I had a little mail conversation with Diplom-Informatiker Gerald G. Koch of the University of Stuttgart (Germany) on how in academia the difference between CEP and ESP is defined. I think it is interesting to share his explanation with the community (which he allowed me to, of course).
- ESP = Event Stream Processing
- CEP = Complex Event Processing
- Events are assumed to be ordered in the stream
- A stream contains one or a small, previously known number of event types
- When correlating several event streams, it is assumed that events appearing in both streams in parallel also occurred at (nearly) the same time
- Aggregation on streams aims on finding trends or abrupt changes in trends
- ESP yields incomplete results, because the window is a constraint arbitrarily set on the event history, so that not all patterns that actually occurred may be detected.
A problem of both approaches is their non-determinism (different event instances may match a pattern). In CEP, you can use policies in order to make pattern detection deterministic (e.g., select only the most recent pattern, or all possible patterns even if they intersect). In ESP, applying policies is not appropriate because of its incompleteness.
However, these are theoretical problems and most probably are not the foremost focus for currently deployed systems.