BACKGROUND

[0001] Data management has become more challenging with the increasing popularity of cloud and on-premise products offering a variety of technological services to users. Conventional techniques for monitoring these systems are unable to effectively manage applications that generate large quantities of data. In one aspect, this because conventional systems rely on log analysis, up-down monitoring of individual servers, and the like, which has limited scalability and efficiency for applications generating large quantities of data. For example, performing a query such as a relational database join operation on hundreds or thousands of time series is expensive in SQL. Additional challenges include combining data without losing fidelity, and finding particular types of data such as a time series matching a desired profile from among the numerous candidates.

BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Various embodiments of the disclosure are disclosed in the following detailed description and the accompanying drawings.

[0003] FIG. 1 A is a block diagram illustrating an embodiment of a system for managing data including responding to a query regarding time series data.

[0004] FIG. IB is a block diagram illustrating an embodiment of a system for managing data including responding to a query regarding time series data.

[0005] FIG. 2 is a functional diagram illustrating a programmed computer system for managing data including responding to a query regarding time series data.

[0006] FIG. 3 is a conceptual diagram illustrating an example embodiment of a time series execution model.

[0007] FIG. 4 is a conceptual diagram illustrating an example embodiment of a join operation. [0008] FIG. 5 is a flowchart illustrating an example embodiment of a process for high fidelity combination of data.

[0009] FIG. 6 is a flowchart illustrating an example embodiment of a process for query implementation using synthetic time series.

[0010] FIG. 7 is a conceptual diagram illustrating an example embodiment of a query.

[0011] FIG. 8 is a conceptual diagram illustrating an example embodiment of a parse tree corresponding to the query shown in FIG. 7.

[0012] FIG. 9 is a conceptual diagram illustrating an example embodiment generating a synthetic time series.

[0013] FIG. 10 is a conceptual diagram illustrating an example embodiment of query implementation using synthetic time series.

DETAILED DESCRIPTION

[0014] The subject matter of this disclosure can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the subject matter of this disclosure may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the subject matter of this disclosure. Unless stated otherwise, a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. As used herein, the term 'processor' refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions.

[0015] A detailed description of one or more embodiments of the subject matter of this disclosure is provided below along with accompanying figures that illustrate the principles of the subject matter of this disclosure. The subject matter of this disclosure is described in connection with such embodiments, but the disclosure is not limited to any embodiment. The scope of the disclosure is limited only by the claims and the disclosure encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the disclosure. These details are provided for the purpose of example and the disclosure may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the disclosure has not been described in detail so that the disclosure is not unnecessarily obscured.

[0016] A numerical measurement of a system or activity can be collected and stored as a metric (also referred to as a "stream"). For example, one type of stream is a CPU load measured over time. Operations can be performed on data points in a stream. In some instances, the operations can be performed in real time as data points are received. In other instances, the operations can be performed on historical data. Metrics analysis include a variety of use cases including online services (e.g., access to applications), software development, energy, Internet of Things (IoT), financial services (e.g., payment processing), healthcare, manufacturing, retail, operations management, and the like.

[0017] It is challenging to perform operations on data streams when the data streams are not aligned, e.g., when a sample at a particular time for a first data stream does not match up with a sample at the same time for a second data stream. It is also challenging to find time series that conform to a pattern, especially when the set of time series is very large (e.g., on the order of hundreds or more). Conventional techniques grid input streams to ensure that they are aligned to allow operations to be performed on the input streams. However, gridding streams causes a loss of fidelity so that combining data in conventional systems is lossy. Techniques of the present disclosure combine data while maintaining high fidelity and quickly and efficiently identify times series that conform to a pattern.

[0018] FIG. 1A is a block diagram illustrating an embodiment of a system 100 for managing data including responding to a query regarding time series data. In one aspect, the system 100 performs high fidelity combination of data, for example combining time series data in response to a query. In another aspect, the system 100 performs operations by implementing a query using a synthetic time series. The system 100 handles both discrete data (points) and continuous data (values). [0019] The system includes a compiler 104 and an executor 106. The system can be implemented by a query execution engine configured to parse a query, produce a query execution plan, fetch data, run the data through processing operations (also referred to as "boxes"), and determine an answer or response to the query.

