A method of creating rule information, the method includes: from a complex rule defining a complex condition being a combination of conditions on event data individually belonging to each of a plurality of event data classes, and a complex rule defining a predetermined action when the complex condition is satisfied, first extracting a condition on event data belonging to each of the event data classes from the complex condition; and creating an extraction rule for extracting event data to be an application target of the complex rule satisfying the extracted condition from an event data group.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A method of creating rule information, the method comprising: from a complex rule defining a complex condition being a combination of conditions on event data individually belonging to each of a plurality of event data classes, and a complex rule defining a predetermined action when the complex condition is satisfied, first extracting a condition on event data belonging to each of the event data classes from the complex condition; and creating an extraction rule for extracting event data to be an application target of the complex rule satisfying the extracted condition from an event data group. 2. The method according to claim 1, further comprising: by applying the created extraction rule to the event data group, second extracting event data to be an application target of the complex rule from the event data group. 3. The method according to claim 2, further comprising: third extracting another condition on the event data belonging to the event data class common to the complex condition of each of the plurality of complex rules from the plurality of the complex rules; and after executing the third extracting, discarding the event data group when there is no event data satisfying the other condition among the event data group. 4. The method according to claim 2, further comprising: based on a predetermined threshold value corresponding to a specific event data class, and the complex rule, creating a new complex rule defining a complex condition combining a first condition including existence of specific data based on a comparison result between a number of extracting event data belonging to the specific event data class and the predetermined threshold value, and a second condition on event data belonging to a different event data class from the specific event data class included in the complex rule, and an action corresponding to the comparison result when the complex condition is satisfied; applying the extraction rule to the event data group; creating the specific data based on the comparison result between a number of pieces of event data belonging to the specific event data class extracted from the event data group by the applying, and the predetermined threshold value; and setting the event data extracted from the event data group by the applying, and the specific data to an application target of the new complex rule. 5. The method according to claim 4, further comprising: discarding event data belonging to the specific event data class among the event data group when the number is higher than the predetermined threshold value; and setting event data excluding the event data discarded by the discarding among the event data extracted from the event data group by the applying, and the specific data to an application target of the new complex rule. 6. The method according to claim 1, wherein the creating creates the extraction rule based on a number of pieces of event data belonging to each of the event data classes included in the event data group. 7. An apparatus comprising: a memory; and a processor coupled to the memory and configured to: from a complex rule defining a complex condition being a combination of conditions on event data individually belonging to each of a plurality of event data classes, and a complex rule defining a predetermined action when the complex condition is satisfied, extract a condition on event data belonging to each of the event data classes from the complex condition, and create an extraction rule for extracting event data to be an application target of the complex rule satisfying the extracted condition from an event data group. 8. The apparatus according to claim 7, wherein the processor is configured to: by applying the created extraction rule to the event data group, extract event data to be an application target of the complex rule from the event data group. 9. The apparatus according to claim 8, wherein the processor is configured to: extract another condition on the event data belonging to the event data class common to the complex condition of each of the plurality of complex rules from the plurality of the complex rules, and after executing the another condition, discard the event data group when there is no event data satisfying the other condition among the event data group. 10. The apparatus according to claim 8, wherein the processor is configured to: based on a predetermined threshold value corresponding to a specific event data class, and the complex rule, create a new complex rule defining a complex condition combining a first condition including existence of specific data based on a comparison result between a number of extracting event data belonging to the specific event data class and the predetermined threshold value, and a second condition on event data belonging to a different event data class from the specific event data class included in the complex rule, and an action corresponding to the comparison result when the complex condition is satisfied, apply the extraction rule to the event data group, create the specific data based on the comparison result between a number of pieces of event data belonging to the specific event data class extracted from the event data group by applying of the extraction rule, and the predetermined threshold value, and set the event data extracted from the event data group by applying of the extraction rule, and the specific data to an application target of the new complex rule. 11. The apparatus according to claim 10, wherein the processor is configured to: discard event data belonging to the specific event data class among the event data group when the number is higher than the predetermined threshold value, and set event data excluding the event data discarded by the discarding among the event data extracted from the event data group by applying of the extraction rule, and the specific data to an application target of the new complex rule. 12. The apparatus according to claim 7, wherein the processor is configured to: create the extraction rule based on a number of pieces of event data belonging to each of the event data classes included in the event data group. 13. A non-transitory storage medium that stores a program for causing a computer to execute a process, the process comprising: from a complex rule defining a complex condition being a combination of conditions on event data individually belonging to each of a plurality of event data classes, and a complex rule defining a predetermined action when the complex condition is satisfied, first extracting a condition on event data belonging to each of the event data classes from the complex condition; and creating an extraction rule for extracting event data to be an application target of the complex rule satisfying the extracted condition from an event data group. 14. The non-transitory storage medium according to claim 13, wherein the process further comprising: by applying the created extraction rule to the event data group, second extracting event data to be an application target of the complex rule from the event data group. 15. The non-transitory storage medium according to claim 14, wherein the process further comprising: third extracting another condition on the event data belonging to the event data class common to the complex condition of each of the plurality of complex rules from the plurality of the complex rules; and after executing the third extracting, discarding the event data group when there is no event data satisfying the other condition among the event data group. 16. The non-transitory storage medium according to claim 14, wherein the process further comprising: based on a predetermined threshold value corresponding to a specific event data class, and the complex rule, creating a new complex rule defining a complex condition combining a first condition including existence of specific data based on a comparison result between a number of extracting event data belonging to the specific event data class and the predetermined threshold value, and a second condition on event data belonging to a different event data class from the specific event data class included in the complex rule, and an action corresponding to the comparison result when the complex condition is satisfied; applying the extraction rule to the event data group; creating the specific data based on the comparison result between a number of pieces of event data belonging to the specific event data class extracted from the event data group by the applying, and the predetermined threshold value; and setting the event data extracted from the event data group by the applying, and the specific data to an application target of the new complex rule. 17. The non-transitory storage medium according to claim 16, wherein the process further comprising: discarding event data belonging to the specific event data class among the event data group when the number is higher than the predetermined threshold value; and setting event data excluding the event data discarded by the discarding among the event data extracted from the event data group by the applying, and the specific data to an application target of the new complex rule. 18. The non-transitory storage medium according to claim 13, wherein the creating creates the extraction rule based on a number of pieces of event data belonging to each of the event data classes included in the event data group.