ApsaraMQ for RocketMQ:Event patterns

How event pattern matching works

Event patterns follow these matching rules:

• Structural matching: The event must contain every field specified in the pattern, with the same nested structure. Fields in the event that are not in the pattern are ignored.

• Case sensitivity: All string comparisons are case-sensitive. EventBridge does not modify strings during matching.

• JSON values: Matched values must be valid JSON -- strings in double quotes (""), numbers, or unquoted keywords (true, false, null).

• Logical operators: Keys in a pattern are combined with AND logic. Values in an array for the same key are combined with OR logic.

Operator quick reference

All available pattern operators are listed below, with detailed examples in the sections that follow.

Event structure reference

All examples in this topic use events based on the CloudEvents specification. The full event structure is shown below for reference -- subsequent examples include only the fields relevant to each operator.

{
    "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source": "acs.oss",
    "specversion": "1.0",
    "type": "oss:ObjectCreated:PostObject",
    "datacontenttype": "application/json",
    "dataschema": "http://example.com/test.json",
    "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time": "2020-08-17T16:04:46.149Asia/Shanghai",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Exact value matching

Match events where a field equals a specific value. Specify the target value in an array.

Pattern -- match events from acs.oss:

{
    "source": ["acs.oss"]
}

Match result: An event with "source": "acs.oss" matches. An event with "source": "acs.aliyuncvc" or "source": "acs.imm" does not.

Prefix matching

Match events where a field value starts with a specified string. Use the prefix operator.

Pattern -- match events where source starts with acs.:

{
    "source": [
        {
            "prefix": "acs."
        }
    ]
}

Match result: Both "source": "acs.oss" and "source": "acs.imm" match, because both start with acs..

Substring matching (contains)

Match events where a field value includes a specified substring.

{
    "type": [
        {
            "contains": "Normal"
        }
    ]
}

{
    "type": [
        {
            "contains": "Normal"
        },
        {
            "contains": "Error"
        }
    ]
}

Suffix matching

Match events where a field value ends with a specified string. Use the suffix operator. Combine prefix and suffix in the same array to narrow the match.

Pattern -- match events where subject starts with acs:oss:cn-hangzhou:1234567:xls-papk/ and ends with .txt or .jpg:

{
    "subject": [
        {
            "prefix": "acs:oss:cn-hangzhou:1234567:xls-papk/"
        },
        {
            "suffix": ".txt"
        },
        {
            "suffix": ".jpg"
        }
    ]
}

Match result: A subject of "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg" matches. A subject ending in .png does not.

Exclusion matching (anything-but)

Match events where a field value does not equal a specified value. The anything-but operator supports strings, numbers, lists, and prefix exclusion.

{
    "data": {
        "state": [
            {
                "anything-but": "initializing"
            }
        ]
    }
}

{
    "data": {
        "x-limit": [
            {
                "anything-but": 123
            }
        ]
    }
}

{
    "data": {
        "state": [
            {
                "anything-but": "initializing"
            }
        ],
        "x-limit": [
            {
                "anything-but": 123
            }
        ]
    }
}

{
    "data": {
        "state": [
            {
                "anything-but": [
                    "stopped",
                    "overloaded"
                ]
            }
        ]
    }
}

{
    "data": {
        "x-limit": [
            {
                "anything-but": [
                    100,
                    200,
                    300
                ]
            }
        ]
    }
}

{
    "data": {
        "state": [
            {
                "anything-but": {
                    "prefix": "init"
                }
            }
        ]
    }
}

{
    "source": [
        {
            "anything-but": [
                "acs.aliyuncvc"
            ]
        }
    ]
}

{
    "source": [
        {
            "anything-but": {
                "prefix": "acs."
            }
        }
    ]
}

Numeric matching

Match events based on numeric values or ranges. Use the numeric operator with comparison operators: =, >, >=, <, <=. Specify a range by combining two comparisons in the same array.

Pattern -- match events where:

• data.c-count is greater than 0 and less than or equal to 5

• data.d-count is less than 10

• data.x-limit equals 301.8

{
    "data": {
        "c-count": [
            {
                "numeric": [">", 0, "<=", 5]
            }
        ],
        "d-count": [
            {
                "numeric": ["<", 10]
            }
        ],
        "x-limit": [
            {
                "numeric": ["=", 301.8]
            }
        ]
    }
}

Match result: An event with "c-count": 5, "d-count": 7, "x-limit": 301.8 matches. Changing x-limit to 300 breaks the match.

IP address matching (cidr)

Match events based on an IPv4 address in CIDR notation. Use the cidr operator on a field inside data.

Pattern -- match events where data.source-ip is in the 10.0.0.0/24 subnet:

{
    "data": {
        "source-ip": [
            {
                "cidr": "10.0.0.0/24"
            }
        ]
    }
}

Match result: "source-ip": "10.0.0.123" matches. "source-ip": "192.168.0.123" does not.

Combined conditions

Combine multiple operators in a single pattern for precise filtering. All conditions are joined with AND logic -- every condition must be satisfied.

Pattern -- match events where:

• source starts with acs.

• data.state is not initializing

• data.source-ip is in the 10.0.0.0/24 subnet

• data.c-count is greater than 0 and at most 5

• data.d-count is less than 10

• data.x-limit is not 100, 200, or 300

{
    "source": [
        {
            "prefix": "acs."
        }
    ],
    "data": {
        "state": [
            {
                "anything-but": "initializing"
            }
        ],
        "source-ip": [
            {
                "cidr": "10.0.0.0/24"
            }
        ],
        "c-count": [
            {
                "numeric": [">", 0, "<=", 5]
            }
        ],
        "d-count": [
            {
                "numeric": ["<", 10]
            }
        ],
        "x-limit": [
            {
                "anything-but": [100, 200, 300]
            }
        ]
    }
}

Match result: An event with source: "acs.oss", state: "pending", source-ip: "10.0.0.123", c-count: 5, d-count: 7, and x-limit: 301.8 matches. Changing state to "initializing" or source-ip to "192.168.0.123" breaks the match.

Array matching

Pattern values are always arrays. If a field value in the event is also an array, the event matches when the two arrays share at least one common element (non-empty intersection).

Pattern -- match events with specific subject values:

{
    "subject": [
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
    ]
}

Match result: An event with "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg" matches (exact value in the array).

An event with an array-valued subject also matches if the arrays overlap:

{
    "subject": [
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
    ]
}

This matches because acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg appears in both arrays.

Null and empty string matching

Match events where a field is null or an empty string ("").

{
    "data": {
        "eventVersion": [""]
    }
}

{
    "data": {
        "responseElements": [null]
    }
}

Field existence matching (exists)

Match events based on whether a field is present in the data object. Set exists to false to match events where the field is absent.

Pattern -- match events where data.state does not exist:

{
    "data": {
        "state": [
            {
                "exists": false
            }
        ]
    }
}

Match result: An event with data containing only name and scope matches. An event where data also contains "state": "terminated" does not.