure 1, be a flow process of the data processing method based on flow of event in the embodiment of the present invention
Schematic diagram.This flow process comprises the steps:
101, reception belongs to the event of current stream process window.In a streaming process, event is the shape with flow of event
Formula inputs.This event can include that call record, short message send record or record is clicked in website.
102, caching belongs to the event of current stream process window.Can be specifically to belong to the process of current stream by described
The event buffer of window processes in the internal memory of engine to stream.
When the event of caching, it is also possible to cache according to the second expression formula further, i.e. belong to described in judgement
Current stream processes whether the event of window meets second expression formula relevant with the second keyword;If it is determined that knot
Fruit for being unsatisfactory for the second expression formula, is then deleted the current stream that belongs to cached and processes the event of window, and cache
Belong to current stream described in Jie Shouing and process the event of window;Otherwise, belong at current stream described in caching reception
The event of reason window.
Certainly, this expression formula can also be the 3rd expression formula, i.e. judges whether to cache institute according to the 3rd expression formula
State current stream and process the event of window, when judged result is for being, belongs to current stream described in caching and process window
Event.
103, judge whether the event belonging to current stream process window cached meets relevant with the first keyword
The first expression formula.
Wherein, described first keyword can be had keyword.
104, when judged result is for being unsatisfactory for described first expression formula, do not delete cached belong to current stream
Process the event of window, and receive the next event belonging to current stream process window.
105, when judged result is for meeting described first expression formula, the most slow according to described first keyword output
The current stream that belongs to deposited processes the event of window, and wherein said first keyword has cached for indicating output
Belong to current stream process window and meet the event of described first expression formula.
Further, this stream of stream processing procedure in embodiments of the present invention processes window can be to change over
Time window, such as time slip-window, hopping time window etc., then when described current stream process window move time,
Delete the event being not belonging in caching in the stream process window after moving.
Meanwhile, when whether the event belonging to current stream process window judging caching meets have with the first keyword
During the first expression formula closed, cache and described current stream is processed the intermediate computations knot that the event of window processes
Really;When according to when belonging to the event that current stream processes window of the first keyword output caching, output is according to institute
State the final calculation result that results of intermediate calculations obtains.
Said method can be used in Complex event processing CEP system, described CEP system use CQL language,
The CEP rule of EPL language or class SQL describes language.
Accordingly, the embodiment of the present invention additionally provides a kind of current processing device, as in figure 2 it is shown, this device bag
Include: receive unit 10, for receiving the event belonging to current stream process window;Buffer unit 20, is used for delaying
Belong to current stream described in depositing and process the event of window;First expression formula judging unit 30, caches for judgement
The current stream that belongs to process the event of window and whether meet first expression formula relevant with the first keyword;Output
Unit 40, for when the judged result of the first expression formula judging unit is for meeting described first expression formula, presses
The current stream that belongs to cached according to the first keyword output processes the event of window, wherein said first keyword
The current stream that belongs to for indicating output to cache processes window and meets the event of the first expression formula;Circulation is single
Unit 50, is used for when the judged result of the first expression formula judging unit is for being unsatisfactory for described first expression formula, no
Delete cached belong to current stream process window event, and trigger described reception unit receive belong to current
Stream processes the next event of window.
Wherein, buffer unit 20 can specifically for by described belong to current stream process window event buffer to flow
Process in the internal memory of engine.
As it is shown on figure 3, buffer unit 20 comprises the steps that the second expression formula judgment sub-unit 200, it is used for judging
Whether the described event belonging to current stream process window meets second expression formula relevant with the second keyword;Place
Reason subelement 202, for the judged result when the second expression formula judgment sub-unit for being unsatisfactory for the second expression formula
Time, delete the current stream that belongs to cached and process the event of window, and cache and described in reception, belong to current stream
Process the event of window;Otherwise, belong to current stream described in caching reception and process the event of window.Or: slow
Memory cell includes: the 3rd expression formula judgment sub-unit (not shown), for according to the 3rd expression formula judgement being
The described current stream of no caching processes the event of window, when judged result is for being, belongs to current stream described in caching
Process the event of window.
