Abstract:
A non-transitory computer-readable medium including a program, which when executed by a computer, causes the computer to execute a process including collecting data item indicating specific criteria relating to a plurality of rules for gradually filtering a received data; and selectively extracting specific data relating to the collected data item indicating the specific criteria from content of the received data.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application is based upon and claims the benefit of priority from the prior Japanese Patent Application No. 2013-223724 filed on Oct. 28, 2013, the entire contents of which are incorporated herein by reference. 
       FIELD 
       [0002]    The embodiments discussed herein are related to a medium, a method, and an apparatus. 
       BACKGROUND 
       [0003]    In recent years, complex event processing (CEP) is known as a technique to process data collected one after another from various objects. Although the complex event processing may be referred to as event stream processing (ESP), here, the complex event processing is collectively referred to as CEP which includes the ESP. 
         [0004]    In the complex event processing, data of various data items included in received data are processed according to a set rule, and a result according to the rule is outputted. The data item is also referred to as a property. For example, in the complex event processing, data of various properties included in received data are filtered according to a rule and outputted. Further, in the complex event processing, a plurality of rules may be set and processing may be performed according to the rules in stages. 
         [0005]    Japanese Laid-open Patent Publication No. 2012-212227 is an example of related art. 
       SUMMARY 
       [0006]    According to an aspect of the invention, a non-transitory computer-readable medium including a program, which when executed by a computer, causes the computer to execute a process including collecting data item indicating specific criteria relating to a plurality of rules for gradually filtering a received data; and selectively extracting specific data relating to the collected data item indicating the specific criteria from content of the received data. 
         [0007]    The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
         [0008]    It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0009]      FIG. 1  is a diagram illustrating an example of a schematic configuration of a CEP system; 
           [0010]      FIG. 2  is a diagram illustrating an example of a functional configuration of a data processing device; 
           [0011]      FIG. 3  is a diagram illustrating an example of a data configuration of filter condition data; 
           [0012]      FIG. 4  is a diagram illustrating an example of a data configuration of use property data; 
           [0013]      FIG. 5  is a diagram illustrating an example of a data flow of complex event processing; 
           [0014]      FIG. 6  is a diagram for explaining a flow of extracting an input event; 
           [0015]      FIG. 7  is a diagram for explaining a flow of extracting an output event; 
           [0016]      FIG. 8  is a diagram for explaining a flow of extracting a property to be included in an output event; 
           [0017]      FIG. 9  is a diagram for explaining a correspondence relationship of properties between rules; 
           [0018]      FIG. 10  is a diagram for explaining a flow of extracting properties used for determination; 
           [0019]      FIG. 11  is a diagram for explaining a flow of identifying input event properties for properties used for determination; 
           [0020]      FIG. 12  is a diagram for explaining a flow of extracting properties used for output; 
           [0021]      FIG. 13  is a diagram for explaining a flow of identifying properties of input events corresponding to properties used for output; 
           [0022]      FIG. 14  is a diagram illustrating an example of use property information registered from rules 1 to 3; 
           [0023]      FIG. 15  is a diagram illustrating an example of input conversion processing information and output conversion processing information; 
           [0024]      FIG. 16  is a diagram for explaining an example of a flow of the complex event processing; 
           [0025]      FIG. 17  is a diagram for explaining an example of a flow of deletion of data of final output properties; 
           [0026]      FIG. 18  is a flowchart illustrating a procedure of registration processing; 
           [0027]      FIG. 19  is a flowchart illustrating a procedure of the complex event processing; and 
           [0028]      FIG. 20  is a diagram illustrating a computer executing a data processing program. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0029]    First, the study of the inventors will be described. When a plurality of rules are set and processing is performed in stages, the rule in each stage is set so that data of property used by a rule in the subsequent stage is extracted. Therefore, if data of property used by a rule in a latter stage is changed, the rule of a former stage has to be changed so that the changed data of property is extracted, so it is troublesome. Therefore, for example, the rules are set so that data of all properties of the received data are extracted. 
         [0030]    However, if the rules are set so that data of all properties of the received data are extracted, even data of unnecessary property is extracted. If such data of unnecessary property is extracted, resources are consumed to save and process the data of unnecessary property. 
         [0031]    According to the embodiments described below, the consumption of resources is suppressed. 
         [0032]    Hereinafter, the embodiments will be described in detail based on the drawings. The embodiments do not limit the present disclosure. The embodiments can be appropriated combined in a range where processing contents are not inconsistent with each other. 
       First Embodiment 
       [0033]    A data processing device according to a first embodiment will be described.  FIG. 1  is a diagram illustrating an example of a schematic configuration of a CEP system. The CEP system  10  includes a data processing device  20 . 
         [0034]    The data processing device  20  is a physical server that performs complex event processing and. For example, the data processing device  20  is a server computer installed in a data center and a company. In the data processing device  20 , a CEP processing unit  21  operates. The CEP processing unit  21  is software that realizes the complex event processing. For example, there is Esper as the software that realizes the complex event processing. Although in the example of  FIG. 1 , a case in which there is one data processing device  20  is illustrated, the disclosed system is not limited to this, but there may be two or more data processing devices  20  to distribute processing. Although in the example of  FIG. 1 , a case in which the CEP processing unit  21  described later operates on the data processing device  20  is illustrated, the CEP processing unit  21  may operates on one or more VMs (Virtual Machines) by causing the VMs to operate in the data processing device  20 . 
