Event Abstractor

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for detecting higher level events based on lower level events. In one aspect, a method includes receiving a stream model that defines elements of a data domain. A stream mapping that defines sensor identifiers for real-world sensors and associates each sensor identifier with a respective element of the data domain is received. A user-specified stream matching pattern is received. The stream matching pattern specifies respective sensor identifiers of sensor identifiers of the real-world sensors, and for each sensor identifier, a tuple of data elements of the stream model and, for each tuple of data elements, co-occurrence criteria including at least one time window. A stream of events is obtained from the real-world sensors. A determination is made that two or more events co-occur within the time window and whether the one or more co-occurrence criteria are satisfied.