[0020] In the example shown in FIG. 1 A, the query is provided by a user via client

110. Time series data is provided by storage devices(s) 102. The storage device(s) 102 store and output time series data, e.g., TS1, TS2, TS3, etc. In various embodiment, the storage device(s) 102 includes a storage system such as time series database (TSDB). The data can include times series data, which may be discrete or continuous. For example, the data can include live data fed to a discrete stream, e.g. for a standing query. Conventional systems for processing time series data handles discrete points, but typically do not accommodate continuous data. Continuous sources can include analog output representing a value as a function of time. With respect to processing operations, continuous data may be time sensitive, e.g. reacting to a declared time at which a unit of stream processing is attempted, or a constant, e.g. a 5V signal. Discrete streams can be provided to the processing operations in timestamp order. In various embodiments, if data arrives out-of-order, streams can be rewound to process data in order. In an alternative embodiment, a checkpointing system can pause processing to wait for a next data point and resume processing from an earlier checkpoint to maintain a processing order. In various embodiments, processing is performed based on a wall-clock that drives a stream graph to produce expected output for a particular time. The wall-clock may be, but need not be, equivalent to real time. For example, when processing historical data or producing a live view of time series data over a time window, the wall-clock can be used to drive output from an earlier time (typically a left-most side of a timeline), moving through time and collecting values from the output, then switch to standing mode to await discrete tuples to arrive, as the wall-clock advances in real-time.

[0021] The compiler 104 receives the query and determines relevant times series data to retrieve. In the example shown in FIG. 4, relevant time series to the query are TS 1 , TS2, and TS3. The compiler handles a "compile phase" in which the query is analyzed. The compiler parses the query to determine operations to be performed on relevant time series data. Example operations include finding time series that match criteria defined by the query to identify anomalous behavior, joining time series data, etc., as further described herein.

[0022] The executor 106 handles an "execution phase" in which operations are performed on time series data to generate an answer to the query. In various embodiments, the executor receives commands from the compiler 104 and performs operations on the time series data. For example, one or more executors can perform the operation on the time series data in parallel. In various embodiments, the executor responds to a query about the time series data and outputs an answer to the query. Although shown as separate components in FIG. 1A, the compiler 104 and the executor 106 can be implemented as a single component. The techniques described herein can be performed by the compiler and/or the executor.

[0023] In operation, the system 100 receives a query. The compiler determines what to retrieve from time series database(s) 102 based on the query. For example, the compiler determines how many scans to make on the time series database(s). The compiler then hands off commands to executor 106 to perform an execution phase, e.g. beginning execution of the query. The executor then outputs an answer to the query. Although shown as a single stream, the answer to the query can include one or more streams.

[0024] FIG. IB is a block diagram illustrating an embodiment of a system 150 for managing data including responding to a query regarding time series data. In one aspect, the system 150 performs high fidelity combination of data, for example combining time series data in response to a query. In another aspect, the system 150 performs operations by implementing a query using a synthetic time series. The system 150 handles both discrete data (points) and continuous data (values).

[0025] The system includes a parser 108, a compiler 104, and an executor 106. The functions of the system and system components can be like those described for FIG. 1 A unless otherwise noted. The parser 108 receives a query. In the example shown in FIG. IB, the query is provided by a user via client 110. The query is parsed according to techniques described herein, e.g. in relation to FIG. 6. A synthetic time series (STS) corresponding to the query is generated and passed to the compiler 104. Time series data is provided by storage devices(s) 102. The storage device(s) 102 store and output time series data, e.g., TS1, TS2, TS3, etc. The compiler and/or executor can reduce the input STS and time series data to determine those time series data that most closely match the STS, which can be returned as an answer to the query.

[0026] FIG. 2 is a functional diagram illustrating a programmed computer system 200 for implementing high fidelity combination of data in accordance with some embodiments. As will be apparent, other computer system architectures and configurations can be used to perform high fidelity combination of data. Computer system 100, which includes various subsystems as described below, includes at least one microprocessor subsystem (also referred to as a processor or a central processing unit (CPU)) 202. For example, processor 202 can be implemented by a single-chip processor or by multiple processors. In some embodiments, processor 202 is a general purpose digital processor that controls the operation of the computer system 100. Using instructions retrieved from memory 210, the processor 202 controls the reception and manipulation of input data, and the output and display of data on output devices (e.g., display 218). In some embodiments, processor 202 includes and/or is used to provide performs the processes described below with respect to FIGS. 5 and 6.