Further, as shown in Figure 4, said apparatus may also include that processing unit 60, for slow when judging
When whether the event belonging to current stream process window deposited meets first expression formula relevant with the first keyword,
Cache and described current stream is processed the results of intermediate calculations that the event of window processes;Described output unit 40
It is additionally operable to, when according to when belonging to the event that current stream processes window of the first keyword output caching, export basis
The final calculation result that described results of intermediate calculations obtains.
Wherein, the event of foregoing description can include that call record, short message send record or record is clicked in website,
Described first keyword is had keyword, and described device is in Complex event processing CEP system, described
CEP system uses the CEP rule of CQL language, EPL language or class SQL to describe language.For this dress
Put other terms in embodiment and details can also with reference to the details in embodiment of the method aforementioned or described later,
Do not repeat.
In embodiments of the present invention when processing first expression formula relevant with the first keyword, even if being unsatisfactory for
This first expression formula the most do not delete cached described in belong to current stream and process the event of window, will not be because of
The event that current stream processes window is unsatisfactory for condition and does not the most retain these events so that when finally exporting, can
Meet the event output of condition with all the causing being processed by stream in window, meet condition without exporting
Event afterwards.
In a particular embodiment of the present invention, when event is call record, can according to the first keyword
The first relevant expression formula output meets the all-calls record of condition, and e.g., the malice finding out user's generation is exhaled
Cry, then according to these call records to data base obtain concrete ticket;Will not be because of meeting condition
Part call record before is not buffered, and causes the ticket finally obtained imperfect.
As it is shown in figure 5, be another idiographic flow schematic diagram of the method for stream processing in the embodiment of the present invention.This
Event is processed by example according to the first expression formula and the second expression formula.
201, reception belongs to the event of current stream process window.
202, judge described in belong to current stream and process the event of window and whether meet relevant with the second keyword the
Two expression formulas.If it is judged that for being unsatisfactory for the second expression formula, then perform 203;If it is judged that be full
Foot the second expression formula, then perform 204.
203, delete stream and process the event belonging to current stream process window cached in the internal memory of engine, and will
Belong to current stream described in Jie Shouing to process in the internal memory that the event buffer of window processes engine to stream.Then perform
205。
204, will receive described in belong to current stream process window event buffer to stream process engine internal memory
In.Then step 205 is proceeded to.
205, judge whether the event belonging to current stream process window cached meets relevant with the first keyword
The first expression formula.When judged result is for being unsatisfactory for described first expression formula, perform 206;Work as judged result
During for meeting described first expression formula, perform 207.
206, when judged result is for being unsatisfactory for described first expression formula, do not delete cached belong to current stream
Process window event, and return step 201 receive belong to current stream process window next event.
207, when judged result is for meeting described first expression formula, cached according to the first keyword output
Belong to current stream and process the event of window.
Flow process can be terminated, it is also possible to return step 201 and continue to next thing after this step performs to terminate
Part.
On the basis of above-described embodiment, the stream in a specific embodiment can be limited and process window as one minute
Sliding window, the first expression formula is that user's subsequenct call number of times is more than or equal to five in this minute sliding window
Secondary;Second expression formula is that adjacent twice call record interval is less than 5 seconds (Δ t < 5s), and the second keyword is
Only record meets the call record of the second expression formula.The rule that then EPL describes is as follows:
Select* from stream.win:time (60sec) group by a had count (*) >=5 where
(timestamp-previous(timestamp))(5s......
Wherein, where (timestamp-previous (timestamp)) < 5s represents, adjacent two things
The time interval of part is less than 5 seconds.The most as shown in Figure 6, the handling process for the flow of event of Fig. 7 is:
301, event 1 is received, owing to event 1 is first event, it is not necessary to judge itself and previous event
Interval, cache this event 1, now the event count in window 1 is 1 (and having 1 < 5), has not the most deleted
The event 1 of caching, but do not export.
302, receive event 2, now judge that the interval between event 1 and event 2 less than 5 seconds, then caches
Event 2 (event belonging to window 1 i.e.: now cached has two, is event 1 and event 2 respectively),
Now the event count in window 1 is 2 (and having 2 < 5), does not the most delete the event 1 and 2 cached, but also
Do not export.
