Complex event processing (CEP) is a technology based on stream processing, which regards the system data as different types of events, establishes different event relationship sequence libraries by analyzing the relationship between events, and finally generates high-level events from simple events by using filtering, correlation, aggregation and other technologies, and tracks and analyzes important information by means of pattern rules, Discover valuable information from real-time data. After receiving the data, streaming will process the data immediately. Because the data is sent one by one and queued according to time, like water flow, it is called data flow, and streaming operates the data flow, so it is called stream processing. Streaming features real-time response and low delay. Data is not stored, first calculation, continuous query, event driven. Real time analysis of streaming application scenarios: such as real-time log processing, traffic flow analysis, etc. Flink CEP is a complex event processing (CEP) library implemented on Flink. It allows us to detect the pattern of events in the event flow and gives us the opportunity to master the important matters in the data.