ApsaraMQ for Kafka:Event patterns

How matching works

Event pattern matching follows these rules:

• Structural match: A matched event must contain all fields specified in the pattern, with the same nested structure.

• Case-sensitive exact match: Every character in the pattern is matched exactly. EventBridge does not modify strings during matching.

• JSON values only: All values in a matched event must be valid JSON -- strings in double quotes, unquoted numbers, and unquoted keywords (true, false, null).

• AND across keys, OR within arrays: Keys in the pattern are combined with AND logic. Values within a key's array are combined with OR logic.

Operator reference

The following table summarizes all supported operators. Each operator is described in detail in the sections below.

Exact value matching

Match events where a field equals a specific value. Wrap the target value in an array.

Pattern syntax:

{
    "source": ["acs.oss"]
}

This pattern matches any event where source is "acs.oss". Events with a different source value, such as "acs.aliyuncvc" or "acs.imm", are not matched.

Full example:

The following event matches because its source field is "acs.oss":

Event:

{
    "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source": "acs.oss",
    "specversion": "1.0",
    "type": "oss:ObjectCreated:PostObject",
    "datacontenttype": "application/json",
    "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time": "2020-08-17T16:04:46.149Asia/Shanghai",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Pattern:

{
    "source": ["acs.oss"]
}

Result: Matched. An event with "source": "acs.aliyuncvc" would not match this pattern.

Prefix matching

Match events where a field value starts with a specified string.

Pattern syntax:

{
    "source": [{"prefix": "acs."}]
}

This pattern matches any event whose source value begins with "acs.", such as "acs.oss" or "acs.imm".

Full example:

Event (source starts with "acs." -- matched):

{
    "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source": "acs.oss",
    "specversion": "1.0",
    "type": "oss:ObjectCreated:PostObject",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Pattern:

{
    "source": [{"prefix": "acs."}]
}

Suffix matching

Match events where a field value ends with a specified string. Combine with prefix matching to broaden results using OR logic within the array.

Pattern syntax:

{
    "subject": [
        {"prefix": "acs:oss:cn-hangzhou:1234567:xls-papk/"},
        {"suffix": ".txt"},
        {"suffix": ".jpg"}
    ]
}

This pattern matches events whose subject starts with the specified prefix and ends with .txt or .jpg. The prefix condition and one of the suffix conditions must both be true.

Full example:

Event (subject ends with ".jpg" -- matched):

{
    "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source": "acs.oss",
    "type": "oss:ObjectCreated:PostObject",
    "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Event (subject ends with ".png" -- not matched):

{
    "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source": "acs.oss",
    "type": "oss:ObjectCreated:PostObject",
    "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Pattern:

{
    "subject": [
        {"prefix": "acs:oss:cn-hangzhou:1234567:xls-papk/"},
        {"suffix": ".txt"},
        {"suffix": ".jpg"}
    ]
}

Contains matching

Match events where a field value includes a specified substring.

Pattern syntax:

{
    "type": [{"contains": "Normal"}]
}

This pattern matches events whose type value contains the substring "Normal", such as "UserNormalEvent".

To match multiple substrings with OR logic, add more entries to the array:

{
    "type": [
        {"contains": "Normal"},
        {"contains": "Error"}
    ]
}

This pattern matches events whose type contains "Normal" or "Error". For example, both "UserNormalEvent" and "UserErrorEvent" match, but "UserOtherEvent" does not.

Anything-but matching

Match events where a field value does not equal one or more specified values. The anything-but operator supports strings, numbers, arrays, and prefix-based exclusion.

{
    "data": {
        "state": [{"anything-but": "initializing"}]
    }
}

{
    "data": {
        "x-limit": [{"anything-but": 123}]
    }
}

{
    "data": {
        "state": [{"anything-but": ["stopped", "overloaded"]}]
    }
}

{
    "data": {
        "x-limit": [{"anything-but": [100, 200, 300]}]
    }
}

{
    "data": {
        "state": [{"anything-but": {"prefix": "init"}}]
    }
}

{
    "source": [{"anything-but": ["acs.aliyuncvc"]}]
}

{
    "source": [{"anything-but": {"prefix": "acs."}}]
}

Numeric matching

Match events based on numeric values or ranges.

Pattern syntax:

{
    "data": {
        "c-count": [{"numeric": [">", 0, "<=", 5]}],
        "d-count": [{"numeric": ["<", 10]}],
        "x-limit": [{"numeric": ["=", 301.8]}]
    }
}

This pattern matches events where all three conditions are true (AND logic across keys):

• data.c-count is greater than 0 and less than or equal to 5

• data.d-count is less than 10

• data.x-limit equals 301.8

Supported operators: >, >=, <, <=, =

Range expressions: Combine two operators in a single array to define a range, such as [">", 0, "<=", 5].

IP address matching

Match events based on an IPv4 address in CIDR notation.

Pattern syntax:

{
    "data": {
        "source-ip": [{"cidr": "10.0.0.0/24"}]
    }
}

This pattern matches events where data.source-ip falls within the 10.0.0.0/24 subnet. For example, "10.0.0.123" matches, but "192.168.0.123" does not.

Exists matching

Match events based on whether a field is present or absent.

Pattern syntax:

Match events where the field does not exist:

{
    "data": {
        "state": [{"exists": false}]
    }
}

Setting "exists": false matches events that do not contain data.state.

Null and empty string matching

Match events where a field value is null or an empty string.

Match an empty string:

{
    "data": {
        "eventVersion": [""]
    }
}

This pattern matches events where data.eventVersion is "". It does not match events where data.eventVersion is null or has any non-empty value.

Match a null value:

{
    "data": {
        "responseElements": [null]
    }
}

This pattern matches events where data.responseElements is null. It does not match events where the field has a string value such as "lss".

Array matching

When a field value in the event is an array, matching succeeds if the event array and the pattern array share at least one common element (non-empty intersection).

Pattern syntax:

{
    "subject": [
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
    ]
}

This pattern matches events where subject equals any of the three values. If the event's subject is itself an array, the pattern matches when the two arrays share at least one element.

Example with array-valued field:

The following event matches because the event's subject array and the pattern array share the element "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg":

{
    "subject": [
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
    ],
    "source": "acs.oss",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Combined conditions

Combine multiple operators in a single pattern to create precise filters. Keys in the pattern use AND logic, so all conditions must be satisfied for a match.

Example: This pattern combines prefix, anything-but, CIDR, and numeric matching:

{
    "source": [{"prefix": "acs."}],
    "data": {
        "state": [{"anything-but": "initializing"}],
        "source-ip": [{"cidr": "10.0.0.0/24"}],
        "c-count": [{"numeric": [">", 0, "<=", 5]}],
        "d-count": [{"numeric": ["<", 10]}],
        "x-limit": [{"anything-but": [100, 200, 300]}]
    }
}

An event matches this pattern only when all of the following are true:

• source starts with "acs."

• data.state is not "initializing"

• data.source-ip is in the 10.0.0.0/24 subnet

• data.c-count is greater than 0 and at most 5

• data.d-count is less than 10

• data.x-limit is not 100, 200, or 300

If any single condition fails, the entire pattern does not match.

Limitations