Methods and apparatus for performing real-time analytics based on multiple types of streamed data

Abstract

Streaming data from a plurality of streaming data sources can be received. The streaming data may not be stored in persistent storage. A query can be received from a client device. A rule can be defined based on the query. The rule can be applied to the streaming data. Alerts associated with a subset of the streaming data that matches the rule can be stored in persistent storage. A signal associated with the alerts can be sent to the client device such that the graphical user interface is updated based on the alerts.

What is claimed is: 
     
         1 . A method comprising:
 receiving, at a first compute device, streaming data from a plurality of streaming data sources, at least a portion of the streaming data not being stored in persistent storage;   receiving, from a client device, a signal associated with a first query against the plurality of streaming data sources, the first query associated with a user interacting with a graphical user interface;   defining a first rule based on the first query;   applying the first rule to the streaming data, a subset of streaming data from the plurality of streaming data sources satisfying the first rule;   defining a stream of derivative data based on the subset of streaming data;   receiving, from the client device, a signal associated with a second query against the stream of derivative data;   defining a second rule based on the second query, a subset of the stream of derivative data satisfying the second rule;   storing, in persistent storage, a plurality of alerts, the plurality of alerts associated with the subset of the stream of derivative data; and   sending a signal associated with the plurality of alerts to a second compute device.   
     
     
         2 . The method of  claim 1 , wherein the second compute device is the client device, the signal associated with the plurality of alerts is sent to the client device such that the graphical user interface is updated based on the plurality of alerts. 
     
     
         3 . The method of  claim 1 , wherein the client device is a first client device, the graphical user interface is a first graphical user interface, and the signal associated with the plurality of alerts is sent to the second compute device is at least one of an email, a representational state transfer, or a signal sent to a second client device such that a second graphical user interface is updated based on an alert from the plurality of alerts. 
     
     
         4 . The method of  claim 1 , further comprising:
 receiving, from the client device, a signal associated with a third query, the third query associated with the user interacting with the graphical user interface;   defining a third rule based on the third query;   applying the third rule to each streaming data source from the plurality of streaming data sources, including the stream of derivative data, in parallel.   
     
     
         5 . The method of  claim 1 , wherein:
 a first streaming data source from the plurality of streaming data sources is associated with a first access control level;   a second streaming data source from the plurality of streaming data sources is associated with a second access control level different from the first access control level; and   applying the first rule to the streaming data includes:
 identifying an authorization level associated with the client device; and 
 applying the first rule to the first streaming data source but not to the second streaming data source based on the authorization level not being below the first access control level but being below the second access control level. 
   
     
     
         6 . The method of  claim 1 , wherein, the subset of streaming data is a first subset of streaming data, and the plurality of alerts is a first plurality of alerts, the method further comprising:
 applying a third rule to the plurality of streaming data sources before applying the first rule to the plurality of streaming data sources, a second subset of streaming data from the plurality of streaming data sources satisfying the third rule;   storing, in persistent storage, a second plurality of alerts, the second plurality of alerts associated with the second subset of streaming data;   receiving, from the client device, a signal associated with a fourth query against the first plurality of alerts and the second plurality of alerts;   defining a fourth rule based on the fourth query;   applying the fourth rule to the first plurality of alerts and the second plurality of alerts;   generating an alert based on at least one datum from the first plurality of alerts or at least one datum from the second plurality of alerts satisfying the fourth rule; and   sending a signal associated with the alert to the client device such that the graphical user interface is updated based on the alert.   
     
     
         7 . The method of  claim 1 , wherein the plurality of alerts are a first plurality of alerts, the method further comprising:
 applying the second rule to the stream of derivative data and the streaming data, each alert from the second plurality of alerts associated with a datum from the stream of derivative data or a datum from the streaming data.   
     
     
         8 . The method of  claim 1 , the method further comprising:
 continuously applying the second rule in real time to the stream of derivative data.   
     
