Alert notification on streaming textual data

A non-transitory computer readable storage medium having computer readable program code stored thereon for causing a computer system to perform a method for performing alert notification on streaming textual data, the method comprising:

• receiving streaming textual data;
• generating a plurality of copies of the streaming textual data;
• transmitting a first copy of the streaming textual data to an ingestion service for persistent storage at a data plane;
• transmitting a second copy of the streaming textual data to an alert evaluation service for performing alert evaluation on the streaming textual data, wherein the ingestion service is performed on the first copy of the streaming textual data and the alert evaluation service is performed on the second copy of the streaming textual data independently and concurrently;
• storing the first copy of the streaming textual data at a persistent data store of the data plane;
• evaluating the second copy of the streaming textual data by the alert evaluation service to detect an alert, wherein the evaluating the streaming textual data by the alert evaluation service to detect the alert comprises:
• comparing streaming textual data to alert conditions;
• and
• responsive to satisfying the alert conditions, detecting the alert;
• wherein the alert conditions comprise a single instance alert condition for detecting the alert in response to identifying a single match between the streaming textual data and the single instance alert condition and, a windowed alert condition for detecting the alert in response to identifying a predetermined number of matches between the streaming textual data and the windowed alert condition with a predetermined time window;
• and
• responsive to detecting an alert at the alert evaluation service, generating a notification of the alert.

A computer system comprising:

• a data storage unit;
• and
• a processor coupled with the data storage unit, wherein the processor when executed:
• receives streaming textual data;
• generate a plurality of copies of the streaming textual data;
• transmits a first copy of the streaming textual data to an ingestion service for persistent storage at a data plane;
• transmits a second copy of the streaming textual data to an alert evaluation service for performing alert evaluation on the streaming textual data, wherein the ingestion service is performed on the first copy of the streaming textual data and the alert evaluation service is performed on the second copy of the streaming textual data independently and concurrently;
• store the first copy of the streaming textual data at a persistent data store of the data plane;
• evaluates the second copy of the streaming textual data by the alert evaluation service to detect an alert by comparing streaming textual data to alert conditions and detecting the alert responsive to satisfying the alert conditions, wherein the alert conditions comprise a single instance alert condition for detecting the alert in response to identifying a single match between the streaming textual data and the single instance alert condition, and a windowed alert condition for detecting the alert in response to identifying a predetermined number of matches between the streaming textual data and the windowed alert condition with a predetermined time window;
• and
• generates a notification of the alert responsive to detecting an alert at the alert evaluation service.