Managing large volumes of event data records

A network device, comprising:

• a processor;
• and
• a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
• receiving, from a record collection device, first data comprising an aggregated event data record that is aggregated to a first level of aggregation based on a first data key and represents an aggregation of first raw event data records describing events of a first period logged by devices of a network;
• determining that a volume of aggregated event data records, comprising the aggregated event data record, is less than a defined threshold;
• instructing the record collection device to terminate the aggregation of the first raw event data records and to transmit second data comprising second raw event data record describing events of a second period logged by the devices;
• and
• receiving the second data.

A method, comprising:

• receiving, by a network device comprising a processor, first data comprising first event data records describing events of a first period logged by devices of a network, wherein the first event data records are not aggregated;
• determining, by the network device, a volume of the first event data records exceeds a defined threshold;
• determining, by the network device, aggregation data indicative of an aggregation profile to apply to second event data records describing events of a second period logged by the devices, wherein the aggregation profile comprises configurable elements comprising aggregation key data representing a key employable to aggregate the second event data records and aggregation time data representing a defined time interval employable to aggregate the second event data records;
• and
• receiving, by the network device, second data comprising an aggregated representation of the second event data records, wherein the aggregated representation corresponds to the aggregation profile.