Skip to main content

CEP Overview

CEP(Complex Event Processing) is a layer that immediately determines «what is happening now» from a stream of events. Instead of storing data and then querying it, it makes determinations as data arrives.

"Escalate if an alarm of severity 3 or higher occurs and another of severity 4 or higher occurs on the same equipment within 10 seconds" — "Mark as unreleased if an alarm is triggered but no release signal arrives for 30 minutes"

Rules are written in EQL(PlantPulse CEP SQL).

The language comes first; the engine simply executes it​

       EQL 문장
          │
          ▼
     의미 분석 ─────────► 판정 셋: SUPPORTED · UNSUPPORTED · UNPARSEABLE
          │
          ▼
      공통 IR (엔진 독립)
          │
    ┌─────┴─────┐
    ▼           ▼
  Aster CEP   Flink
  (기본)      (오라클 — 운영에 쓰지 않습니다)
LanguageEQL 1.0 — SQL-92 Core + Streaming Extensions
Default BackendAster CEP — KOPENS proprietary engine (dynamic rule deployment)
FlinkThe Oracle — Used to cross-check answers by running the same statement alongside Aster CEP. It does not run in production
Only «one» engine runs at runtime

One backend is selected at boot; there is no per-statement routing or fallback.

If two run simultaneously, the traceability of 「which engine produced this result」 is lost, and the same input is published twice — a defect actually encountered. Differential execution is performed in CI, and two engines never run together in production.

No fallback means «nowhere to go»

Statements that the booted backend cannot read are rejected during registration. They may be stored but are marked as REJECTED and are not silently passed to another engine.

Rejections always provide a name — they specify via tokens which configuration is blocked. If silently ignored, a statement would be planned, deployed, and produce a plausible but incorrect answer.

What EQL is and is not​

  • It is not a compatibility project for other products. It does not implement every language feature of other CEP products. However, statements currently in operation must continue to run.
  • It is not a nickname for Flink SQL. It is based on SQL-92 and is extended only for streaming requirements.
  • The backend does not define the language. The language exists first, and the backend executes it.
PlantPulse CEP SQL (EQL)
  │
  ├── SQL-92        SELECT · FROM · WHERE · JOIN · GROUP BY
  │                 (+ HAVING · ORDER BY · LIMIT · DISTINCT · CASE · CAST)
  │
  └── CEP 확장      WINDOW · OUTPUT … EVERY · INSERT INTO · 스트림 필터
                    MATCH_RECOGNIZE · pattern[...] · 부재 패턴

Extensions are reserved only for features not in the standard. Standard expressions are not recreated as new keywords.

Data Flow​

  • Input is via Valkey stream, default prefix PP:CEP-IN-STREAM, 16 shards.
  • Output is a Valkey topic, with one topic per statement.
  • The authoritative source for rules and event types is PostgreSQL (cep_statement · cep_event_type).

First 10 Minutes​

# 1. 어느 백엔드로 떴나 — 판정 지표는 «로그 한 줄» 입니다
docker exec plantpulse-datalake sh -c 'grep "CEP input path" /opt/kopens/.../system.log | tail -1'
# CEP input path: aster.

# 2. 서버가 살아 있나 (익명 readiness)
curl -fsS http://127.0.0.1:7400/api/health

# 3. 문장이 몇 개 등록됐고 몇 개가 거부됐나
curl -fsS -H "X-API-Key: ${PP_CEP_API_KEY}" http://127.0.0.1:7400/api/v1/eql/registration

# 4. 이 문장들이 다른 백엔드에서도 도나
curl -fsS -H "X-API-Key: ${PP_CEP_API_KEY}" http://127.0.0.1:7400/api/v1/eql/portability
ingest.rate_1m is not evidence

Inflow increases regardless of which engine is active. A single line in the boot log reveals which backend is running.

Register event types first

Statements based on unregistered types will be compiled, deployed, and run, but they will never match. Therefore, they are rejected at the time of deployment → Register Event Type

Section Structure​

PageWhen to view
EQL LanguageWhen writing statements — clauses, windows, aggregation, patterns, and running examples
BackendsWhich engine to deploy, how to handle portability with cep.mode
Event Type RegistrationWhen introducing a new event to CEP for the first time
OperationsStart/Stop · Reading registration results · I/O contracts
Limits and Rejection TokensFind the meaning of the rejection line here when registration fails