Wednesday, October 31, 2007

Revisiting the "classification of event processing applications - part I"

The picture about is an attempt to classify styles of beards, my first beard has been "goatee and mustache", but after a short period I moved to full beard and persists for more than 30 years, unlike people who grow and remove beards, for me it is an integral part of my personality. Anyway, talking about pictures - for some strange reason the almighty Google has chosen the dog picture I've posted in one of the previous blog as the first answer to the query about "dog" in Google image points at this blog... the wonders of search technology :-)
Now - back to the event processing business, following a comment by PatternStorm (my dear colleague Claudi), I have checked the current definition "complex event processing" in the glossary is somewhat wider than I have remembered, thus, according to it - derived events are subset of complex events, where I thought that some derived events (like enrichment of a single event) are not complex event. Anyway, I am revisiting the classification done in the previous blog, and avoiding the terms "simple event processing" and "complex event processing" - since indeed it has nothing to do with the intuitive meaning of the terms : simple and complex. However, the three classes in terms of type of processing still exists - so I'll repeat them and try different names (but names are always a problem - so any help will be appreciated !).
  • raw event processing: operations on events that do not change the events - just filter and route them.
  • transformed event processing: aggregation and enrichment - this is a type of processing that transform the event. Examples: enrichment it is transformed by adding attributes taken from an external store (e.g. database), translation - create an event with different format / contain translated attributes...
  • Pattern-based event processing -- detecting pattern - and derive events based on the events that participate in the detected pattern.

As said, this is just one of the classifications. More discussions about other classifications - later.


Hans said...

How do you differentiate between "event processing" and just plain processing of network messages? Or do you think that making such a distinction is even worthwhile?

For example, is a router an EP product (since it meets the criteria for type 1)? Or the NAT mechanism in my little Linksys firewall (meeting the criteria for type 2)?

I have no particular opinion on what is EP and what is not and it's definitely not worth arguing about. I was just wondering how you think about it.

Opher Etzion said...

Hello Hans.

There is an overlap between event processing and message processing, there is also overlap between event processing and ESB mediations. I view the event-based programming model as subsuming message processing, and believe that they are on converging path.