[0027] Processor 202 is coupled bi-directionally with memory 210, which can include a first primary storage, typically a random access memory (RAM), and a second primary storage area, typically a read-only memory (ROM). As is well known in the art, primary storage can be used as a general storage area and as scratch-pad memory, and can also be used to store input data and processed data. Primary storage can also store programming instructions and data, in the form of data objects and text objects, in addition to other data and instructions for processes operating on processor 202. Also as is well known in the art, primary storage typically includes basic operating instructions, program code, data and objects used by the processor 202 to perform its functions (e.g., programmed instructions). For example, memory 210 can include any suitable computer-readable storage media, described below, depending on whether, for example, data access needs to be bi-directional or uni-directional. For example, processor 202 can also directly and very rapidly retrieve and store frequently needed data in a cache memory (not shown).

[0028] A removable mass storage device 212 provides additional data storage capacity for the computer system 100, and is coupled either bi-directionally (read/write) or uni-directionally (read only) to processor 202. For example, storage 212 can also include computer-readable media such as magnetic tape, flash memory, PC-CARDS, portable mass storage devices, holographic storage devices, and other storage devices. A fixed mass storage 220 can also, for example, provide additional data storage capacity. The most common example of mass storage 220 is a hard disk drive. Mass storage 212, 220 generally store additional programming instructions, data, and the like that typically are not in active use by the processor 202. It will be appreciated that the information retained within mass storage 212 and 220 can be incorporated, if needed, in standard fashion as part of memory 210 (e.g., RAM) as virtual memory.

[0029] In addition to providing processor 202 access to storage subsystems, bus 214 can also be used to provide access to other subsystems and devices. As shown, these can include a display monitor 218, a network interface 216, a keyboard 204, and a pointing device 206, as well as an auxiliary input/output device interface, a sound card, speakers, and other subsystems as needed. For example, the pointing device 206 can be a mouse, stylus, track ball, or tablet, and is useful for interacting with a graphical user interface.

[0030] The network interface 216 allows processor 202 to be coupled to another computer, computer network, or telecommunications network using a network connection as shown. For example, through the network interface 216, the processor 202 can receive information (e.g., data objects or program instructions) from another network or output information to another network in the course of performing method/process steps.

Information, often represented as a sequence of instructions to be executed on a processor, can be received from and outputted to another network. An interface card or similar device and appropriate software implemented by (e.g., executed/performed on) processor 202 can be used to connect the computer system 100 to an external network and transfer data according to standard protocols. For example, various process embodiments disclosed herein can be executed on processor 202, or can be performed across a network such as the Internet, intranet networks, or local area networks, in conjunction with a remote processor that shares a portion of the processing. Additional mass storage devices (not shown) can also be connected to processor 202 through network interface 216.

[0031] An auxiliary I/O device interface (not shown) can be used in conjunction with computer system 100. The auxiliary I/O device interface can include general and customized interfaces that allow the processor 202 to send and, more typically, receive data from other devices such as microphones, touch-sensitive displays, transducer card readers, tape readers, voice or handwriting recognizers, biometrics readers, cameras, portable mass storage devices, and other computers.

[0032] In addition, various embodiments disclosed herein further relate to computer storage products with a computer readable medium that includes program code for performing various computer-implemented operations. The computer-readable medium is any data storage device that can store data which can thereafter be read by a computer system. Examples of computer-readable media include, but are not limited to, all the media mentioned above: magnetic media such as hard disks, floppy disks, and magnetic tape; optical media such as CD-ROM disks; magneto-optical media such as optical disks; and specially configured hardware devices such as application-specific integrated circuits (ASICs), programmable logic devices (PLDs), and ROM and RAM devices. Examples of program code include both machine code, as produced, for example, by a compiler, or files containing higher level code (e.g., script) that can be executed using an interpreter.

[0033] The computer system shown in FIG. 2 is but an example of a computer system suitable for use with the various embodiments disclosed herein. Other computer systems suitable for such use can include additional or fewer subsystems. In addition, bus 214 is illustrative of any interconnection scheme serving to link the subsystems. Other computer architectures having different configurations of subsystems can also be utilized.

[0034] FIG. 3 is a conceptual diagram illustrating an example embodiment of a time series execution model 300. The model includes processing operations (also referred to as "boxes"). As shown, example operations include map 302, join 304, and reduce 306. FIG. 3 shows the example of processing a query of "ts(cpu.loadavg.lm) + rate(ts(cpu.loadavg.lm))," where ts() takes a query and determines a corresponding time series. In this example, the query is for a sum of a time series corresponding to an average load of a CPU and a rate of the same time series. Rate can be implemented by a map operator such as map 302 shown in FIG. 3.

