Overview of decision management event processing

Decision management (Operational Decision Manager and Decision Intelligence) raw events are processed to time series, which are indexed in OpenSearch. The processing is defined by configuration. By configuring the processing, you customize how events are transformed and where to route events depending on their content.

IBM Business Automation Insights processes raw events that are emitted by decision management. As a result, a time-series document is written to OpenSearch. As an administrator or a business user, you can monitor data from OpenSearch through Business Performance Center. The result of the processing can also be sent to a Kafka egress topic for downstream use to drive automation, populate data lakes, and support other types of data storage.

By configuring the processing, you customize how events are transformed and where events are routed, based on their content. One of the benefits is for you to better target the data to be written to indices and to limit the number of data to be indexed. Thus, you can anticipate and prevent the risk of so-called mapping explosion.

The default processing configuration provides the exact same behavior to transform raw events to time series and use the same OpenSearch index. Your data is displayed in the same way in your existing dashboards. You can update and customize the configuration for your needs. For more information, see Default configuration, Updating the processing configuration, and Configuring a monitoring source for Operational Decision Manager events.

Examples

The provided examples illustrate typical use cases of event processing customization.

Example 1: Processing and writing business data or common data: Based on your monitoring requirements, you can choose to process business data or common data or both.
Example 2: Writing time series to dedicated OpenSearch indices based on the ruleset path: Based on the ruleset path, you can choose to process and write business data or common data to dedicated indices.
Example 3: Filtering out data: You can remove data that yo do not want to monitor.
Example 4: Obfuscating data: You can obfuscate data to comply with regulations.

Mappings explosion risk

The risk of mapping explosion in OpenSearch occurs when too many fields are defined in a single OpenSearch index, which can lead to out-of-memory errors and difficult situations to recover from. By customizing the decision management processing configuration, you prevent the risk by configuring data to be split to dedicated indices and by removing data that is not targeted for monitoring.

For more information, see the Create or update mappings External link opens a new window or tab page of the OpenSearch documentation.