Summary

Currently in Zabbix there is limited event processing, global correlation capabilities. It is required by Zabbix community to extend these capabilities by introducing Complex Event Processing (CEP).

Use cases

1. As a user I want to have a rule based processing for Zabbix events
   1. normalize/enrich events -  for events: discard, close, suppress; for event tags: add, modify, remove via single-event stream
   2. deferred processing - execute action after event inactivity period (e.g. change severity/close old events) via multi-event stream (time window)
   3. event grouping - aggregate events based on a defined rule (incl. flapping trigger de-duplication and counting) via multi-event stream (time window)
   4. event pattern detection - when event pattern matched my criteria - create new event via multi-event stream (time window)
   5. missing event detection - raise alert when there is no specific event within time period via multi-event stream (time window)
2. As a user I want to replace current global event correlation with CEP (improved performance on a large event data sets)