         [0035]    The data processing device  20  stores a filter condition (criteria) that filters data. In the example of  FIG. 1 , the data processing device  20  stores rules 1 to 3 as the filter condition. 
         [0036]    Data is delivered to the data processing device  20  as an event from various objects. For example, the data processing device  20  is connected to a network not illustrated in the drawings and data of event including data of various properties of event is delivered to the data processing device  20  from various objects through the network. The property indicates an item of data such as an attribute of data. In data of property, data of attribute of each property is stored. The data processing device  20  processes data of events received from various objects according to a set rule and outputs a result according to the rule to an output destination. 
         [0037]    Next, a more detailed configuration of the data processing device  20  will be described with reference to  FIG. 2 .  FIG. 2  is a diagram illustrating an example of a functional configuration of the data processing device. As illustrated in  FIG. 2 , the data processing device  20  includes a communication control I/F (interface) unit  40 , a storage unit  41 , a memory  42 , and a control unit  43 . 
         [0038]    The communication control I/F unit  40  is an interface that includes at least one port and controls communication with a network. The communication control I/F unit  40  receives data of event distributed from various objects through the network. Further, the communication control I/F unit  40  outputs information indicating a result of filtering to an output destination. 
         [0039]    The storage unit  41  is a storage device such as a hard disk and an optical disk. The storage unit  41  may be a data-rewritable non-volatile memory such as a flash memory. 
         [0040]    The storage unit  41  stores various information. For example, the storage unit  41  stores an operating system (OS) executed by the control unit  43  and a program for performing various processing such as the complex event processing. Further, the storage unit  41  stores various data used to execute a program executed by the control unit  43 . For example, the storage unit  41  stores filter condition information  41   a  and use property information  41   b.    
         [0041]    The filter condition information  41   a  is data storing a rule indicating a condition to filter data. The rule is set by, for example, an administrator or a developer of the system. Here, there are various description formats of the rule used in the complex event processing. In the present embodiment, an example is used in which the rule is described in an event description language based on Structured Query Language (SQL). However, it is not limited to this. 
         [0042]      FIG. 3  is a diagram illustrating an example of a data configuration of filter condition data. As illustrated in  FIG. 3 , three filter conditions, which are rules 1 to 3, are stored in the filter condition information  41   a . In the event processing language based on SQL, in the same manner as in SQL, the rule includes an insert into phrase, a select phrase, a from phrase, a where phrase, a group by phrase, and an order by phrase. 
         [0043]    The insert into phrase is a section that specifies a name of an output event when data matching the rule is outputted as an event. The select phrase is a section that specifies a property to be data of the output event. For the select phrase, it is possible to set “*” indicating that all properties of an input event to be inputted are specified to be properties of the output event. The from phrase is a section that specifies an input event. The where phrase is a section that specifies a condition of data to be processed. The group by phrase is a section that specifies grouping of data to be outputted. The order by phrase is a section that specifies an output order of data to be outputted. Conditions of the select phrase, the where phrase, the group by phrase, and the order by phrase are specified by a property name. 
         [0044]    In the example of  FIG. 3 , the rule 1 indicates that when data of a property “1b” is greater than 100 for an event “Event1”, data of all properties are extracted and outputted as an event “FilteredEvent1”. 
         [0045]    In the example of  FIG. 2 , the rule 2 indicates that when data of a property “2b” is smaller than 100 for an event “Event2”, data of all properties are extracted and outputted as an event “FilteredEvent2”. 
         [0046]    In the rule 3, aliases are defined in the from phrase so that the event “FilteredEvent1” is “e1” and the event “FilteredEvent2” is “e2”. The rule 3 indicates that when data of a property “1a” of “e1” and data of a property “2a” of “e2” are the same, each data of the property “1a” of “e1”, a property “1c” of “e1”, a property “2d” of “e2”, and a property “2e” of “e2” are extracted. In the rule 3, it is defined that the data of the property “1a” of “e1” is the data of the property “1a” and the data of the property “1c” of “e1” is the data of the property “1c”. In the rule 3, it is defined that the data of the property “2d” of “e2” is the data of the property “2d” and the data of the property “2e” of “e2” is the data of the property “2e”. The rule 3 indicates that the data of the property “1a”, the data of the property “1c”, the data of the property “2d”, and the data of the property “2e” are outputted as an event “ActionEvent”. 
         [0047]    Here, the rule 1 outputs the event “FilteredEvent1”. The rule 2 outputs the event “FilteredEvent2”. The rule 3 filters data from the event “FilteredEvent1” and the event “FilteredEvent2”. Therefore, the rules 1 to 3 are gradual filters so that a filtering result of the rule 1 and the rule 2 is further filtered by the rule 3. 
         [0048]    Let us return to  FIG. 2 . The use property information  41   b  is data that stores a property used for a rule. The use property information  41   b  is registered by a collection unit  43   a  described later. 
