(With the continuous development of enterprise information construction, enterprises have established a large number of IT systems. These IT systems generate a lot of event information every day during the operation process. You need to judge the operation status of IT systems through these event information. However, the event information is distributed in different systems. In addition, a large or medium-sized data center usually generates tens of millions of event information every day.)