Rule expressions use comparison operators to match request values and logical operators to combine conditions.
Comparison operators
Comparison operators compare an incoming request value against a value specified in an expression.
contains
Checks if the request value contains the specified string.
Operator name:
ContainsValue type:
StringExample:
(http.host contains "example.com")
ends_with
Checks if the request value ends with the specified string.
Operator name:
Ends withValue type:
StringExample:
(ends_with(http.host, "cn"))
eq
Checks if the request value equals the specified value.
Operator name:
Equal toValue type:
StringExample:
(http.host eq "www.example.com")
exists
Checks if a specified field or attribute exists in the request.
Operator name:
ExistsValue type:
StringExample:
(exists(http.request.headers["user-agent"]))
ge
Checks if the request value is greater than or equal to the specified numeric value.
Operator name:
Greater than or equal toValue type:
intExample:
(ip.geoip.asnum ge 45104)
gt
Checks if the request value is greater than the specified numeric value.
Operator name:
Greater thanValue type:
intExample:
(ip.geoip.asnum gt 45104)
in
Checks if the request value matches any value in a specified set. Use the $ symbol to reference a list.
Operator name:
Is inValue type:
ArrayExample:
(http.host in {"www.example.com" "blog.example.com"})( ip.src in $<LIST_NAME>)
le
Checks if the request value is less than or equal to the specified numeric value.
Operator name:
Less than or equal toValue type:
intExample:
(ip.geoip.asnum le 45104)
len eq
Checks if the length of the request value equals the specified numeric value.
Operator name:
Length equalsValue type:
StringExample:
(len(http.request.cookies["session"]) eq 330688)
len gt
Checks if the length of the request value is greater than the specified numeric value.
Operator name:
Length is greater thanValue type:
StringExample:
(len(http.request.cookies["session"]) gt 330688)
len lt
Checks if the length of the request value is less than the specified numeric value.
Operator name:
Length is less thanValue type:
StringExample:
(len(http.request.cookies["session"]) lt 330688)
lt
Checks if the request value is less than the specified numeric value.
Operator name:
Less thanValue type:
intExample:
(ip.geoip.asnum lt 45104)
matches
Checks if the request value matches a specified regular expression (PCRE-compatible).
Only the Premium and Enterprise plans support regular expressions.
Operator name:
Matches regexValue type:
StringExample:
(http.host matches "(www|blog)\.example\.com")
ne
Checks if the request value does not equal the specified value.
Operator name:
Not equal toValue type:
StringExample:
(http.host ne "www.example.com")
not ends_with
Checks if the request value does not end with the specified string.
Operator name:
Does not end withValue type:
StringExample:
(not ends_with(http.host, "cn"))
not exists
Checks if a specified field or attribute does not exist in the request.
Operator name:
Does not existValue type:
StringExample:
(not exists(http.request.headers["user-agent"]))
not starts_with
Checks if the request value does not start with the specified string.
Operator name:
Does not start withValue type:
StringExample:
(not starts_with(http.host, "blog"))
not...contains
Checks if the request value does not contain the specified string.
Operator name:
Does not containValue type:
StringExample:
(not http.host contains "example.com")
not...in
Checks if the request value does not match any value in a specified set. Use the $ symbol to reference a list.
Operator name:
Is not inValue type:
ArrayExample:
(not http.host in {"www.example.com" "blog.example.com"})(not ip.src in $<LIST_NAME>)
not...matches
Checks if the request value does not match a specified regular expression (PCRE-compatible).
Only the Premium and Enterprise plans support regular expressions.
Operator name:
Does not match regexValue type:
StringExample:
(not http.host matches "(www|blog)\.example\.com")
percent
Filters requests based on a specified field and percentage value.
Operator name:
PercentageValue type:
IntValue range: 1 to 100
If the field value is empty (for example, the request does not include the specified header), the rule does not take effect, and the match result is false.
Supported fields:
Header:
http.request.headers["example"]Client IP:
ip.srcURI query string:
http.request.uri.args["example"]Request timestamp:
http.request.timestamp.sec
Examples:
percent(http.request.headers["example"],80)percent(ip.src,80)percent(http.request.cookies["example"],80)percent(http.request.args["example"],80)percent(http.request.timestamp.sec,80)
starts_with
Checks if the request value starts with the specified string.
Operator name:
Starts withValue type:
StringExample:
(starts_with(http.host, "blog"))
Other operators
lower
Converts the request value to lowercase for case-insensitive matching.
Operator name:
Case-insensitiveValue type:
StringExample:
(lower(http.request.uri))
Logical operators
Logical operators combine multiple expressions into a composite expression.
and
Returns true only when all combined expressions are true.
Operator name:
Logical ANDExample:
((http.host eq "www.example.com") and (ip.geoip.country eq "CN"))
not
Negates an expression result, inverting true to false and vice versa.
Operator name:
Logical NOTExample:
not (http.host eq "www.example.com")
or
Returns true if any combined expression is true.
Operator name:
Logical ORExample:
((http.host eq "www.example.com") or (ip.geoip.country eq "CN"))
Grouping symbols
Use parentheses ( and ) to group expression parts and control evaluation order.
Grouping symbols are supported in the expression editor and the ESA API, but not in the expression builder.
Nested expression example:
(http.host eq "www.example.com" and ((http.referer in {"download.example.com"}) or (http.referer in {"image.example.com"})))