303, receive event 3, now judge that interval between event 2 and event 3 is more than 5 seconds, the most now
Delete the event 1 that cached and event 2, only caching event 3, now the event count in window 1 be 1 (and
Have 1 < 5), the most do not delete the event 3 of caching, but do not export.
304 and when window sliding time then, sliding window.When window 1 slides as window 2 (also
I.e.: now current stream process window is become window 2 from window 1), delete the event of the window that slides out (here
For event 1), then receive and process successor 4~6, count simultaneously and change the most accordingly, and by above-mentioned side
Method proceeds event handling.
305 and when window sliding time then, sliding window.When window 2 slides as window 3 (also
I.e.: now current stream process window is become window 3 from window 2), delete the event of the window that slides out (here
For event 2), receive event 7, now judge that interval between event 6 and event 7 is less than 5 seconds, then this
Time the event that cached be 3~7, now the event count in window is 5 (and having 5=5), does not the most delete the most slow
The event 3~7 deposited, and export the event 3~7 of caching.
306, similar above-mentioned method is used to continue with successor.
Certainly, above-mentioned time slip-window can also be hopping time window, and its handling process is similar to.
As shown in Figure 8, then for flow process event processed according to the first expression formula and the 3rd expression formula.
In this example, the first keyword is had keyword, and the expression formula of the first keyword is count () > 5, the
Three expression formulas are * *!=null, i.e. field * * are not empty.Then for flow of event as shown in Figure 9, it processes
Flow process is:
401, event 1 is received, owing to event 1 is first event, it is judged that its field * * is not empty, caching
This event, now the event count in window 1 is 1 (and having 1 < 5), does not the most delete the event 1 cached,
But do not export.
402, event 2 is received, it is judged that its field * * is not empty, caches this event, the now thing in window 1
Part is counted as 2 (and having 2 < 5), does not the most delete the event 1 and 2 cached, but does not exports.In like manner process
Event 3~5.When window sliding time then, sliding window.When window 1 slides as window 2, delete
Slide out the event of window, count simultaneously and change the most accordingly, and proceed event handling as stated above.
403, event 6 is received, it is judged that its field * * is not empty, and the event the most cached is 2~6, this
Time window in event count be 5 (and having 5=5), the most do not delete the event cached, and export and cache
Event 2~6.
404, similar above-mentioned method is used to continue with successor.
In the above-described embodiments, keyword had can also be with other various window definition, querying condition, mould
Formula definition etc. is used in combination, e.g., Count (a), count ([all | distinct] expression [, filter_expr])
Count (* [, filter_expr]) etc..
By the description of above-described embodiment, in the prior art, in measurement period: single rule is existing
There is keyword (e.g., having), the record after meeting condition can only be exported, the meeting when there being new event to receive
Delete processed event;The all records meeting condition are caused, it is necessary to more rules combines if listed
Realize.And in embodiments of the present invention, in measurement period: the keyword extension of single rule (e.g., increases
Add keyword had), can list and cause all records meeting condition, realize without more rules combination.
The most in embodiments of the present invention, the record buffer memory of expression formula condition after had will be met, when reaching rule
(for simple event count, it is not inconsistent during expression formula condition after defining output condition or not being inconsistent had
After had, expression formula condition does not the most output, but for complex situations, as there is the situation of classified statistics,
Event is the record of the event in different grouping, and such as packet A may meet 5 times, then packet A's
Record just outputs, and packet B does not meet 5 times, then the record relevant with packet B does not the most export),
After meeting had, all records of expression formula condition export, and empty caching and are further continued for counting.
One of ordinary skill in the art will appreciate that all or part of flow process realizing in above-described embodiment method,
Can be by computer program and complete to instruct relevant hardware, described program can be stored in a calculating
In machine read/write memory medium, this program is upon execution, it may include such as the flow process of the embodiment of above-mentioned each method.
Wherein, described storage medium can be magnetic disc, CD, read-only store-memory body (Read-Only Memory,
Or random store-memory body (Random Access Memory, RAM) etc. ROM).
Above disclosed only one preferred embodiment of the present invention, can not limit this with this certainly
Bright interest field, the equivalent variations therefore made according to the claims in the present invention, still belong to what the present invention was contained
Scope.