         [0049]      FIG. 4  is a diagram illustrating an example of a data configuration of use property data. As illustrated in  FIG. 4 , the use property information  41   b  includes items of a “determination property”, a “property of input event to be base of determination property”, a “final output property”, and a “property of input event to be base of final output property”. The item of the “determination property” is an area that stores a property to be used for determination in the rule. The item of the “property of input event to be base of determination property” is an area that stores information indicating what property of what input event the determination property is. The item of the “final output property” is an area that stores a property that is finally outputted to an output destination when the property is included in the rule. If the rule includes no property that is finally outputted to an output destination, “-” indicating that there is no final output property is stored in the item of “final output property”. The item of the “property of input event to be base of final output property” is an area that stores information indicating what property of what input event the property of input event to be a base of the final output property is. 
         [0050]    In the example of  FIG. 4 , the rule 1 indicates that the property “1b” of the event “Event1” is used for determination. Further, the rule 1 indicates that the base of the property “1b” of the event “Event1” is the property “1b” of the event “Event1”. Further, the rule 1 indicates that there is no property that is outputted to an output destination because the final output property is “-”. 
         [0051]    The rule 2 indicates that the property “2b” of the event “Event2” is used for determination. Further, the rule 2 indicates that the base of the property “2b” of the event “Event2” is the property “2b” of the event “Event2”. Further, the rule 2 indicates that there is no property that is outputted to an output destination because the final output property is “-”. 
         [0052]    The rule 3 indicates that the property “1a” of the event “FilteredEvent1” and the property “2a” of the event “FilteredEvent2” are used for determination. Further, the rule 3 indicates that the base of the property “1a” of the event “FilteredEvent1” is the property “1a” of the event “Event1” and the base of the property “2a” of the event “FilteredEvent2” is the property “2a” of the event “Event2”. Further, the rule 3 indicates that the properties “1a”, “1c”, “2d”, and “2e” of the event “ActionEvent” are properties that are outputted to a final output destination. Further, the rule 3 indicates that the base of the property “1a” of the event “ActionEvent” is the property “1a” of the event “Event1” and the base of the property “1c” of the event “ActionEvent” is the property “1c” of the event “Event1”. Further, the rule 3 indicates that the base of the property “2d” of the event “ActionEvent” is the property “2d” of the event “Event2” and the base of the property “2e” of the event “ActionEvent” is the property “2e” of the event “Event2”. 
         [0053]    Let us return to  FIG. 2 . The memory  42  is a device that temporarily stores various data. The memory  42  is a data-rewritable volatile semiconductor memory such as a random access memory (RAM) and a cache memory. For example, the memory  42  temporarily stores various data used for processing of the control unit  43 . 
         [0054]    The control unit  43  is a device that controls the data processing device  20 . As the control unit  43 , it is possible to employ an electronic circuit such as a central processing unit (CPU) and an micro processing unit (MPU) and an integrated circuit such as an application specific integrated circuit (ASIC) and an field programmable gate array (FPGA). The control unit  43  includes an internal memory to store programs and control data that define various processing procedures and performs various processing by using the programs and the control data. Various programs operate, so that the control unit  43  functions as various processing units. For example, in the control unit  43 , the aforementioned CEP processing unit  21  operates. The CEP processing unit  21  includes a collection unit  43   a , a capturing unit  43   b , an event processing unit  43   c , an output unit  43   d , and a deletion unit  43   e . Although in the present embodiment, an example is described in which the CEP processing unit  21  includes the collection unit  43   a , the capturing unit  43   b , the event processing unit  43   c , the output unit  43   d , and the deletion unit  43   e , any unit may be provided separately from the CEP processing unit  21 . 
         [0055]    The collection unit  43   a  is a processing unit that collects properties used for filtering. The collection unit  43   a  collects properties used for processing of a rule from each rule of the filter condition information  41   a  stored in the storage unit  41 . Then the collection unit  43   a  identifies a property of an input event that is the base of the properties used in the processing and registers the identified property in the use property information  41   b.    
         [0056]    Here, a flow will be described in which the collection unit  43   a  collects properties used for each rule from each rule of the filter condition information  41   a  and registers data in the use property information  41   b .  FIG. 5  is a diagram illustrating an example of a data flow of the complex event processing. In the example of  FIG. 5 , an apparatus event E1 including data of properties “1a” to “1e” is inputted from an apparatus  50 A having the properties “1a” to “1e”. Further, an apparatus event E2 including data of properties “2a” to “2e” is inputted from an apparatus  50 B having the properties “2a” to “2e”. The data processing device  20  converts the apparatus event E1 including data of the properties “1a” to “1e” inputted from the apparatus  50 A into an event “Event1” and captures the event “Event1”. Further, the data processing device  20  converts the apparatus event E2 including data of the properties “2a” to “2e” inputted from the apparatus  50 B into an event “Event2” and captures the event “Event2”. The data processing device  20  processes data of the captured event “Event1” according to the rule 1 and outputs data of an event “FilteredEvent1”. Further, the data processing device  20  processes data of the captured event “Event2” according to the rule 2 and outputs data of an event “FilteredEvent2”. Then, the data processing device  20  processes the data of the event “FilteredEvent1” and the data of the event “FilteredEvent2” according to the rule 3 and outputs data of an event “Action Event”. The data processing device  20  performs output conversion processing on the data of the event “ActionEvent” according to an output format and outputs the converted data to an output destination as an event for action. The rules 1 to 3 are the rules illustrated in  FIG. 3 . 
         [0057]    The collection unit  43   a  extracts an input event of each rule from the rules stored in the filter condition information  41   a . Further, when an alias is defined in the input event, the collection unit  43   a  also extracts the alias. 