[0035] In operation, the input stream is a time series corresponding to

cpu.loadavg.lm. One version of ts(cpu.loadavg.lm) is sent directly to join 304 and another is subjected to map 302. The result of map 302 is the result of the operation

rate(ts.(cpu.loadavg.lm)). The join operation synthetically produces (e.g., interpolates) data points in either of the input streams, ts(cpu.loadavg.lm) and rate(ts.(cpu.loadavg.lm)), as needed to perform subsequent operations. This is further described herein with respect to FIGS. 4 and 5. In embodiments in which discrete time series data are not fully aligned, the joining includes annealing data prior to reduction. The join operation produces two processed streams, which are received by reduce operator 306. Reduce 306 sums the input streams and outputs an answer to the query. In various embodiments, the reduce operator can include operations taken on observations that occur at the same time, e.g. averaging data, summing data, etc. In the example shown, the query need not include parameters for gridding. Instead, the join operator determines and produces synthetic points such that high fidelity is maintained when combining data. That is, fidelity is preserved because gridding need not be performed.

[0036] In an embodiment (not shown), a resample operator can be applied following reduce 306 to a final continuous stream so that it is sampled at the desired resolution defined by the user and returned as discrete data.

[0037] The processing operations described herein are performed by operators.

Operators can receive one or more streams, perform operations on the streams, and output one or more streams. An output stream can include characteristics, which can be tagged. For example, a flag ("isContinuous" for simplicity) can indicate whether a stream is continuous at a particular timestamp. As another example, another flag ("isContinuousUntil" for simplicity) can indicate a time up until which a stream is continuous. The isContinuousUntil flag can be used by summarization or windowing operators to prioritize discrete data. For example, when advancing a stream while summarizing for which both discrete and continuous data are available, the stream can be advanced beyond any piecewise continuous portion of the stream to obtain the discrete data. The boxes can operate on past data or in real time as the data comes in.

[0038] A constant operator outputs a constant value. In some embodiments, the constant value is output regardless of the wall-clock. In various embodiments, the output of the constant operator is continuous.

[0039] A function operator changes its output depending on a current time. For example, the current time can be based on the wall-clock. In various embodiments, the output of the function operator is continuous.

[0040] An empty operator generates no points. For example, this operation can be used when a user invokes a discrete data source that is empty.

[0041] A map operator transforms a stream. The map operator can take a function and time series as input and perform the function over one or more values of the time stream. In various embodiments, the map operator maintains the characteristics of the time series such that output for an input stream that is continuous is also continuous. In an embodiment, a series is delayed by transforming the timestamp such that the observations appear to be from another time (e.g., the past) or data from another time stamp can be brought to a present timestamp. In various embodiments, the map operator takes a timestamp (e.g., a time prior to a current time) and a value of a stream at that timestamp. This information is passed, along with a current value and time, to perform operations that use at least some of the information. For example, rate and deriv are operations based on a first timestamp, a second timestamp, and corresponding values at those times.

[0042] A filter operator processes a time series such that at least some data contained in the time series is altered or prevented from being output. The filter operator receives a stream and filters the stream based on a predicate, where the filtering removes or alters some values of the stream instead of passing the value directly downstream. For example, the filter operator can remove pre-defined values (NaN, null, etc.) from a stream, filter points based on their values or timestamps, and the like.

[0043] A last operator converts a discrete stream to a continuous stream. The conversion is made by taking each discrete value and maintaining the value for a predefined duration ("MaxDistance" for simplicity). For example, a piecewise continuous stream is reported as continuous until at least one of MaxDistance has elapsed and a timestamp corresponding to a next discrete point.

[0044] A next operator converts a discrete stream to a continuous stream. The conversion is made by taking one or more discrete values and making it available up to MaxDistance before its actual occurrence. For example, a piecewise continuous stream is reported as continuous until at least one of MaxDistance has elapsed and a timestamp corresponding to a next discrete point.

[0045] A window operator stores values over a range ("WindowSize" for simplicity) and applies a function to the data within the range. The range and the function can be provided to the window operator. In various embodiments, the output is continuous as the window can move over data at infinitely small resolutions. In various embodiments, a flag ("isDefinedWithNo Values" for simplicity) is provided to the operation and specifies whether the operation should be invoked when there are no values observed in an entire range corresponding to WindowSize. For example, if isDefinedwithNo Values is false, running the window operator over the stream produces no data. [0046] A resample operator converts an input stream to a discrete stream that is at least paced at a predefined window size. The input stream can be discrete or continuous. The resample operator can summarize data that is present in the input stream. In various embodiments, conversion is not performed for a piecewise series that is continuous throughout the defined window. Instead, the input stream is sampled at the start of the window.

