Aspects include obtaining a pattern that describes an event in a natural language format. The pattern that describes the event is converted into at least one identified pattern key value pair. A database transaction is monitored and converted into a least one database transaction key value pair. A similarity score is calculated by scoring similarities between the identified pattern key value pair(s) and the database transaction key value pair(s). Based on similarity score meeting a threshold, an alert is output to indicate that the database transaction matches the pattern that describes the event.