         [0058]      FIG. 6  is a diagram for explaining a flow of extracting an input event. The collection unit  43   a  extracts input events from the from phrase of the rules 1 to 3. Further, the collection unit  43   a  extracts an alias of the input event from an alias definition of the from phrase. For example, the collection unit  43   a  extracts the event “Event1” as an input event for the rule 1. Further, the collection unit  43   a  extracts the event “Event2” as an input event for the rule 2. Further, the collection unit  43   a  extracts the input event “FilteredEvent1” and “FilteredEvent1” as input events for the rule 3. Further, the collection unit  43   a  extracts “e1” as an alias of the event “FilteredEvent1” and “e2” as an alias of the event “FilteredEvent2” for the rule 3. 
         [0059]    Further, the collection unit  43   a  extracts an output event of each rule from the rules stored in the filter condition information  41   a.    
         [0060]      FIG. 7  is a diagram for explaining a flow of extracting an output event. The collection unit  43   a  extracts output events from the insert into phrase of the rules 1 to 3. For example, the collection unit  43   a  extracts the event “FilteredEvent1” as an output event for the rule 1. Further, the collection unit  43   a  extracts the event “FilteredEvent2” as an output event for the rule 2. Further, the collection unit  43   a  extracts the event “ActionEvent” as an output event for the rule 3. When there is no insert into phrase in a rule, the collection unit  43   a  defines an event name that does not overlap other events in order to discriminate an event outputted by the rule from the other events. For example, when there is no insert into phrase, the collection unit  43   a  defines an event name of the output event to be the event name of the input event+“OutputStream” and extracts the defined event name. 
         [0061]    Further, the collection unit  43   a  extracts a property to be included in an output event of each rule from the rules stored in the filter condition information  41   a . Further, the collection unit  43   a  extracts a property that is a base of the property to be included in the output event. Further, the collection unit  43   a  extracts a property of an input event to be base of the property to be included in the output event. 
         [0062]      FIG. 8  is a diagram for explaining a flow of extracting a property to be included in an output event. The collection unit  43   a  extracts properties from the select phrase of the rules 1 to 3. For example, when “*” is described in the select phrase, the collection unit  43   a  extracts all properties of the input event as properties to be included in the output event. Further, when an alias of a property to be included in the output event is defined, the collection unit  43   a  extracts the alias. Further, when no alias of a property to be included in the output event is defined, the collection unit  43   a  extracts the described property. 
         [0063]    Further, the collection unit  43   a  extracts a property that is a base of the extracted property. Further, the collection unit  43   a  extracts a property of an input event to be base of the property to be included in the output event. 
         [0064]    For example, “*” is set in the select phrase for the rule 1, so that the collection unit  43   a  extracts all properties “1a” to “1e” of the input event as properties of data of the output event. No aliases of the properties “1a” to “1e” are defined in the select phrase, so that the collection unit  43   a  extracts the same properties “1a” to “1e” as the base properties. Further, the collection unit  43   a  extracts the properties “1a” to “1e” of the event “Event1” as properties of input event that are bases of the properties “1a” to “1e”. 
         [0065]    Further, “*” is set in the select phrase for the rule 2, so that the collection unit  43   a  extracts all properties “2a” to “2e” of the input event as properties to be output data. No aliases of the properties “2a” to “2e” are defined in the select phrase, so that the collection unit  43   a  extracts the same properties “2a” to “2e” as the base properties. Further, the collection unit  43   a  extracts the properties “1a” to “1e” of the event “Event2” as properties of input event that are bases of the properties “2a” to “2e”. 
         [0066]    Further, the collection unit  43   a  extracts properties “1a”, “1c”, “2d”, and “2e” from the select phrase as properties to be output data for the rule 3. Aliases of the properties “1a”, “1c”, “2d”, and “2e” are defined in the select phrase. Therefore, the collection unit  43   a  extracts the property “1a” of “e1”, the property “1c” of “e1”, the property “2d” of “e2”, and the property “2e” of “e2” as base properties. Further, the collection unit  43   a  extracts the properties “1a” and “1c” of the event “FilteredEvent1” and the properties “2d” and “2e” of the event “FilteredEvent2” as properties of input event that are bases of the properties “1a”, “1c”, “2d”, and “2e”. 
         [0067]    The collection unit  43   a  identifies a correspondence relationship of properties between rules from the extracted input event and output event of each rule and properties included in the output event. 
         [0068]      FIG. 9  is a diagram for explaining a correspondence relationship of property between rules. For example, the collection unit  43   a  identifies an input event, properties of the input event, properties of an output event, and the output event in each rule. Thereby, properties that are inputted but not outputted by the rule are identified. In the example of  FIG. 9 , an arrow is depicted when there is a property of output event corresponding to a property of input event. 
         [0069]    The collection unit  43   a  extracts properties used for determination from the rules stored in the filter condition information  41   a . The collection unit  43   a  identifies properties of input events for the properties used for determination from the correspondence relationship of properties between rules. 
         [0070]      FIG. 10  is a diagram for explaining a flow of extracting properties used for determination. The collection unit  43   a  extracts properties used for determination from the where phrase of the rules 1 to 3. 
