A journal is a temporal view of a query whereby the results of a query are grouped into fixed time periods (such as every minute, hour or day etc).
A journal can be used to calculate aggregates and/or detect anomalous conditions for message data in real-time.
For example, a journal could be used to:
- Count the number of messages acquired each hour.
- Insert an alert row for each message that matches given criteria.
- Count the number of messages with a measure that exceeds a given threshold during each day
Note that the query results of a journal are materialised so that the results of a journal can be retained independently of the underlying source data - hence tables and journals are purged independently.