CEP: from Esper back to Akka

COMPLEX EVENT PROCESSING: FROM ESPER BACK TO AKKA

Alexander Solovyev [email protected]

DESCRIPTION OF THE PROBLEM

Complex Event Processing: a method of tracking and analyzing event streams to identify meaningful patterns (such as opportunities or threats) and respond to them as quickly as possible.

Example: changing of…

•  …financial parameters of the client accounts •  e.g. margin level

•  …application parameters / indicators like… •  heartbeats, status of connections •  memory/CPU activity etc.

ABOUT THE PROJECT IN A NUTSHELL

Monitoring Service

•  built on Scala and Akka •  input - a stream of asynchronous events •  HTTP as a transport

•  output - an alert or alerts in case of a problem

BASIC TECHNICAL REQUIREMENTS

•  Scala, or Java, or whatever that can run on JVM •  in-process •  open-source

Nice to have: •  declarative DSL is a plus

AVAILABLE OPTIONS

•  TIBCO StreamBase, Oracle CEP •  commercial

•  Storm •  …not mature at the moment of the choice •  but now might be considered: has a Trident DSL etc.

•  Apache Camel •  more about event routing & transformation •  albeit, http://camel.apache.org/cep.html

•  EsperTech Esper •  meets all the formal requirements •  has a commercial support

OTHER INTERESTING CANDIDATES

•  Akka Streams •  Drools Fusion •  Pivotal Real-Time Intelligence for Telcos (RTI4T) •  Spark Streaming

ESPER

Example: absence of heartbeats. Esper Event Processing Language, a bit simplified query:

select * from pattern [ every Event_A -> (timer:interval(10 sec) and not Event_B)]

…then write a simple Esper event listener and we are done. Isn’t it cute? J …wish it was so…

Margin Level alerting

if within last T seconds margin level is above a given limit during N seconds in sum, than raise the margin level alert.

•  At least three alert levels.

•  No duplicates, no false positives.

MORE COMPLEX EXAMPLE

ESPER PITFALLS

•  EPL has a steep learning curve •  has at least two dialects •  includes quite a few different built-in “views”, functions etc. •  documentation is a reference book plus a set of samples rather than a

tutorial

•  Unit-testing of actors gets more complicated (due to different groups of threads)

An impact on development, and which is even more important, on maintenance.

THE ESCAPE Why wouldn’t just use the Akka framework?

•  out-of-box event handling

•  very cheap state: no need to think about thread synchronization etc.

•  timers to introduce notation of time

Indeed this is more verbose, but we get simplicity in lieu. P. S. Erlang experts often choose a similar approach for tasks like being described above – applying of the actor model.

A NOTE FROM TYPESAFE

There are no technical blockers to use Akka and Esper together. An appropriate template is provided: •  http://typesafe.com/activator/template/akka-with-esper

THANK YOU

…and your questions J