About event patterns

Use this information to understand how patterns are created and how they differ from related event groups.

Patterns and related event groups
The use of patterns allows events with different Identifier fields to be grouped in the Event Viewer.
Extending patterns
Using regular expressions and name similarity, you can enable the discovery of a pattern instance on more than one resource.
Examples of pattern processing
The following examples illustrate how pattern processing is performed.
Overlapping event patterns
When a pattern instance is generated based on an event received in the live event stream, a search is performed for any existing pattern instances that contain an event with at least one of the same event type values, and that have matching resources. These are known as overlapping pattern instances. If there are overlapping pattern instances then a hierarchical event group structure is created and displayed in the Event Viewer.

Parent topic: Managing event patterns