[0047] An extend operator repeats a last known value based on input parameters. The extend operator takes an input stream and a MaxDistance (e.g., as measured from the wall clock), determines a last known value of the stream, and repeats the last known value if the last known tuple has a timestamp that is within a threshold. In various embodiments, the threshold is now()— MaxDistance, where now corresponds to a current timestamp. The extend operator facilitates operations by ensuring that sensors reporting data sporadically will have a value (a last known value) for operations such as aggregations or windowing. In various embodiments, the extend operator differs from the last operator in that the extend operator uses the wall-clock as the anchor while the last operator uses a time stamp of a last known tuple as the anchor.

[0048] An interpolate operator converts an input stream to a continuous stream by creating linearly interpolated lines between discrete data points. The input stream can be any type of stream. For example, a discrete stream is converted to a continuous stream and a piece-wise continuous stream is converted to a fully continuous stream.

[0049] A default operator takes two input streams and provides an output in which one or more values from a first stream is substituted for one or more values in a second stream. In assembling an output stream, if a value for a first input stream is not available at a particular timestamp, a substitute value from a second stream is used instead. In an embodiment, attack and/or release parameters define how the substitution is performed. The attack parameter defines a length of time that the operator waits after a last value of the first stream was observed before a value from the second stream is substituted. The release parameter defines a length of time during which values from the second stream are used. For example, after the length of time has expired, the operator no longer substitutes values from the secondary stream. If the attack parameter is infinity, the second stream is not used as a substitute. If the release parameter is infinity, the second stream will be used up until the first discrete data point is observed in the first stream. [0050] A join operator takes input times series and combines the input series. The join operator accommodates input time series including those that are not time-aligned. An input time series is automatically interpolated, for example by applying the interpolate operator internally to yield one or more values for timestamps that do not have originally sampled values. In various embodiments, each input times series is automatically interpolated. A parameter ("InnerJoin" for simplicity) defines whether the join operator invokes a given reducer function on inputs when there are time series that have not yet started or have already finished (because the interpolate operator adds points between discrete points, but not before a times series begins or after it ends). In various embodiments, a flag ("isDefmedWithNo Values" for simplicity) is provided to the operation and specifies whether the operation should be invoked when there are no values observed in an entire range corresponding to WindowSize. For example, if isDefinedwithNo Values is false, running the window operator over the stream produces no data.

[0051] The join operator can be adapted to characteristics of input streams. For example, the joining of input streams can be optimized based on the characteristics of the input streams. For example, a single-series join reduces the operation to a map reducer, operating on each point in the series. A continuous-only join is performed if all input series are continuous and optimizes the join by choosing a sampling annealer that advances each continuous stream to a given timestamp and invokes the reducers on the values. The resulting series is continuous. A single-discrete join is performed if one input series is discrete and other streams are continuous, and optimizes the join by choosing a single driving annealer that hops at the pace of the discrete series and have all the other continuous series aligned with the timestamp of the discrete series. An annealing join allows an arbitrary number of continuous and discrete streams to be joined. Continuous streams are sampled while the timestamp of the slowest progressing discrete stream is used at each step to advance the final timestamp of the resultant series. A reducer function is applied to values of the input streams. The final series is either purely discrete (e.g., if all input series are purely discrete) or piecewise continuous (e.g., a single continuous series present in the annealer would make that region of annealing continuous).

[0052] A summary of each of the operators described herein is shown in Table 1. The operators are represented with the input parameters that it takes and, if applicable, the streams with which the operation is called. For example, Join(InnerJoin, IsDefmedWithNo Values, R = f(xl , ... , xn))(S 1 , ... , Sn) means that the join operation takes InnerJoin,

IsDefinedWithNo Values, and R as parameters, and operations on input streams

[0053] Some of the operations described herein provide a particular output regardless of input, some operations receive a single input and provide a single output (SISO), and some operations receive multiple input and provide a single output (MISO). By way of non- limiting example, the following operations provide a particular output regardless of input: constant, function, and empty. By way of non-limiting example, the following operations are SISO: map, filter, last, next, window, resample, extend, and interpolate. By way of non- limiting example, the following operations are MISO: default and join.

[0054] In some embodiments, for example those in which an intended operation on a point stream is not streamable, an operator can memorize an entire stream while running through the stream to yield an internal array of points and timestamps. For example, a normalize operator processes a time series by first reading the entire series to determine a maximum value prior to normalizing the values of the time series.

