Usage notes
Take note of the following items when you use event patterns:
A matched event must contain all fields listed in the event pattern, and the fields in the event must have the same nested structure as the fields in the event pattern.
Exact match is used for each character of the event pattern. All characters are case-sensitive. EventBridge does not modify the strings during the matching process.
All values in a matched event must be in the JSON format. These values include numeric values, strings that are enclosed in double quotation marks (""), and keywords that are not enclosed in double quotation marks (""), such as true, false, and null.
Event patterns support the OR logical operator. You can use the AND logical operator to specify keys in event patterns, and the OR logical operator to specify key values in arrays.
Event matching based on a field value
You can specify the value of a specific field as a matching condition. In the following example, only events in which the value of the source field indicates Object Storage Service (OSS) are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
"acs.oss"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
Event matching based on the prefix of a field value
You can specify the prefix of a field value as a matching condition. In the following example, only events in which the value of the source field is prefixed with acs. are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
{
"prefix":"acs."
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
Event matching based on the inclusion of a field value
You can specify a field value that you want to include in event matching. The following section describes two examples. In Example 1, only events in which the value of the type field includes Normal are matched and filtered. In Example 2, only events in which the value of the type field includes Normal or Error are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Example 1: Match events in which the value of the "type" field includes "Normal"
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| None |
Example 2: Match events in which the value of the "type" field includes "Normal" or "Error"
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
},
{
"contains": "Error"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserOtherEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| None |
Event matching based on the suffix of a field value
You can specify the suffix of a field value as a matching condition. In the following example, only events in which the value of the subject field is prefixed with acs:oss:cn-hangzhou:1234567:xls-papk/ and suffixed with .jpg or .txt are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
{
"prefix":"acs:oss:cn-hangzhou:1234567:xls-papk/"
},
{
"suffix":".txt"
},
{
"suffix":".jpg"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
Event matching based on the exclusion of a field value
You can specify a field value that you want to exclude from event matching. You can use the anything-but field to exclude strings and numeric values. In the following example, only events in which the value of the state field is not initializing and the value of the x-limit field is not 123 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
The following pattern uses the anything-but field to exclude one string and one numeric value.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
| {
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"x-limit":[
{
"anything-but":123
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| None |
In the following example, only events in which the value of the state field is not stopped or overloaded are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| {
"data":{
"state":[
{
"anything-but":[
"stopped",
"overloaded"
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"stopped"
}
}
| None |
In the following example, only events in which the value of the x-limit field is not 100, 200, or 300 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"data":{
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":200
}
}
| None |
In the following example, only events in which the value of the state field is not prefixed with init are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
| {
"data":{
"state":[
{
"anything-but":{
"prefix":"init"
}
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"initializing"
}
}
| None |
In the following example, only events in which the value of the source field does not indicate Elastic Compute Service (ECS) are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":[
"acs.ecs"
]
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"data":{
"meetingName":"marketing-meeting",
"action":"meeting_start",
"time":1590592494070,
"meetingUUID":"hz-20864c8f-b10d-45cd-9935-884bca1b****"
},
"id":"45ef4dewdwe1-7c35-447a-bd93-fab****",
"source":"acs.aliyuncvc",
"specversion":"1.0",
"subject":"acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672",
"time":"2020-07-21 20:22:01.961000",
"type":"aliyuncvc:MeetingEvent:MeetingStateEvent"
}
| None |
In the following example, only events in which the value of the source field does not indicate an Alibaba Cloud service are matched and filtered. In this case, the events sent from your custom applications are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":{
"prefix":"acs."
}
}
]
}
| None |
Event matching based on a numeric value or range
You can specify a numeric value or range of a field as a matching condition. In the following example, only events in which the value of the c-count field is greater than 0 and less than or equal to 5, the value of the d-count field is less than 10, and the value of the x-limit field is 301.8 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
| {
"data":{
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"numeric":[
"=",
301.8
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":300
}
}
| None |
Important Numeric value matching takes effect only when the numeric values are in the JSON format and between -1.0e9 and +1.0e9. These numeric values are accurate to 15 digits and 6 decimal places.
Event matching based on an IP address
You can specify an IP address by using a field in the data parameter as a matching condition. In the following example, only events in which the value of the source-ip field is 10.0.0.0/24 are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
| {
"data":{
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"192.168.0.123"
}
}
| None |
Note Only IPv4 addresses are supported for this type of event matching.
Event matching based on a combined condition
You can combine multiple filter rules as a matching condition. This allows you to precisely match and filter events. In the following example, prefix matching, exclusion matching, IP address matching, and numeric value matching are combined. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
| {
"source":[
{
"prefix":"acs."
}
],
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
],
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"initializing",
"source-ip":"192.168.0.123"
}
}
| None |
Event matching based on an array
The value of each field in the event pattern is an array that contains one or more values. If a value in the array matches a value in an event, the event is matched and filtered. If a value in an event is also an array, and the intersection of the array in the event and the array in the event pattern is not an empty set, the event is matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
Event matching based on the null value or empty string
You can specify the null value or empty string of a field value as a matching condition. In the following example, only events in which the value of the eventVersion field is an empty string are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"eventVersion":[
""
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "1.0",
"responseElements": null
}
}
| None |
In the following example, only events in which the value of the responseElements field is null are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"responseElements":[
null
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": "lss"
}
}
| None |
Note A null value is different from an empty string. If you use an event pattern to match the empty string, the null value cannot be matched.
Event matching based on the existence or nonexistence of a field
You can specify the existence or nonexistence of a field in the data parameter as a matching condition. In the following example, only events in which the state field does not exist are matched and filtered. The following table describes the process during which an event is sent from the event source and filtered by the event pattern.
Event from the event source | Event pattern | Event after filtering |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
| {
"data":{
"state":[
{
"exists": false
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| None |