plantpulse-cep (Complex Event Processing)

Role

This is the Complex Event Processing layer. It detects temporal and logical patterns of multiple events in real-time to perform alarms, Flow triggers, and automation. Rules are written in EQL (PlantPulse CEP SQL).

Item	Value
Module Name	plantpulse-cep
Installation Path	/opt/kopens/plantpulse-platform/plantpulse-cep/
Port	7400 (HTTP) · 7401 (TLS)
Execution Engine	One at boot — Aster CEP (cep.backend=aster, same even if not configured)
pd Service	cep — MASTER only
API Authentication	X-API-Key: <PP_CEP_API_KEY>
Console Login	PP_CEP_WEB_USER / PP_CEP_WEB_PASSWORD — If empty, only the console is closed

Language, backend, operation, and limits are in dedicated sections

This page covers modules and files. For how to write and execute statements, refer to the CEP section.

Usage Example

"If an alarm is triggered and is not cleared for 30 minutes, report as uncleared"

SELECT a.machineId AS machine
FROM pattern [every a=AlarmEvent -> not ClearEvent for 30 min]

Configuration

The API, console, and engine are in the same process. Only one engine selected at boot is running.

Directory Structure

plantpulse-cep/
├── config/plantpulse-cep.properties     # 생성물 ← plantpulse-datalake-cli 의 템플릿
├── bin/start.sh
├── logs/
└── server/                              # 내장 Tomcat — webapps/ROOT.war · logs/catalina.<date>.log

Key Settings

# 백엔드 — 부팅 시 하나. 미설정이면 이전 것을 그대로 유지한다
cep.backend=aster
#cep.mode=native                       # native | portable

# 이벤트 입력 (Valkey 스트림)
cache.host=${PP_REDIS_HOST}
cache.port=${PP_REDIS_PORT}
cache.password=${PP_REDIS_PASSWORD}
cache.ssl.enabled=false
cep.stream.shard_count=16
cep.consumer.thread_count=16

# 룰 · 이벤트 타입 레지스트리 (PostgreSQL datalake DB — CEP 가 표를 스스로 만든다)
jdbc.datalake.url=jdbc:postgresql://${PP_POSTGRES_HOST}:${PP_POSTGRES_PORT}/datalake
jdbc.datalake.username=${PP_DATALAKE_DB_USER}
jdbc.datalake.password=${PP_DATALAKE_DB_PASSWORD}

# 운영 지표 (Cassandra)
storage.host=${PP_CASSANDRA_HOST}
storage.keyspace=${PP_KEYSPACE}
cep.storage.ttl_seconds=864000        # 10일

# 인증
cep.api.key=${PP_CEP_API_KEY}
cep.web.user=${PP_CEP_WEB_USER}
cep.web.password=${PP_CEP_WEB_PASSWORD}
cep.api.max_eql_text_length=100000

cep.flink.* only applies when booted with Flink

cep.flink.reconciler.enabled and cep.flink.router.enabled remain in the same file. If booted with a different backend, they are ignored, and the name is logged once.

There have been cases where these were left on and booted with another backend, resulting in the same statement running on two engines and results being published twice → Backends

The procedure for changing values is How to change configuration, and API key rotation is Change passwords and API keys.

Key APIs

Path	Function
POST /api/v1/eql/deploy	Statement registration
POST /api/v1/eql/validate	Determination only — SUPPORTED / UNSUPPORTED / UNPARSEABLE
DELETE /api/v1/eql/undeploy/{id}	Deregistration
GET /api/v1/eql/registration	Registration result table (ACTIVE / REJECTED)
GET /api/v1/eql/portability	Portability
GET /api/v1/eql/metrics/snapshot · /metrics/engine	Match rate and output rate per statement, engine metrics
GET·POST·PUT·DELETE /api/v1/event-types	Event type registration
GET·POST·DELETE /api/v1/keys	API key
GET /api/health	Anonymous readiness — engine, cache, schema

Operational Commands

docker exec plantpulse-datalake pd status cep
docker exec plantpulse-datalake pd restart cep
docker exec plantpulse-datalake pd logs --lines 200 cep

# 어느 백엔드로 떴나 — 판정 지표는 로그 한 줄이다
docker exec plantpulse-datalake sh -c 'grep "CEP input path" ... | tail -1'

curl -fsS http://127.0.0.1:7400/api/health

Frequently Occurring Issues

Symptom	Cause	Action
Registration remains as REJECTED	The booted backend cannot accept that configuration	Find that line in the Rejection token
Registration rejected with 400	Unregistered event type	Event type registration
CEP does not start at all	cep.backend typo or missing runtime WAR	The log specifies the name. There is no fallback
Results are not arriving anywhere	Zero subscribers	no subscriber in the log
Same result arrives twice	Booted with another backend while cep.flink.* switch was on	Backends
Health is DEGRADED, table name in reason	CEP owner table is missing	Check DB connection (jdbc.datalake.*) and restart — it creates itself during startup
API 401	API key mismatch	passwd.sh PP_CEP_API_KEY
Console login rejected	PP_CEP_WEB_PASSWORD is empty	Web screen login accounts

Related Documents

• CEP section — Overview, EQL, Backends, Event Types, Operation, Limits
• Datalake Overview
• CEP Console (7401)
• CEP Client