An event pattern is a module that is provided by EventBridge to filter events. EventBridge filters events by using event patterns and routes events to event targets. Event patterns must have the same structure as the matched events. This topic describes common event patterns.

Usage notes

Take note of the following items when you use event patterns:

  • A matched event must contain all the fields listed in the event pattern, and the fields in the event must have the same nested structure as those in the event pattern.
  • Exact match is used for each character of the event pattern. All characters are case-sensitive. EventBridge does not modify the strings during the matching process.
  • All values in a matched event must be in the JSON format. These values include numeric values, strings that are enclosed in double quotation marks (""), and keywords that are not enclosed in double quotation marks (""), such as true, false, and null.
  • Event patterns support the logical OR operator. You can use the logical AND operator to specify keys in event patterns and the logical array OR operator to specify key values.

Event matching based on a field value

You can specify the value of a field as a matching condition. In the following example, only the events in which the value of the source field indicates Object Storage Service (OSS) are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "source":[
        "acs.oss"
    ]
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

Event matching based on the prefix of a field value

You can specify the prefix of a field value as a matching condition. In the following example, only the events in which the value of the source field is prefixed by acs are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "source":[
        {
            "prefix":"acs."
        }
    ]
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

Event matching based on the suffix of a field value

You can specify the suffix of a field value as a matching condition. In the following example, only the events in which the value of the subject field is prefixed by acs:oss:cn-hangzhou:1234567:xls-papk/ and suffixed by .jpg or .txt are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "subject":[
        {
            "prefix":"acs:oss:cn-hangzhou:1234567:xls-papk/"
        },
        {
            "suffix":".txt"
        },
        {
            "suffix":".jpg"
        }
    ]
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

Event matching based on the exclusion of a field value

You can specify a field value that you want to exclude from event matching. You can use the anything-but field to exclude strings and numeric values. In the following example, only the events in which the value of the state field is not initializing and the value of the x-limit field is not 123 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

The following pattern uses the anything-but field to exclude one string and one numeric value.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"running",
        "x-limit":456
    }
}
 
{
    "data":{
        "state":[
            {
                "anything-but":"initializing"
            }
        ],
        "x-limit":[
            {
                "anything-but":123
            }
        ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"running",
        "x-limit":456
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
 N/A

In the following example, only the events in which the value of the state field is not stopped or overloaded are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"terminated"
    }
}
 
{
    "data":{
        "state":[
            {
                "anything-but":[
                    "stopped",
                    "overloaded"
                ]
            }
        ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"terminated"
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"stopped"
    }
}
 N/A

In the following example, only the events in which the value of the x-limit field is not 100, 200, or 300 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
 
{
    "data":{
        "x-limit":[
            {
                "anything-but":[
                    100,
                    200,
                    300
                ]
            }
        ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":200
    }
}
 N/A

In the following example, only the events in which the value of the state field is not prefixed by init are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"pending"
    }
}
 
{
    "data":{
        "state":[
            {
                "anything-but":{
                    "prefix":"init"
                }
            }
        ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"pending"
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"initializing"
    }
}
 N/A

In the following example, only the events in which the value of the source field does not indicate Cloud Video Conferencing are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
 
{
    "source":[
        {
            "anything-but":[
                "acs.aliyuncvc"
            ]
        }
    ]
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
 
{
    "data":{
        "meetingName":"marketing-meeting",
        "action":"meeting_start",
        "time":1590592494070,
        "meetingUUID":"hz-20864c8f-b10d-45cd-9935-884bca1b****"
    },
    "id":"45ef4dewdwe1-7c35-447a-bd93-fab****",
    "source":"acs.aliyuncvc",
    "specversion":"1.0",
    "subject":"acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672",
    "time":"2020-07-21 20:22:01.961000",
    "type":"aliyuncvc:MeetingEvent:MeetingStateEvent"
}
 N/A

