Methods, systems, and computer program products for event decomposition using rule-based directives and computed keys

A computer program product for generating a common event format representation of information from a plurality of messages, comprising:

• a computer readable medium having computer readable program code embodied therein, the computer readable program code comprising:
• computer readable program code configured to parse a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message;
• computer readable program code configured to obtain the property value from the previous message if the rule specifies to obtain the property value from the previous message;
• and
• computer readable program code configured to populate the common event format representation for the current message with the obtained property value from the previous message.

A system for generating a common event format representation of information from a plurality of messages, comprising:

• means for parsing a rule associated with a current message to determine if a property of a common event format representation for the current message is to be populated with a property value from a previous message;
• means for obtaining the property value from the previous message if the rule specifies to obtain the property value from the previous message;
• and
• means for populating the common event format representation for the current message with the obtained property value from the previous message.

A method of generating a common event format representation of information from a plurality of messages, comprising:

• parsing a rule associated with a current message to identify regular expressions therein;
• parsing the rule to determine if a property of the common event format representation for the current message is to be populated with a property value determined by specified code;
• obtaining the property value using the specified code if the rule specifies to obtain the property value using the specified code, wherein execution of the specified code is based on execution of at least one of the identified regular expressions;
• and
• populating the common event format representation for the current message with the obtained property value.