         [0071]    For example, the collection unit  43   a  extracts the property “1b” as a property used for determination for the rule 1. The collection unit  43   a  identifies that the property “1b” is the property “1b” of the event “Event1” from the from phrase. 
         [0072]    Further, the collection unit  43   a  extracts the property “2b” as a property used for determination for the rule 2. The collection unit  43   a  identifies the property “2b” is the property “2b” of the event “Event2” from the from phrase. 
         [0073]    Further, the collection unit  43   a  extracts the property “1a” of “e1” and the property “2a” of “e2” as properties used for determination for the rule 3. The collection unit  43   a  identifies that the property “1a” of “e1” is the property “1a” of the event “FilteredEvent1” from the from phrase. Further, the collection unit  43   a  identifies that the property “2a” of “e2” is the property “2a” of the event “FilteredEvent2” from the from phrase. 
         [0074]    The collection unit  43   a  identifies properties of input events corresponding to the properties used for determination from the identified correspondence relationship of properties between rules.  FIG. 11  is a diagram for explaining a flow of identifying properties of input events corresponding to properties used for determination. For example, the property “1a” of the event “FilteredEvent1” is the property “1a” of the event “Event1” at the uppermost stream in the correspondence relationship. The property “2a” of the event “FilteredEvent2” is the property “2a” of the event “Event2” at the uppermost stream in the correspondence relationship. On the other hand, the property “1b” of the event “Event1” and the property “2b” of the event “Event2” are at the uppermost stage in the correspondence relationship. Therefore, the collection unit  43   a  identifies that the properties of input events for the properties used for determination are the properties “1a” and “1b” of the event “Event1” and the properties “2a” and “2b” of the event “Event2”. 
         [0075]    Further, the collection unit  43   a  extracts properties used for output from the rules stored in the filter condition information  41   a . Then, the collection unit  43   a  identifies properties of input events to be bases of the properties of an event used for output from the correspondence relationship of properties between rules. 
         [0076]      FIG. 12  is a diagram for explaining a flow of extracting properties used for output. The collection unit  43   a  extracts properties from the select phrase of the rules 1 to 3. Then, the collection unit  43   a  obtains properties to be included in the output event at the lowermost stream in the correspondence relationship and identifies properties of input events for the properties to be included in the output event at the lowermost stream. For example, among the properties extracted from the select phrases, the property “1a” of “e1”, the property “1c” of “e1”, the property “2d” of “e2”, and the property “2e” of “e2” are the properties to be final outputs. These property “1a” of “e1”, property “1c” of “e1”, property “2d” of “e2”, and property “2e” of “e2” are the properties “1a” and “1c” of the event “FilteredEvent1” and the properties “2d” and “2e” of the event “FilteredEvent2”. 
         [0077]    The collection unit  43   a  identifies properties of input events for the properties used for output from the identified correspondence relationship of properties between rules.  FIG. 13  is a diagram for explaining a flow of identifying properties of input events corresponding to properties used for output. For example, the properties “1a” and “1c” of the event “FilteredEvent1” are the properties “1a” and “1c” of the event “Event1” at the uppermost stream in the correspondence relationship. The properties “2d” and “2e” of the event “FilteredEvent2” is the properties “2d” and “2e” of the event “Event2” at the uppermost stream in the correspondence relationship. Therefore, the collection unit  43   a  identifies that the properties of input events for the properties used for output are the properties “1a” and “1c” of the event “Event1” and the properties “2d” and “2e” of the event “Event2”. 
         [0078]    The collection unit  43   a  registers the identified result in the use property information  41   b . For example, the collection unit  43   a  registers a property used for determination in an item of the “determination property” and registers a property of input event to be base of the determination property in the item of the “property of input event to be base of determination property” for each rule. Further, the collection unit  43   a  registers a property used for output in an item of the “final output property” and registers a property of input event to be base of the final output property in the item of “property of input event to be base of final output property”. Thereby, for example, the collection unit  43   a  registers data as illustrated in  FIG. 14  from the rules 1 to 3.  FIG. 14  is a diagram illustrating an example of the use property information registered from the rules 1 to 3. The use property information  41   b  illustrated in  FIG. 14  is the same as that in  FIG. 4 . 
         [0079]    The capturing unit  43   b  is a processing unit that performs input processing that selectively captures data of collected properties from among data of inputted event. For example, the capturing unit  43   b  generates input conversion processing information  60   a  which is a list of the properties used for determination and the final output properties from the use property information  41   b  for each event received from the outside. Further, the capturing unit  43   b  generates output conversion processing information  60   b  which is a list of the properties of input properties to be bases of final output properties from the use property information  41   b.    
         [0080]      FIG. 15  is a diagram illustrating an example of input conversion processing information and output conversion processing information. As illustrated in  FIG. 15 , in the input conversion processing information  60   a , the properties “1a” and “1b” are registered as the properties used for determination and the properties “1a” and “1c” are registered as the final output properties for the event “Event1”. Further, in the input conversion processing information  60   a , the properties “2a” and “2b” are registered as the properties used for determination and the properties “2d” and “2e” are registered as the final output properties for the event “Event2”. 
