ApsaraMQ for RocketMQ:Event patterns

How it works

EventBridge compares each incoming event against your event pattern using the following rules:

• The event must contain every field specified in the pattern, with the same nested structure.

• Matching is character-by-character and case-sensitive. EventBridge does not modify strings during comparison.

• All values must be valid JSON: numbers, double-quoted strings, or unquoted keywords (true, false, null).

• AND logic applies across fields: the event must satisfy all field conditions in the pattern.

• OR logic applies within a field's value array: the event matches if it satisfies any value in the array.

Operator reference

Event structure

All examples use events based on the CloudEvents v1.0 specification. A typical event looks like this:

{
    "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source": "acs.oss",
    "specversion": "1.0",
    "type": "oss:ObjectCreated:PostObject",
    "datacontenttype": "application/json",
    "dataschema": "http://example.com/test.json",
    "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time": "2020-08-17T16:04:46.149Asia/Shanghai",
    "data": {
        "name": "test",
        "scope": 100
    }
}

Each section below shows the pattern syntax and describes which events match.

Exact value

Match events where a field equals a specific value. Wrap the value in an array.

Pattern -- match events where source is acs.oss:

{
    "source": ["acs.oss"]
}

Result: An event with "source": "acs.oss" matches. Events with "source": "acs.aliyuncvc" or "source": "acs.imm" do not match.

Specify multiple values in the array to match any of them (OR logic):

{
    "subject": [
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
    ]
}

If the field value in the event is also an array, the event matches when the two arrays share at least one common element.

Prefix

Match events where a field value starts with a given string.

Pattern -- match events where source starts with acs.:

{
    "source": [{"prefix": "acs."}]
}

Result: Events with "source": "acs.oss" and "source": "acs.imm" both match.

Suffix

Match events where a field value ends with a given string. Prefix and suffix operators can be combined within the same field.

Pattern -- match events where subject starts with acs:oss:cn-hangzhou:1234567:xls-papk/ and ends with .jpg or .txt:

{
    "subject": [
        {"prefix": "acs:oss:cn-hangzhou:1234567:xls-papk/"},
        {"suffix": ".txt"},
        {"suffix": ".jpg"}
    ]
}

Result: An event with "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg" matches (satisfies both the prefix and the .jpg suffix). An event with "subject": "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png" also matches because OR logic applies across the array -- it satisfies the prefix condition even though it does not match .txt or .jpg.

Contains

Match events where a field value contains a given substring.

{
    "type": [{"contains": "Normal"}]
}

{
    "type": [
        {"contains": "Normal"},
        {"contains": "Error"}
    ]
}

Anything-but (exclusion)

Match events where a field value does not equal one or more specified values. The anything-but operator supports strings, numbers, lists, and prefix-based exclusion.

{
    "data": {
        "state": [{"anything-but": "initializing"}]
    }
}

{
    "data": {
        "x-limit": [{"anything-but": 123}]
    }
}

{
    "data": {
        "state": [{"anything-but": "initializing"}],
        "x-limit": [{"anything-but": 123}]
    }
}

{
    "data": {
        "state": [{"anything-but": ["stopped", "overloaded"]}]
    }
}

{
    "data": {
        "x-limit": [{"anything-but": [100, 200, 300]}]
    }
}

{
    "data": {
        "state": [{"anything-but": {"prefix": "init"}}]
    }
}

{
    "source": [{"anything-but": ["acs.aliyuncvc"]}]
}

{
    "source": [{"anything-but": {"prefix": "acs."}}]
}

Numeric value and range

Match events where a numeric field equals a value or falls within a range. Supported comparison operators: >, <, <=, =.

Pattern -- match events where c-count is between 0 (exclusive) and 5 (inclusive), d-count is less than 10, and x-limit equals 301.8:

{
    "data": {
        "c-count": [{"numeric": [">", 0, "<=", 5]}],
        "d-count": [{"numeric": ["<", 10]}],
        "x-limit": [{"numeric": ["=", 301.8]}]
    }
}

Result: An event with "c-count": 5, "d-count": 7, and "x-limit": 301.8 matches. An event with "x-limit": 300 does not match.

IP address (CIDR)

Match events where a field in the data object contains an IP address within a specified CIDR range.

Pattern -- match events where data.source-ip is in the 10.0.0.0/24 subnet:

{
    "data": {
        "source-ip": [{"cidr": "10.0.0.0/24"}]
    }
}

Result: An event with "source-ip": "10.0.0.123" matches. An event with "source-ip": "192.168.0.123" does not match.

Null and empty string

{
    "data": {
        "eventVersion": [""]
    }
}

{
    "data": {
        "responseElements": [null]
    }
}

Field existence

Match events based on whether a field exists in the data object.

Pattern -- match events where the data.state field does not exist:

{
    "data": {
        "state": [{"exists": false}]
    }
}

To match events where a field does exist, set exists to true:

{
    "data": {
        "state": [{"exists": true}]
    }
}

Combined conditions

Combine multiple operators across different fields for precise filtering. All conditions must be satisfied (AND logic).

Pattern -- match events that satisfy all of the following conditions:

• source starts with acs.

• data.state is not initializing

• data.source-ip is in 10.0.0.0/24

• data.c-count is between 0 (exclusive) and 5 (inclusive)

• data.d-count is less than 10

• data.x-limit is not 100, 200, or 300

{
    "source": [{"prefix": "acs."}],
    "data": {
        "state": [{"anything-but": "initializing"}],
        "source-ip": [{"cidr": "10.0.0.0/24"}],
        "c-count": [{"numeric": [">", 0, "<=", 5]}],
        "d-count": [{"numeric": ["<", 10]}],
        "x-limit": [{"anything-but": [100, 200, 300]}]
    }
}

Result: An event with "source": "acs.oss", "state": "pending", "source-ip": "10.0.0.123", "c-count": 5, "d-count": 7, and "x-limit": 301.8 matches. Changing any single value to violate its condition (for example, "state": "initializing" or "source-ip": "192.168.0.123") causes the event to fail.

Limitations