[0055] FIG. 4 is a conceptual diagram illustrating an example embodiment of a join operation. The join operation can be performed on time series TSl, TS2, and TS3. Each time series includes sampled data points, represented by a solid circle. For example, TSl includes sampled data points at times tl, t2, t5, and tlO; TS2 includes sampled data points at times t2, t5, and t9; TS3 includes sampled data points at times t3, t4, and t5. Data points can be generated by interpolating, e.g. applying a "last" function. In the example shown, time series Tl and T2 include interpolated data points, represented by a dashed circle. Interpolated data points are those that were not collected, but are constructed based on known data points. TS 1 includes interpolated data point 402 at time t3, interpolated data point 404 at time t4, and an interpolated data point at time t9. The values of interpolated data points 402 and 404 can be determined from the values of surrounding sampled data points such as the data points at times t2 and t5. In the example shown, interpolation is performed for points that have sampled data points prior and subsequent to the times missing sampled data points.

Interpolation is not performed for points that are missing either a point prior to or subsequent to the missing point. TS2 includes interpolated data points at times t3 and t4. TS3 does not include interpolated data points.

[0056] Conventional techniques for generating the output stream includes summarizing, gridding, or interpolating the time series such that, at any given time, a point is available for each time series with which to perform operations. This is costly, especially if there are many time series and/or missing data points for the time series.

[0057] Techniques of the present disclosure provide for more efficient operations by interpolating points as necessary. As shown in FIG. 4, points at times t3 and t4 are interpolated, but others are not because those are the times for which output points can be generated. Whether output points can be generated depends on other times series. For example, output points are not generable at times tl, t2, t6, t7, t8, t9, and tlO in the example shown because the operation in the example expects a data point for each stream to generate output. There are no sampled data points and no data point can be interpolated for times tl, t2, t6, t7, t8, t9, and tlO for at least one of the streams. Thus, output cannot be generated even if interpolation can be performed for another one of the streams.

[0058] In FIG. 4, the result of the output stream shown represents a result of a join operation. The output stream includes defined points 406, 408, 412 at times t3-t5. At times tl, t2, t9, tlO, although there is a sampled data point at a corresponding time for at least one of the time series T1-T3, there is no defined point in the output stream. This is because, for the example shown, the operation is performed for points on all time series. That is, if one of the time series does not have a point at a particular time, the operation does not generate a result for that time in the output. At times t3, t4, and t5, defined points are generated for the output because there are interpolated data points or sampled data points. At times tl, t2, t9, tlO, not all streams are present because at least one stream does not have a sampled or interpolated data point. Thus, no output is generated at those times.

[0059] FIG. 5 is a flowchart illustrating an example embodiment of a process 500

(also referred to as a "method") for high fidelity combination of data. The method can be performed by a processor such as system 100 shown in FIG. 1A, the system 150 shown in FIG. IB, or processor 202 shown in FIG. 2.

[0060] In 502, the method receives a first data stream (also referred to as "a first input data stream" or "a first stream"), a second data stream (also referred to as "a second input data stream" or "a second stream"), and an operation. Referring to the example of FIG. 4, the first input data stream is TS1 and the second input data stream is TS3. FIG. 4 also shows a third input data stream TS2. For simplicity, method 500 will be explained using only two input data streams, TS1 and TS3.

[0061] Returning to FIG. 5, in 504, the method determines whether the first stream and the second stream are de-synchronized. For example, two streams are de-synchronized if they are not aligned. Referring to the example of FIG. 4, the first input data stream TS1 and the second input data stream TS3 are desynchronized because at at least one time, a sampled data point exists for one stream but not the other. For example, at time t3, first stream TS1 does not have a sampled data point while second stream TS3 does have a sampled data point 406.

[0062] Returning to FIG. 5, if it is determined in 504 that the first and second streams are not de-synchronized (e.g., synchronized), the method can simply terminate. Otherwise, if the first and second streams are de-synchronized, the method proceeds to 506 in which the method generates samples to synchronize the first stream and the data stream. Referring to the example of FIG. 4, data point 402 is generated at time t3 and data point 404 is generated at time t4 so that first stream TS 1 and second stream TS3 become aligned. A data point that is synthetically generated is called an "interpolated data point" in the example of FIG. 4.

[0063] Returning to FIG. 5, in 508, the method performs the operation on the first and second streams, including on the generated samples. Referring to the example of FIG. 4, the operation is a join operation that yields defined points 406, 408, and 412. Although there is a sampled data point for one of the streams at other times, there is no sampled point or interpolated point for the other stream. Thus, no output is generated, as represented by a "not defined" dashed diamond symbol. For example, at time tl, although first stream TS1 has a sampled data point, second stream TS3 does not. Thus, for an operation such as join that takes in a value for each stream, no output is generated for time tl. As further described herein, some operations can be performed if at least one stream has a sampled point at a particular time, in which case output would be generated.