         [0081]    In the output conversion processing information  60   b , the property “1a” of the event “Event1” is registered as a base of the property “1a” of the event “ActionEvent”. Further, in the output conversion processing information  60   b , the property “1c” of the event “Event1” is registered as a base of the property “1c” of the event “ActionEvent”. Further, in the output conversion processing information  60   b , the property “2d” of the event “Event2” is registered as a base of the property “2d” of the event “ActionEvent”. Further, in the output conversion processing information  60   b , the property “2e” of the event “Event2” is registered as a base of the property “2e” of the event “ActionEvent”. 
         [0082]    When the capturing unit  43   b  receives an event from the outside, the capturing unit  43   b  performs input processing that selectively captures data of collected properties from among data of the received event based on the input conversion processing information  60   a  and the output conversion processing information  60   b . For example, the capturing unit  43   b  converts data of properties that are used for determination of the received event in the input conversion processing information  60   a  among the data of the received event into a predetermined format corresponding to the complex event processing and captures the converted data. For example, when the complex event processing corresponds to data of an Extensible Markup Language (XML) format, the capturing unit  43   b  converts data of properties used for determination into the XML format and captures the converted data. Further, for example, the capturing unit  43   b  performs input processing that selectively captures data of the event received from the outside based on the output conversion processing information  60   b . For example, the capturing unit  43   b  gives a unique ID to data of properties registered in the output conversion processing information  60   b  among the data of the received event and stores the data with the unique ID in the memory  42 . 
         [0083]    Then, the capturing unit  43   b  outputs the data of properties which is used for determination and is converted into a predetermined format corresponding to the complex event processing and the given ID to the event processing unit  43   c  as data of the event. 
         [0084]    The event processing unit  43   c  is a processing unit that processes an event according to the rules stored in the filter condition information  41   a . For example, the event processing unit  43   c  processes data of events captured by the capturing unit  43   b  according to each rule stored in the filter condition information  41   a  and outputs a processing result according to the rules to the output unit  43   d . The event processing unit  43   c  includes an ID included in a processed event in data of output of each rule. When the event processing unit  43   c  performs processing of each rule in stages, if data of output includes data of property that is not used for determination of rule in latter stage, the event processing unit  43   c  may delete the data of property that is not used. 
         [0085]    The output unit  43   d  is a processing unit that performs output processing for outputting a processing result of the event processing unit  43   c  to an output destination. For example, when the output unit  43   d  outputs data of event of a processing result of the event processing unit  43   c  to an output destination, the output unit  43   d  reads actual data of property stored in the memory  42  from an ID included in the data of event. Then, the output unit  43   d  generates data of event including the read data of property instead of the ID and outputs the generated data of event to the output destination. 
         [0086]    Here, an example of a flow of the complex event processing by the capturing unit  43   b , the event processing unit  43   c , and the output unit  43   d  will be described.  FIG. 16  is a diagram for explaining the example of the flow of the complex event processing. In the same manner as the example of  FIG. 5 , the example of  FIG. 16  illustrates a case in which the apparatus event E1 including data of properties “1a” to “1e” and the apparatus event E2 including data of properties “2a” to “2e” are processed by the rules 1 to 3 illustrated in  FIG. 3 . 
         [0087]    The apparatus event E1 and the apparatus event E2 are inputted into the capturing unit  43   b  and the capturing unit  43   b  receives the apparatus event E1 and the apparatus event E2 ( FIG. 16  ( 1 )). When the apparatus event E1 is inputted into the capturing unit  43   b , the capturing unit  43   b  gives a unique ID-1 to data of final output properties “1a” and “1c” and stores the data in the memory  42  ( FIG. 16  ( 2 )). Then, the capturing unit  43   b  converts data of determination properties “1a” and “1b” into a predetermined format corresponding to the complex event processing and generates an internal event “Event1” with ID-1 ( FIG. 16  ( 3 )). Further, when the apparatus event E2 is inputted into the capturing unit  43   b , the capturing unit  43   b  gives a unique ID-2 to data of final output properties “2d” and “2e” and stores the data in the memory  42  ( FIG. 16  ( 2 )). Then, the capturing unit  43   b  converts data of determination properties “2a” and “2b” into the predetermined format corresponding to the complex event processing and generates an internal event “Event2” with ID-2 ( FIG. 16  ( 3 )). 
         [0088]    The event processing unit  43   c  processes the data of events captured by the capturing unit  43   b  according to the rules 1 to 3 and outputs a processing result according to the rule 3 ( FIG. 16  ( 4 )). In the example of  FIG. 16 , if data of output includes data of property that is not used for determination of rule in latter stage, the event processing unit  43   c  deletes the data of property that is not used. For example, in the event “FilteredEvent1” outputted from the rule 1, the property “1b” that is not used for determination of the rule 3 is deleted. However, data of property that is not used may remain without being deleted. 
         [0089]    In this way, the capturing unit  43   b  selectively captures data of properties used for determination of the rules, so that it is possible to suppress resources from being consumed by storing and processing unnecessary data of property. Data of properties used for determination of the rules are captured, so that the event processing unit  43   c  can perform determination of the rules. 
         [0090]    The output unit  43   d  receives the output event “ActionEvent” that is a processing result of the rule 3 of the last stage ( FIG. 16  ( 5 )). When the output unit  43   d  receives the output event “ActionEvent”, the output unit  43   d  acquires data of final output properties “1a”, “1c”, “2d”, and “2e” stored in the memory  42  from ID-1 and ID-2 included in the event “ActionEvent” ( FIG. 16  ( 6 )). Then, the output unit  43   d  generates data of event including the data of final output properties and outputs the generated data of event to an output destination as an event for action ( FIG. 16  ( 7 )). 