In the following example, only the events in which the value of the source field does not indicate an Alibaba Cloud service are matched and filtered. In this case, the events sent from your custom applications are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
 
{
    "source":[
        {
            "anything-but":{
                "prefix":"acs."
            }
        }
    ]
}
 N/A

Event matching based on a numeric value or range

You can specify a numeric value or range of a field as a matching condition. In the following example, only the events in which the value of the c-count field is greater than 0 and less than or equal to 5, the value of the d-count field is less than 10, and the value of the x-limit field is 301.8 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8
    }
}
 
{
    "data":{
        "c-count":[
            {
                "numeric":[
                    ">",
                    0,
                    "<=",
                    5
                ]
            }
        ],
        "d-count":[
            {
                "numeric":[
                    "<",
                    10
                ]
            }
        ],
        "x-limit":[
            {
                "numeric":[
                    "=",
                    301.8
                ]
            }
        ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":300
    }
}
 N/A
Notice Numeric value matching takes effect only when the numeric values are in the JSON format and between -1.0e9 and +1.0e9. These numeric values are accurate to 15 digits and 6 decimal places.

IP address matching

You can specify an IP address by using a field in the data parameter as a matching condition. In the following example, only the events in which the value of the source-ip field is 10.0.0.0/24 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "source-ip":"10.0.0.123"
    }
}
 
{
    "data":{
        "source-ip":[
            {
                "cidr":"10.0.0.0/24"
            }
        ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "source-ip":"10.0.0.123"
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "source-ip":"192.168.0.123"
    }
}
 N/A
Note Only IPv4 addresses are supported.

Event matching based on a combined condition

You can combine multiple filter rules as a matching condition. This allows you to precisely match and filter events. In the following example, prefix matching, exclusion matching, IP address matching, and numeric value matching are combined. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8,
        "state":"pending",
        "source-ip":"10.0.0.123"
    }
}
 
{
    "source":[
        {
            "prefix":"acs."
        }
    ],
    "data":{
        "state":[
            {
                "anything-but":"initializing"
            }
        ],
        "source-ip":[
            {
                "cidr":"10.0.0.0/24"
            }
        ],
        "c-count":[
            {
                "numeric":[
                    ">",
                    0,
                    "<=",
                    5
                ]
            }
        ],
        "d-count":[
            {
                "numeric":[
                    "<",
                    10
                ]
            }
        ],
        "x-limit":[
            {
                "anything-but":[
                    100,
                    200,
                    300
                ]
            }
        ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8,
        "state":"pending",
        "source-ip":"10.0.0.123"
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8,
        "state":"initializing",
        "source-ip":"192.168.0.123"
    }
}
 N/A

Event matching based on an array

The value of each field in the event pattern is an array that contains one or more values. If a value in the array matches a value in an event, the event is matched and filtered. If a value in an event is also an array, and the intersection of the array in the event and the array in the event pattern is not an empty set, the event is matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "subject":[
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
    ]
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":[
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
    ],
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":[
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
    ],
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

Event matching based on the null value or empty string

You can specify the null value or empty string of a field value as a matching condition. In the following example, only the events in which the value of the eventVersion field is an empty string are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
 
{
    "data":{
        "eventVersion":[
            ""
        ]
    }
}
 
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
 
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "1.0",
    "responseElements": null
   }
}
 N/A

In the following example, only the events in which the value of the responseElements field is null are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
 
{
    "data":{
        "responseElements":[
            null
        ]
    }
}
 
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
 
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": "lss"
   }
}
 N/A
Note A null value is different from an empty string. If you use an event pattern to match the empty string, the null value cannot be matched.

Existence matching

You can specify the existence or nonexistence of a field in the data parameter as a matching condition. In the following example, only the events in which the state field does not exist are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.

Event from the event source Event pattern Event after filtering 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
    }
}
 
{
    "data":{
        "state":[
            {
               "exists": false
            }
         ]
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
    }
}
 
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"terminated"
    }
}
 N/A