[0064] Returning to FIG. 5, in 512, the method delivers a result of the operation. In the example shown in FIG. 5, results are delivered dynamically, e.g. as points are generated and processed, the points are delivered. The points can be delivered to a browser and rendered on a graphical user interface.

[0065] The techniques described in FIG. 5 can be used to implement a filter or a query. For example, the techniques of FIG. 5 can provide a reducer that receives a query in the form of a synthetic time series (STS). The reducer can operate on one or more times series using the STS to determine those time series that match (or most closely match) the STS to output an answer to the query. This is further described herein in relation to FIG. 6.

[0066] FIG. 6 is a flowchart illustrating an example embodiment of a process 600

(also referred to as a "method) for query implementation using a synthetic time series. The STS can be constructed based on the query, such that the STS acts as a filter on times series data to yield an answer to the query. For example, a query is translated to an STS. Then, one or more time series that most closely match the STS can be identified using a reduce operation. If the query is a pattern, then an STS representing the pattern is generated and those time series that most closely match the pattern are identified. The method can be performed by a processor such as system 100 shown in FIG. 1A, the system 150 shown in FIG. IB, or processor 202 shown in FIG. 2.

[0067] In 602, the method detects a conditional query. For example, the method detects the type (e.g., conditional) of the query by parsing the query. In various embodiments, a conditional query is a query that is based on the satisfaction of one or more conditions. A conditional query can include a conditional expression, conditional logic, and the like.

[0068] In 604, the method finds a predicate in the query. The predicate can be determined during the parsing of the query. The predicate forms at least part of a basis for generating an STS and/or determining candidate time series that match the synthetic time series. The detection of a conditional query (602) and finding a predicate in the query (604) are further discussed herein with respect to FIGS. 7 and 8. In some embodiments, 602 and 604 are performed by a parser such as the parser 108 shown in FIG. 1.

[0069] In 606, the method determines candidates based on the query. The candidates can be determined during the parsing of the query. The candidates form at least part of a basis for generating an STS and/or determining candidate time series that match the synthetic time series. The determination of candidates is further discussed herein with respect to FIGS. 7 and 8.

[0070] Returning to FIG. 6, in 608, the method generates an STS. An STS can be generated for each candidate determined in 606. The STS can be used as part of a reduction process to identity time series that correspond to the STS. The generation of the STS is further discussed herein with respect to FIGS. 9 and 10.

[0071] In 612, the method sends STS and times series to a reducer. The reducer determines input time series that most closely match the STS. For example, closely matching (also referred to as "correlating") time series are those meeting a threshold or criteria related to the STS. The reducer can be implemented according to the techniques described herein, e.g. in relation to FIG. 5. The sending of the STS and times series to the reducer is further described herein with respect to FIG. 10.

[0072] In 614, the method produces an output time series. The output time series can be a response or answer to the query. In various embodiments, the output can include one or more streams, for example the top three matching data streams. The number of output streams can be defined by the query, a threshold, or other pre-defined criteria.

[0073] In an alternative embodiment, an STS query alone can be used without other types of times series such as observed time series. For example, an answer to a query for a total number of weekdays in a span of time can be generated using a STS without other types of time series.

[0074] FIG. 7 is a conceptual diagram illustrating an example embodiment of a query

700. The query "if (between weekday ("PST"), 2, 3, ts (...)) > 100" can be determined to be a conditional query because it represents the conditional query, "return a data point if a data sample that is collected on Tuesday and Wednesday (based on Pacific Standard Time) is greater than 100." For example, a parser detecting a keyword ("if in this example) can determine that the query is conditional. For example, the data points can represent temperatures. In this example, the answer to the query would be data points in input streams that correspond to every incidence of temperature exceeding 100 degrees on Tuesday or Wednesday. In other words, those temperatures recorded on Tuesday or Wednesday that are over 100 degrees are determined to satisfy the condition defined in the query.

[0075] FIG. 8 is a conceptual diagram illustrating an example embodiment of a parse tree 800 corresponding to the query shown in FIG. 7. The parsing can be performed according to various natural language processing techniques. The query "if (between weekday ("PST"), 2, 3, ts (...)) > 100" is parsed as follows. Each node in the parse tree is labeled with the corresponding semantic element of query 700. Element A is a predicate, element B is a candidate, element C is a lower threshold, element D is an upper threshold, and element E is a criteria. Each of these elements can be identified when the query is received and parsed.