         [0091]    In this way, data of properties for output are stored in the memory  42  and the data of properties are excluded from processing objects of the event processing unit  43   c , so that, in the event processing unit  43   c , it is possible to suppress resources from being vainly consumed by storing and processing the data of properties for output. 
         [0092]    The deletion unit  43   e  is a processing unit that deletes the data of final output properties stored in the memory  42 . The deletion unit  43   e  deletes the data of output properties stored in the memory  42  after filtering processing in stages by a plurality of rules. For example, an area of a counter whose initial value is zero is provided in an area where data of properties registered in the output conversion processing information  60   b  of each event are stored in the memory  42 . When the event processing unit  43   c  starts processing of data of an event, the event processing unit  43   c  adds 1 to the counter in a storage area of an ID included in the data of the event. When the event processing unit  43   c  ends the processing of the data of the event, the event processing unit  43   c  subtracts 1 from the counter in the storage area of the ID included in the data of the event. Thereby, while data of an event is being processed by any one of the rules, the value of the counter is greater than zero, and while data of an event is not being processed by any one of the rules, the value of the counter is zero. 
         [0093]    After the output unit  43   d  generates and outputs data of an event, the deletion unit  43   e  determines whether or not the value of the counter in a storage area of an ID included in the outputted event is zero, and if the value of the counter is zero, the deletion unit  43   e  deletes data in the storage area of the ID. Thereby, the deletion unit  43   e  can suppress data for which processing is completed and which is out of use from remaining in the memory  42 . 
         [0094]    Here, an example of a flow of deleting data of final output properties stored in the memory  42  will be described.  FIG. 17  is a diagram for explaining an example of a flow of deletion of data of final output properties. In the same manner as the examples in  FIGS. 5 and 16 , the example of  FIG. 17  illustrates a case in which the apparatus event E1 including data of properties “1a” to “1e” is processed by the rules 1 to 3 illustrated in  FIG. 3 . 
         [0095]    When the event processing unit  43   c  starts processing of the event “Event1” and the event “FilteredEvent1”, the event processing unit  43   c  adds 1 to a counter of ID-1. Further, when the event processing unit  43   c  ends the processing of the event “Event1” and the event “FilteredEvent1”, the event processing unit  43   c  subtracts 1 from the counter of ID-1. After the output unit  43   d  completes output processing of the event “ActionEvent”, if the value of the counter in a storage area of ID-1 included in the event “ActionEvent” is zero, the deletion unit  43   e  deletes data in the storage area of ID-1. Thereby, the deletion unit  43   e  can suppress data for which processing is completed and which is out of use from remaining in the memory  42 . 
         [0096]    Next, a flow of various processing performed by the data processing device  20  according to the present embodiment will be described. First, a flow of registration processing will be described in which the data processing device  20  collects properties used for each rule from each rule of the filter condition information  41   a  and registers data in the use property information  41   b .  FIG. 18  is a flowchart illustrating a procedure of the registration processing. The registration processing is performed at a predetermined timing, for example, at a timing when a rule is registered. 
         [0097]    As illustrated in  FIG. 18 , the collection unit  43   a  extracts the input event, the output event, and properties included in the output event from each rule and identifies a correspondence relationship of properties between the rules (S 10 ). The collection unit  43   a  extracts properties used for determination from the rules stored in the filter condition information  41   a  (S 11 ). The collection unit  43   a  identifies properties of the input events for the properties used for determination from the correspondence relationship of properties between the rules (S 12 ). 
         [0098]    Further, the collection unit  43   a  extracts properties used for output from the rules stored in the filter condition information  41   a  (S 13 ). The collection unit  43   a  identifies properties of the input events to be bases of the properties of an event used for output from the correspondence relationship of properties between the rules (S 14 ). 
         [0099]    The collection unit  43   a  registers the identified properties in the use property information  41   b  (S 15 ) and ends the processing. 
         [0100]    Next, a flow will be described in which the data processing device  20  performs the complex event processing of data of an event received from the outside.  FIG. 19  is a flowchart illustrating a procedure of the complex event processing. The registration processing is performed at a predetermined timing, for example, at a timing when receiving an event from the outside. 
         [0101]    As illustrated in  FIG. 19 , the capturing unit  43   b  converts data of properties that are used for determination of event among data of the received event into a predetermined format and captures the converted data (S 20 ). Further, the capturing unit  43   b  gives a unique ID to data of final output properties among the data of the received event and stores the data with the unique ID in the memory  42  (S 21 ). The capturing unit  43   b  generates an event by including the ID which the capturing unit  43   b  gives in data of the event (S 22 ). 
         [0102]    The event processing unit  43   c  processes the data of the generated event according to the rules stored in the filter condition information  41   a  (S 23 ). In this case, when the event processing unit  43   c  starts processing of the data of the event, the event processing unit  43   c  adds 1 to a counter in a storage area of an ID included in the data of the event. When the event processing unit  43   c  ends the processing of the data of the event, the event processing unit  43   c  subtracts 1 from the counter in the storage area of the ID included in the data of the event. 
