Optimized complex event processing in a software-defined network is provided. A computing device receives a rule that identifies a source device and an event notification condition. A network inventory structure that identifies a plurality of nodes in the network and corresponding processing capabilities is accessed. A particular datapath node of the plurality of nodes is identified. A packet flow window criterion and a packet operation are determined based on the event notification condition. A particular virtual network function (VNF) of a plurality of VNFs is identified based on the rule. A controller node datapath configuration command that comprises a source device identifier that identifies the source device, the packet flow window criterion, the packet operation, and a VNF identifier that identifies the particular VNF is generated. The controller node datapath configuration command is sent to a controller node of the plurality of nodes.