This topic describes the syntax for message filtering.
Notes
Note the following principles for message filtering:
An event must contain all the field names listed in the event pattern. The fields in the event pattern must also have the same nested structure as the fields in the event.
Pattern matching is case-sensitive and matches character by character. The matching process does not normalize strings.
Values to be matched must follow JSON rules, such as strings enclosed in quotation marks, numbers, and the unquoted keywords true, false, and null.
Event patterns support OR semantics. Different Keys are matched with AND semantics, and values in an array for a Key are matched with OR semantics.
Match by value
You can match an event by specifying the value of a field. For example, the following event pattern matches only events where the source is Object Storage Service. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
"acs.oss"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"data":{
"meetingName":"marketing-meeting",
"action":"meeting_start",
"time":1590592494070,
"meetingUUID":"hz-20864c8f-b10d-45cd-9935-884bca1b****"
},
"id":"45ef4dewdwe1-7c35-447a-bd93-fab****",
"source":"acs.aliyuncvc",
"specversion":"1.0",
"subject":"acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672",
"time":"2020-07-21 20:22:01.961000",
"type":"aliyuncvc:MeetingEvent:MeetingStateEvent"
}
| None |
{
"id": "45ef4dewdwe1-7c35-447a-bd93-fab****",
"source": "acs.imm",
"specversion": "1.0",
"subject": "acs.imm:cn-hangzhou:123456789098****:215672",
"time": "2020-11-19T21:04:41+08:00",
"type": "imm:Task:VideoModeration",
"aliyunaccountid": "123456789098****",
"aliyunpublishtime": "2020-11-19T21:04:42Z",
"aliyuneventbusname": "default",
"aliyunregionid": "cn-hangzhou",
"aliyunpublishaddr": "172.25.XX.XX",
"data": {
"name":"test",
"scope":100
}
}
| No match |
Match by prefix
You can match an event by the prefix of a field's value. For example, the following event pattern matches only events where the source field starts with acs.. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
{
"prefix":"acs."
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id": "45ef4dewdwe1-7c35-447a-bd93-fab****",
"source": "acs.imm",
"specversion": "1.0",
"subject": "acs.imm:cn-hangzhou:123456789098****:215672",
"time": "2020-11-19T21:04:41+08:00",
"type": "imm:Task:VideoModeration",
"aliyunaccountid": "123456789098****",
"aliyunpublishtime": "2020-11-19T21:04:42Z",
"aliyuneventbusname": "default",
"aliyunregionid": "cn-hangzhou",
"aliyunpublishaddr": "172.25.XX.XX",
"data": {
"name":"test",
"scope":100
}
}
| {
"id": "45ef4dewdwe1-7c35-447a-bd93-fab****",
"source": "acs.imm",
"specversion": "1.0",
"subject": "acs.imm:cn-hangzhou:123456789098****:215672",
"time": "2020-11-19T21:04:41+08:00",
"type": "imm:Task:VideoModeration",
"aliyunaccountid": "123456789098****",
"aliyunpublishtime": "2020-11-19T21:04:42Z",
"aliyuneventbusname": "default",
"aliyunregionid": "cn-hangzhou",
"aliyunpublishaddr": "172.25.XX.XX",
"data": {
"name":"test",
"scope":100
}
}
|
Match by suffix
You can match an event by the suffix of a field's value. For example, the following event pattern matches events where the subject has the prefix acs:oss:cn-hangzhou:1234567:xls-papk/ and the suffix .jpg or .txt. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
{
"prefix":"acs:oss:cn-hangzhou:1234567:xls-papk/"
},
{
"suffix":".txt"
},
{
"suffix":".jpg"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
Anything-but matching
You can match any value except for those you specify. You can use anything-but with strings and numbers. For example, the following event pattern matches all events where the state is not initializing and x-limit is not 123. The following table describes how events from an event source are filtered by the event pattern.
The following pattern shows a single anything-but match, first for a string and then for a number.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
| {
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"x-limit":[
{
"anything-but":123
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| No match |
The following event pattern matches events where the state is not stopped or overloaded. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| {
"data":{
"state":[
{
"anything-but":[
"stopped",
"overloaded"
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"stopped"
}
}
| No match |
The following event pattern matches events where x-limit is not 100, 200, or 300. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"data":{
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":200
}
}
| No match |
The following event pattern matches events where the prefix of the state value is not init. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
| {
"data":{
"state":[
{
"anything-but":{
"prefix":"init"
}
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"initializing"
}
}
| No match |
The following event pattern matches events where the source is not Elastic Compute Service. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":[
"acs.ecs"
]
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"data":{
"meetingName":"marketing-meeting",
"action":"meeting_start",
"time":1590592494070,
"meetingUUID":"hz-20864c8f-b10d-45cd-9935-884bca1b****"
},
"id":"45ef4dewdwe1-7c35-447a-bd93-fab****",
"source":"acs.aliyuncvc",
"specversion":"1.0",
"subject":"acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672",
"time":"2020-07-21 20:22:01.961000",
"type":"aliyuncvc:MeetingEvent:MeetingStateEvent"
}
| No match |
The following event pattern matches only events whose source is not an Alibaba Cloud service, such as events sent from your custom applications. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":{
"prefix":"acs."
}
}
]
}
| None |
Numeric matching
You can match a field based on a numeric value or range. For example, the following event pattern matches events where c-count is greater than 0 and less than or equal to 5, d-count is less than 10, and x-limit is 301.8. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
| {
"data":{
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"numeric":[
"=",
301.8
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":300
}
}
| No match |
Important Numeric matching works only for JSON numbers. The value must be between -1.0e9 and +1.0e9. The value is accurate to 15 digits, with up to 6 decimal places.
IP address matching
You can match an IP address in the data field. For example, the following event pattern matches events where the source-ip is in the 10.0.0.0/24 CIDR block. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
| {
"data":{
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"192.168.0.123"
}
}
| None |
Note Only IPv4 addresses are supported.
Multi-pattern matching
You can combine multiple rules to create complex event patterns. For example, the following pattern combines prefix matching, anything-but matching, IP address matching, and numeric matching to precisely filter events. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
| {
"source":[
{
"prefix":"acs."
}
],
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
],
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"initializing",
"source-ip":"192.168.0.123"
}
}
| None |
Matching arrays
The value for a field in an event pattern can be an array of values. The pattern matches if any value in the array matches the value in the event. If the value in the event is also an array, the pattern matches if the intersection of the two arrays is not empty. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
Matching empty values
You can create an event pattern to match events that contain a null value or an empty string. For example, the following pattern matches events where the eventVersion value is an empty string. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"eventVersion":[
""
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "1.0",
"responseElements": null
}
}
| No match |
The following event pattern matches events where the responseElements value is null. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"responseElements":[
null
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": "lss"
}
}
| No match |
Note A null value is not the same as an empty string. A pattern that matches an empty string does not match a null value.
Existence matching
You can match an event based on the existence or absence of a field in the data object. For example, the following pattern matches events that do not contain a state field. The following table describes how events from an event source are filtered by the event pattern.
Event received from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
| {
"data":{
"state":[
{
"exists": false
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| No match |