     
         9 . A non-transitory processor readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:
 receive, at a compute device, streaming data from a plurality of data sources, at least a portion of the streaming data not being stored in persistent storage;   send a first signal to a first client device such that the first client device renders a first graphical user interface presenting at least a portion of the streaming data;   receive, from the first client device, a request to define a first rule in response to a user of the first client device making a form-based selection via the first graphical user interface;   define a stream of derivative based on applying the first rule to the streaming data;   receive, from a second client device different from the first client device, a request to define a second rule in response to a user of the second client device making a form-based selection via a second graphical user interface;   apply the second rule to the stream of derivative data to identify a datum from the stream of derivative data satisfying the rule; and   send a second signal to the second client device such that an alert is presented via the second graphical user interface, the alert based on the datum from the stream of derivative data satisfying the second rule.   
     
     
         10 . The non-transitory processor readable medium of  claim 9 , wherein the datum is a first datum, the code further comprising code to cause the processor to:
 store a second datum satisfying the first rule in persistent storage; and   send a third signal to the first client device such that a third graphical user interface presents a notification, the third signal sent in response to a quantity of data from the streaming data satisfying the first rule exceeding a pre-defined threshold, the third graphical user interface configured to present notifications associated with the first rule and the second rule.   
     
     
         11 . The non-transitory processor readable medium of  claim 9 , wherein the datum is a first datum, the code further comprising code to cause the processor to:
 send a third signal to the first client device such that an alert is presented via the first graphical user interface;   receive, from the second client device, a request to define a third rule;   apply the third rule to the streaming data, including the stream of derivative data to identify a second datum from at least one of the streaming data or the stream of derivative data satisfying the third rule;   store the second datum in persistent storage; and   send a fourth signal to the second client device such that the second graphical user interface presents a notification, the notification based on the first datum and the second datum.   
     
     
         12 . The non-transitory processor readable medium of  claim 9 , wherein-the datum is a first datum, the graphical user interface is a first graphical user interface configured to present alerts associated with the first rule, the code further comprising code to cause the processor to:
 store the second datum in persistent storage; and   send a third signal to the first client device such that a third graphical user interface presents a notification, the third signal sent in response to at least one of (1) a quantity of data from the stream of derivative data satisfying the second rule or (2) a quantity of data from the streaming data satisfying the first rule exceeding a pre-defined threshold.   
     
     
         13 . The non-transitory processor readable medium of  claim 9 , wherein the datum is a first datum, a second datum from the streaming data satisfying the first rule, and the alert is a first alert, the code further comprising code to cause the processor to:
 store the second datum in persistent storage; and   generate a second alert based, at least in part, on the second datum satisfying the first rule.   
     
     
         14 . The non-transitory processor readable medium of  claim 9 , wherein the alert is a first alert, the signal sent to the second client device such that the first alert is presented at a first time, the code further comprising code to cause the processor to:
 store the second rule; and   send a signal to the second client device at a second time after the first time such that a second alert is presented via the second graphical user interface.   
     
     
         15 . The non-transitory processor readable medium of  claim 9 , wherein the first rule is applied to a first data source from the plurality of data sources, the code further comprising code to cause the processor to:
 define the first rule, the first rule having a first set of parameters associated with the first data source; and   define a third rule, the third rule having a second set of parameters associated with a second data source from the plurality of data sources; and   apply the third rule to the second data source.   
     
     
         16 . The non-transitory processor readable medium of  claim 9 , wherein the alert is a first alert, the code further comprising code to cause the processor to:
 define the second rule in response to receiving the request to define the second rule;   send a signal representing the second rule to a third client device different from the second client device;   receive, from the third client device, a request to apply the second rule to the stream of derivative data; and   send a signal to the third client device such that a second alert associated with the second rule is presented via a third graphical user interface.   
     
     
         17 . The non-transitory processor readable medium of  claim 9 , wherein the second rule is associated with a first location at a first time and a second location at a second time, applying the second rule includes applying the second rule at the first time, and the datum satisfying the second rule is a first datum associated with the first location, the code further comprising code to cause the processor to:
 apply the second rule to the stream of derivative data at a second time, a second datum from the stream of derivative data associated with the second location satisfying the second rule at the second time.   
     
     
         18 . The non-transitory processor readable medium of  claim 9 , wherein the stream of derivative data is not stored in persistent storage.