         [0103]    The output unit  43   d  outputs data of an event that is a processing result of the event processing unit  43   c  to an output destination (S 24 ). 
         [0104]    The deletion unit  43   e  deletes data in a storage area where the value of the counter in the storage area of the ID included in the outputted event is zero (S 25 ) and ends the processing. 
         [0105]    In this way, the data processing device  20  collects data items used for each rule from a plurality of rules which are stored in the storage unit  41  and indicate conditions for filtering inputted data in stages. Then, the data processing device  20  selectively captures data of collected properties from among inputted data. Thereby, data of unnecessary properties are not captured, so that the data processing device  20  can suppress consumption of resources. Further, the data processing device  20  selectively captures data of properties used for each rule, so that the data processing device  20  can perform processing according to each rule. Further, by selectively capturing data of properties used for each rule, for example, when processing of the rules is distributed to a plurality of devices and processed by the devices, it is possible to reduce the amount of data of communication between the devices by not capturing data of unnecessary properties. 
         [0106]    Further, the data processing device  20  collects determination properties used for determination in a rule and output properties outputted when satisfying the rule. Then, the data processing device  20  captures data of the determination properties from received data by converting the data of the determination properties into a predetermined format corresponding to the complex event processing and stores data of the output properties in the memory  42 . In this way, the data processing device  20  can perform determination of a rule by data of minimum properties by capturing the data of the determination properties, so that it is possible to suppress consumption of resources. Further, the data processing device  20  can output data according to a rule when satisfying the rule by storing the data of the output properties in the memory  42 . 
         [0107]    Further, the data processing device  20  performs filtering in stages by a plurality of rules by using the data of the determination properties converted into a predetermined format for the received data and outputs a result of the filtering by using the data of the output properties stored in the memory  42 . Thereby, the data processing device  20  can perform filtering in stages while suppressing consumption of resources. 
         [0108]    Further, the data processing device  20  deletes the data of the output properties stored in the memory  42  after the filtering processing in stages by a plurality of rules. Thereby, the data processing device  20  can suppress the data of the output properties stored in the memory  42  from remaining. 
       Second Embodiment 
       [0109]    Although the embodiment related to the disclosed device has been described, the disclosed technique may be implemented in various different forms in addition to the embodiment described above. Therefore, other embodiments included in the present disclosure will be described below. 
         [0110]    For example, in the embodiment described above, the input conversion processing information  60   a  and the output conversion processing information  60   b  are generated from the use property information  41   b . In the embodiment described above, a case is described in which the input conversion processing and the output conversion processing are performed by using the input conversion processing information  60   a  and the output conversion processing information  60   b . However, the disclosed device is not limited to this. For example, the data processing device  20  may perform the input conversion processing and the output conversion processing by using the use property information  41   b.    
         [0111]    Each component of each device illustrated in the drawings is functional and conceptual and may be physically configured differently from the component illustrated in the drawings. In other words, specific forms of distribution and integration of the devices are not limited to those illustrated in the drawings, and all or part of the devices can be functionally or physically distributed or integrated in arbitrary units according to various loads and the state of use. For example, the processing units including the collection unit  43   a , the capturing unit  43   b , the event processing unit  43   c , the output unit  43   d , and the deletion unit  43   e  illustrated in  FIG. 2  may be appropriately integrated. All or part of processing functions performed in each processing unit may be realized by a CPU and a program analyzed and executed by the CPU or may be realized by hardware based on wired logic. 
         [0112]    Data Processing Program 
         [0113]    The various processing described in the above embodiment can be realized by executing a program prepared in advance by a computer system such as a personal computer or a workstation. Therefore, an example of a computer system that executes a program having the same function as that of the above embodiment will be described below.  FIG. 20  is a diagram illustrating a computer executing a data processing program. 
         [0114]    As illustrated in  FIG. 20 , a computer  300  includes a central processing unit (CPU)  310 , a read only memory (ROM)  320 , a hard disk drive (HDD)  330 , and a random access memory (RAM)  340 . These units  310  to  340  are connected to each other through a bus  400 . 
         [0115]    The ROM  320  stores in advance a data processing program  320   a  that exerts the same functions as those of each unit of the embodiment described above. For example, the data processing program  320   a  that exerts the same functions as those of the collection unit  43   a , the capturing unit  43   b , the event processing unit  43   c , the output unit  43   d , and the deletion unit  43   e  of the embodiment described above is stored. The data processing program  320   a  may be appropriately divided. 
         [0116]    The CPU  310  reads and executes the data processing program  320   a  from the ROM  320 , so that the CPU  310  performs the same operation as that of the embodiment described above. In other words, the data processing program  320   a  performs the same operations as those of the collection unit  43   a , the capturing unit  43   b , the event processing unit  43   c , the output unit  43   d , and the deletion unit  43   e.    
         [0117]    The data processing program  320   a  described above is not stored in the ROM  320  from the beginning in some cases. The data processing program  320   a  may be stored in the HDD  330 . 
         [0118]    For example, the program is stored in a “portable physical medium” such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, and an IC card, which are inserted into the computer  300 . Then, the computer  300  may read the program from these media and execute the program. 
         [0119]    Further, the program is stored in “another computer (or server)” connected to the computer  300  through a public line, the Internet, a LAN, a WAN, or the like. Then, the computer  300  may read the program from these and execute the program. 
         [0120]    All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.