Correlation rules

Event Analytics provides functionality for time and event correlation using the system session CorrelationRules, which is part of the standard content. This session contains these system rules:
  • EventCorrelationProcessor
  • TimeCorrelationProcessor

You cannot edit these system rules. If you select one of these rules, the rule editor is not displayed.

Note: The system session CorrelationRules must always be started. Otherwise, outbound messages using time or event correlation are not generated.

As with all rules, the time and event correlation rules subscribe to events. The time correlation rule subscribes to TimeCorrelation events from EventAnalytics with the operation Request. The event correlation rule subscribes to EventCorrelation events from EventAnalytics with the Create, Request, and Start operations. Time and event correlation are controlled by these events, which means that these events must contain specific virtual fields, for example for correlation ID, for the correlation to work.

Here is the overall event flow:

  1. Data event: This event contains the data for the time or event correlation rule. These events are normally published by M3.
  2. Triggering event, only for event correlation: This event triggers the event correlation to publish new events. This event is normally published by M3.
  3. Rule: This is a normal rule set to use time or event correlation. This is how you control the time and event correlation. Several rules can use the same time or event correlation. At least two rules are required for event correlation: one for the data event and one for the triggering event.
  4. TimeCorrelation or EventCorrelation event: This event is published by the above rules and subscribed to by the time and event correlation rules.
  5. Time and event correlation rules: These system rules provide time and event correlation functionality and publish new time and event correlated events.