Event Filtering

Highly loaded AggreGate servers process millions of events per hour. To mark out important events from the incoming event stream, AggreGate users may create and manage event filters. A filter is owned by whoever created it, but may be shared between users due to the flexible permissions setup.

Events may be filtered by:

• Source (device, a group of devices, system resource, or a group of resources).
• Event type.
• Event level (severity).
• Any custom criteria defined by expression.

Filtering by expression makes event filters extremely flexible. Here are just some examples of how it may help:

• Finding events fired within a specific date/time range.
• Finding Login events of a specific user (i.e. filtering by username).
• Finding all events that contain a certain substring in any of their data fields.


Event Filter

• Finding all temperature readings collected when temperature was higher than 120 degrees.
• Filtering events matching condition X and/or condition Y, or more complex combinations.

In addition to the selection criteria, filters include event list visualization rules:

• Visibility of event's basic parameters, i.e. source, type, level and acknowledgements.
• Visibility of individual event-specific fields.
• Custom expression-based and level-based highlighting rules.

In addition to user-level filters, each server has pre-filtering rules allowing to discard certain events before they are saved in the database of routed to any destination

A filter can be made to prompt an operator for certain parameters every time it is activated.

AggreGate Server distribution includes a set of built-in filters for viewing major system events, device events, alerts, etc.