# US 2019/0317835 A1 · Management of events in event management systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0317835 A1 - Document ID: US20190317835A1 - Status: Published application - Kind: A1 - Application number: 15/951,247 - Filed: 2018-04-12 - Published: 2019-10-17 - Earliest claimed: 2018-04-12 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Paul B. French; Gerd Breiter; Kristian J. Stewart; John Lee - Web page: https://patentgrep.com/patent/US20190317835A1 ## CPC - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 16/211: {Schema design and management} - G06F 16/2477: {Temporal data queries} - G06F 16/258: {Data format conversion from or to a database} - G06F 16/288: {Entity relationship models} - G06F 16/84: Mapping; Conversion - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system, method and computer program product are provided for improved management of events. A plurality of events is received from an event source. Each event comprises event data relating to a monitored system associated with the event source. A set of data fields in the event data of the plurality of events is identified. One or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields are determined. A mapping of the event data of the plurality of events to a predefined common format is determined, based on the one or more relationships. ## Claims ### Claim 1 A method comprising: receiving a plurality of events from an event source, each event comprising event data relating to a monitored system associated with the event source; identifying a set of data fields in the event data of the plurality of events; determining one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields, and determining a mapping of the event data of the plurality of events to a predefined common format, based on the one or more relationships. ### Claim 2 (depends on 1) The method of claim 1, further comprising: identifying an anchor field in the identified set of data fields, wherein the anchor field has a high frequency of occurrence in the plurality of events and has a relatively small number of distinct values greater than one, and analyzing the events to determine relationships between the anchor field and at least one other data field in the set of data fields. ### Claim 3 (depends on 2) The method of claim 2, wherein analyzing the events identifies one or more sub-anchor fields of the anchor field, wherein each sub-anchor field is present in all the events in the plurality of events when the anchor field has a particular value. ### Claim 4 (depends on 3) The method of claim 3, wherein determining one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields comprises: determining a condition that defines the relationship between each sub-anchor field and the anchor field in the set of data fields. ### Claim 5 (depends on 2) The method of claim 2, wherein analyzing the events is performed iteratively until all relationships between each data field and the other data fields in the set of data fields are determined. ### Claim 6 (depends on 1) The method of claim 1, further comprising: comparing at least one data field in the set of data fields for the plurality of events with data fields in a set of data fields for events provided by another event source to determine one or more relationships between data fields for the plurality of events and data fields for events provided by the other event source. ### Claim 7 (depends on 6) The method of claim 6, wherein the comparing determines one or more relationships selected from the group consisting of: an exact match between the names or values of fields and their relationships; a similarity between the names or values of fields and their relationships, and a cognitive match between names or values of fields and their relationships, including a match in meaning of the names or values or the phonetic or translated equivalents thereof. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining one or more relationships between at least one data field in the set of data fields and at least one data field of the predefined common format, and comparing determined relationships between at least one data field in the set of data fields and at least one data field of the predefined common format with known relationships between data fields of events provided by another event source and the data fields of the predefined common format. ### Claim 9 (depends on 1) The method of claim 1, wherein determining a mapping of the event data of the plurality of events to a predefined common format, based on the determined one or more relationships, comprises: determining a mapping rule, for mapping data of a data field to a corresponding data field of the predefined common format. ### Claim 10 (depends on 1) The method of claim 1, further comprising: deploying a normalizer in an event management system, wherein the normalizer is configured to implement the determined mapping of the event data of the plurality of events to the predefined common format for events received by the event management system from the event source. ### Claim 11 (depends on 10) The method of claim 10, further comprising: determining an event model of events received from the event source, and deploying a validator in the event management system, wherein the validator is configured to validate events received by the event management system from the event source, wherein: if a received event from the event source is validated, the validator forwards the event data for the received event to the normalizer, or if a received event from the event source is not validated, the validator stores the event data in memory and issues a notification indicating that the event model and/or normalizer requires updating. ### Claim 12 (depends on 10) The method of claim 10, further comprising: receiving at least one new event from the event source; identifying new fields in the set of data fields in the event data, based on the at least one new event from the event source; analyzing the at least one new event, to determine one or more relationships selected from the group consisting of: relationships between at least one data field and at least one other data field in the new event, and relationships between at least one data field in the new event and at least one data field of the predefined common format, and updating the determined mapping of the event data of events from the event source to the predefined common format, based on the analysis. ### Claim 13 An apparatus comprising: an event learning system comprising a processor and memory, wherein the processor is configured to: receive a plurality of events from an event source, each event comprising event data relating to a monitored system associated with the event source; identify a set of data fields in the event data of the plurality of events; determine one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields, and determine a mapping of the event data of the plurality of events to a predefined common format, based on the determined one or more relationships. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the processor is further configured to: identify an anchor field in the identified set of data fields, wherein the anchor field has a high frequency of occurrence in the plurality of events and has a relatively small number of distinct values greater than one, and analyze the events to determine relationships between the anchor field and at least one other data field in the set of data fields. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein analyzing the events identifies one or more sub-anchor fields of the anchor field, wherein each sub-anchor field is present in all the events in the plurality of events when the anchor field has a particular value, wherein the processor is further configured to: determine a condition that defines the relationship between each sub-anchor field and the anchor field in the set of data fields. ### Claim 16 (depends on 14) The apparatus of claim 14, wherein the processor is further configured to: analyze the events iteratively until all relationships between each data field and the other data fields in the set of data fields are determined. ### Claim 17 (depends on 13) The apparatus of claim 13, wherein the processor is further configured to: compare at least one data field in the set of data fields for the plurality of events with data fields in a set of data fields for events provided by another event source to determine one or more relationships between data fields for the plurality of events and data fields for events for events provided by the other event source. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the processor is configured to determine one or more relationships between data fields for the plurality of events and data fields for events provided by the other event source selected from the group consisting of: an exact match between the names or values of fields and their relationships; a similarity between the names or values of fields and their relationships, and a cognitive match between names or values of fields and their relationships, including a match in meaning of the names or values or the phonetic or translated equivalents thereof. ### Claim 19 (depends on 13) The apparatus of claim 13, wherein the processor is further configured to: determine one or more relationships between at least one data field in the set of data fields and at least one data field of the predefined common format, and compare determined relationships between at least one data field in the set of data fields and at least one data field of the predefined common format with known relationships between data fields of events provided by another event source and the data fields of the predefined common format. ### Claim 20 A computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein the program instructions are executable by a processor to cause the processor to: receive a plurality of events from an event source, each event comprising event data relating to a monitored system associated with the event source; identify a set of data fields in the event data of the plurality of events; determine one or more relationships between at least one data field in the set of data fields and at least one other data field in the set of data fields, and determine a mapping of the event data of the plurality of events to a predefined common format, based on the determined one or more relationships.