ApsaraMQ for RabbitMQ:Event patterns

How matching works

EventBridge evaluates each incoming event against your pattern using these rules:

Operator reference

Use the following table to find the right operator for your filtering needs. Detailed syntax and examples follow in each section.

Exact value match

To match events where a field equals a specific value, wrap the value in an array.

Pattern:

{
    "source": ["acs.oss"]
}

This pattern matches events where source is "acs.oss". Events with a different source, such as "acs.ecs" or "acs.imm", do not match.

Example -- The following OSS event matches because source is "acs.oss":

{
    "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source": "acs.oss",
    "specversion": "1.0",
    "type": "oss:ObjectCreated:PostObject",
    "datacontenttype": "application/json",
    "dataschema": "http://example.com/test.json",
    "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time": "2020-08-17T16:04:46.149Asia/Shanghai",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Events with a different source do not match:

• An event with "source": "acs.ecs" (Elastic Compute Service)

• An event with "source": "acs.imm" (Intelligent Media Management)

Prefix match

To match events where a field value starts with a specific string, use the prefix operator.

Pattern:

{
    "source": [{"prefix": "acs."}]
}

This pattern matches events where source starts with "acs.", such as "acs.oss" and "acs.imm".

Suffix match

To match events where a field value ends with a specific string, use the suffix operator.

Combine prefix and suffix in the same array to apply both conditions. Multiple suffix entries use OR logic -- the event matches if any suffix matches.

Pattern:

{
    "subject": [
        {"prefix": "acs:oss:cn-hangzhou:1234567:xls-papk/"},
        {"suffix": ".txt"},
        {"suffix": ".jpg"}
    ]
}

This pattern matches events where subject starts with the specified OSS path prefix AND ends with .txt or .jpg. An event with subject ending in .png does not match.

Contains match

To match events where a field value contains a specific substring, use the contains operator.

Single substring:

{
    "type": [{"contains": "Normal"}]
}

Matches events like "type": "UserNormalEvent". Does not match "type": "UserErrorEvent".

Multiple substrings (OR logic):

{
    "type": [
        {"contains": "Normal"},
        {"contains": "Error"}
    ]
}

Matches events where type contains either "Normal" or "Error". Both "UserNormalEvent" and "UserErrorEvent" match. "UserOtherEvent" does not.

Anything-but match

To exclude events that match specific values, use the anything-but operator. Events with any other value for the specified field pass through.

{
    "data": {
        "state": [{"anything-but": "initializing"}]
    }
}

{
    "data": {
        "x-limit": [{"anything-but": 123}]
    }
}

{
    "data": {
        "state": [{"anything-but": ["stopped", "overloaded"]}]
    }
}

{
    "data": {
        "x-limit": [{"anything-but": [100, 200, 300]}]
    }
}

{
    "data": {
        "state": [{"anything-but": {"prefix": "init"}}]
    }
}

{
    "source": [{"anything-but": ["acs.ecs"]}]
}

{
    "source": [{"anything-but": {"prefix": "acs."}}]
}

Numeric match

To match events based on numeric values or ranges, use the numeric operator with one or more comparison operators.

Define a range by placing two operators in the same array.

Single condition:

{
    "data": {
        "d-count": [{"numeric": ["<", 10]}]
    }
}

Matches events where data.d-count is less than 10.

Range condition:

{
    "data": {
        "c-count": [{"numeric": [">", 0, "<=", 5]}]
    }
}

Matches events where data.c-count is greater than 0 and less than or equal to 5.

Exact numeric value:

{
    "data": {
        "x-limit": [{"numeric": ["=", 301.8]}]
    }
}

Matches events where data.x-limit equals 301.8. An event with "x-limit": 300 does not match.

Multiple numeric conditions across fields:

{
    "data": {
        "c-count": [{"numeric": [">", 0, "<=", 5]}],
        "d-count": [{"numeric": ["<", 10]}],
        "x-limit": [{"numeric": ["=", 301.8]}]
    }
}

All three conditions must be true (AND logic across keys).

IP address match

To match events based on an IPv4 address or CIDR block, use the cidr operator on a field in the data object.

Pattern:

{
    "data": {
        "source-ip": [{"cidr": "10.0.0.0/24"}]
    }
}

Matches events where data.source-ip falls within the 10.0.0.0/24 range. For example, "source-ip": "10.0.0.123" matches, but "source-ip": "192.168.0.123" does not.

Combined match

Combine multiple operators in a single pattern for precise filtering. Conditions across different fields use AND logic -- every condition must be true for the event to match.

The following pattern combines prefix, anything-but, CIDR, and numeric operators:

{
    "source": [{"prefix": "acs."}],
    "data": {
        "state": [{"anything-but": "initializing"}],
        "source-ip": [{"cidr": "10.0.0.0/24"}],
        "c-count": [{"numeric": [">", 0, "<=", 5]}],
        "d-count": [{"numeric": ["<", 10]}],
        "x-limit": [{"anything-but": [100, 200, 300]}]
    }
}

This event matches only when all conditions are true:

• source starts with "acs."

• data.state is not "initializing"

• data.source-ip is in the 10.0.0.0/24 range

• data.c-count is greater than 0 and at most 5

• data.d-count is less than 10

• data.x-limit is not 100, 200, or 300

Match example:

An event with source: "acs.oss", state: "pending", source-ip: "10.0.0.123", c-count: 5, d-count: 7, and x-limit: 301.8 satisfies all conditions.

Non-match example:

An event with state: "initializing" and source-ip: "192.168.0.123" fails the anything-but and CIDR conditions.

Array match

When a pattern field lists multiple values in an array, the event matches if its field value equals any value in that array. If the event field itself is an array, the event matches when the two arrays share at least one common element.

Single value in the event, multiple values in the pattern:

{
    "subject": [
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
    ]
}

Matches if the event's subject equals any of the three values.

Array value in the event:

If the event contains "subject": ["acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg", "acs.ecs:cn-hangzhou:123456789098****:215672"], it matches because the first element appears in both the pattern array and the event array.

Null and empty string match

To match events where a field is null or an empty string "", wrap the target value in an array.

Match an empty string:

{
    "data": {
        "eventVersion": [""]
    }
}

Matches events where data.eventVersion is "". Does not match if the value is "1.0".

Match a null value:

{
    "data": {
        "responseElements": [null]
    }
}

Matches events where data.responseElements is null. Does not match if the value is "lss" or any other non-null value.

Field existence match

To match events based on whether a field exists in the data object, use the exists operator.

Match when a field does not exist:

{
    "data": {
        "state": [{"exists": false}]
    }
}

Matches events where the data object does not contain a state field. If state is present with any value (including null), the event does not match.

Match when a field exists:

{
    "data": {
        "state": [{"exists": true}]
    }
}

Matches events where the data object contains a state field, regardless of its value.