What data structures and algorithms are suitable for event stream correlation? Specifically, I am looking at these two use cases:
- X occurrences within t seconds grouped by some variables (v1,v2). For example, 5 failed login attempts within a minute grouped by service such as SSH or FTP and IP address.
- Event A is followed by events B and C grouped by some variables (v1,v2) within a time-frame t.
In terms of actual implementation, I have found the Simple event Correlator to be approximately what I am looking for, but it's a big blob of perl...