[0076] The root of the tree 800 is "greater than." For example, when parsing in the query shown in FIG.7, a first operation is a binary operation between the expression 100 and if(). A first child, "100" is identified as a criteria and "if is identified as a condition. The "if then branches into three children, "between," "then," and "else." "Between" is identified as a predicate. "Then" and "else" are expected conditions for "if," where responsive to "if being satisfied, outcomes associated with "then" occur. In this example, "then" corresponds to identifying and returning a data point. Otherwise, outcomes associated with "else" occur. In this example, "else" corresponds to not returning the point (because it does not meet the predicate).

[0077] "Between" branches into "weekday," "low," and "high." "Weekday" identifies the candidates that will be tested for satisfaction of the conditions (criteria and predicate) defined by the query. For example, data samples will be analyzed to determine weekday information contained in the data samples. "Low" and "high" are thresholds that are relevant to the predicate. In this example, "low" and "high" are thresholds defining a range for "between."

[0078] FIG. 9 is a conceptual diagram illustrating an example embodiment of generating an STS. In the example shown, the STS is generated from identified candidates and thresholds. Candidates 902 include weekdays, e.g. days of the week: Sunday through Saturday, the low threshold 904 is 2 corresponding to Tuesday, and the high threshold 906 is 3 corresponding to Wednesday. In a time series, the weekdays are represented by curve 908, the low threshold is represented by curve 912, and the high threshold is represented by curve 914.

[0079] The candidate, low threshold, and high threshold are inputs to annealing 920.

The annealing 920 accepts these as inputs and outputs a STS as a result of the annealing. In FIG. 9, the STS 922 represents weekdays that fall on Tuesday or Wednesday, as shown by the high values corresponding to Tuesday and Wednesday and low values corresponding to the other days of the week. The STS can be used to identify candidates by focusing on the values of time series collected on Tuesdays and Wednesdays, as further described herein. In an embodiment, as shown, annealing includes joining the input time series 908, 912, and 914 to find their intersection.

[0080] FIG. 10 is a conceptual diagram illustrating an example embodiment of query implementation using an STS. In the example shown in FIG. 10, the query is performed on time series 1002.1-1002.5. According to the techniques described herein, an STS corresponding to the query is generated.

[0081] A reducer 1030 accepts times series as input and outputs one or more discrete data streams those most closely corresponds to the STS. The reducer receives input time series 1002.1-1002.5 and reducing the time series against the STS. Reducing the times series 1002.1-1002.5 and the STS is represented by overlay 1022. In the overlay, the STS is the thickened line 830.1. The input times series data set includes five times series, 1002.1- 1002.5. The superimposed series show how closely (or far) that various time series correspond to the STS.

[0082] In the example shown in FIG. 10, candidate answers 1050.1, 1050.2, and

1050.3 are the three series selected from among 1002.1-1002.5, which most closely match the STS. The top three candidates are those that most closely match the STS. The top three candidates are 1050.1, 1050.2, and 1050.3, because their shapes most closely match the STS. How closely the shapes match an STS can be determined based on an amount by which one or more points in a time series deviate from the STS.

[0083] For example, time series 1002.4 and 1002.5 do not sufficiently match the STS because the time series data does not include Tuesday and Wednesday data. For example, stream 1002.4 includes Thursday and Friday data and stream 1002.5 includes Monday and Tuesday data. Thus, they do not closely match the STS. In some embodiments, the candidate answers are output as discrete data streams. These candidates are then processed with criteria 1024.

[0084] The candidate streams 1050.1-1050.3 are then analyzed to find those points that satisfy the condition "greater than 100" (labelled 1024). The output of the analysis is an answer to the query. The answer can be output for further processor and/or for rendering on a graphical user interface.

[0085] The techniques described herein find application in a variety of management systems including streaming (real-time) analytics platforms such as application delivery (reducing downtime), monitoring SaaS and software performance across cloud and on- premise services, operational analytics, big data management (including searching, navigating, analyzing, correlating, and visualizing millions of data points per second), Internet of Things (real-time overview of sensors and devices), business metrics, and the like. The techniques described herein can combine data, while maintaining high fidelity, where the data is discrete, continuous, or a combination thereof. The techniques described herein handle data streams are not aligned, maintain high fidelity when combining data streams, and identifies time series that conform to a pattern, even when the set of time series is very large.

[0086] Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the disclosure is not limited to the details provided. There are many alternative ways of implementing the disclosure. The disclosed embodiments are illustrative and not restrictive.