Events

Everything that we observe is denoted as an event. Observation is always a time specific attribute because observability is always calculated with respect to time. An event is a discrete data record with significant points of analysis that occurred at a given time (timestamp) for a specific entity. Events are automatically generated when the entities change state, errors occur, and so on.

All data operations are simple events. The following operations are examples of events:

• store the data
• fetch the data
• transfer the data to a network

Everything in the Cisco Observability Platform data model is an event, such as system start , system stop, any violation and so on. Events include raw data for example, log messages. Logs in the Cisco Observability Platform data model are considered to be events.

Each reported event is a discrete immutable stored entry. You can store multiple identical events (same type, timestamp and attributes) in the system.

Events in the Cisco Observability Platform Model

In an Cisco Observability Platform model, an event is distinguished based on the properties that are required for making it an event type. The event kind has some properties that are measured using key-value pairs. If anything includes these properties, then it is an event. The keys are static, whereas the values may change based on your solution.

An event kind describes the properties of an event and the event type describes the structure of the event. You can define the event type to use the event entity within the Cisco Observability Platform model for your solution.

Event Kind

Event kind is a set of defined fields that describe the event. You can use the same event kind to describe a new event.

The event kind is associated with the event type. This event type is used for the manifest file within the solution. For information about kinds and type, see Glossary. For information about creating a solution that includes the event type file, see the student guide.

Each event kind includes the following states or properties:

Event Type

You can define different types of events in the Cisco Observability Platform data model. To define a new event, create an event type in the event.json file in a solution package. The following table describes the required parameters or keys to define an event type:

Example

The following JSON file is an example of an event type definition of the events defined in the intercom message data model:

{
  "namespace": {
    "name": "${manifest.name & manifest.tag}",
    "version": 1
  },
  "kind": "event",
  "name": "intercomMessage",
  "displayName": "The event to capture the messages sent on intercom on space fleet.",
  "attributeDefinitions": {
    "attributes": {
      "sender": {
        "type": "string"
      },
      "receiver": {
        "type": "string"
      },
      "sourceRoom": {
        "type": "string"
      },
      "destinationRoom": {
        "type": "string"
      },
      "messageText": {
        "type": "string"
      }
    }
  }
}

Add New Entity Type to the Solution

The Cisco Observability Platform (fsoc) provides the following command to help you easily add a new entity type to your solution:

fsoc solution extend –-add-event=<event-name>

Replace with the name of the new event you want to add to your solution data model.

Assign Events and Logs to Entities

Cisco Observability Platform automatically assigns any log data to the respective entities across domains. This eliminates the need to manually assign the events or logs to entities in the solution data model.