全部產品
Search
文件中心

EventBridge:事件模式

更新時間:Dec 05, 2024

事件模式是事件匯流排EventBridge用來過濾相關事件的模式定義。事件匯流排EventBridge通過事件模式過濾事件並將事件路由到事件目標,事件模式必須和匹配的事件具有相同的結構。本文介紹事件模式的常用類型。

注意事項

事件模式比對的原則如下:

  • 事件必須包含事件模式中列出的所有欄位名,且事件模式裡的欄位名必須和事件中的欄位名具有相同的嵌套結構。

  • 事件模式是逐個字元精確匹配的 ,需注意大小寫,匹配過程中不會對字串進行任何標準化的操作。

  • 要匹配的值遵循JSON規則:用引號引起來的字串、數字以及不帶引號的關鍵字truefalsenull

  • 事件模式支援OR的語義,事件模式比對中各個Key支援AND語義,Key的Value值支援數組OR的語義。

指定值匹配

您可以指定某個欄位的值進行匹配。例如,以下樣本事件模式只匹配source是阿里雲Object Storage Service的事件。下表介紹事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "source":[
        "acs.oss"
    ]
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

首碼匹配

您可以指定某個欄位的值的首碼進行匹配。例如,以下樣本事件模式只匹配source欄位以acs.開頭的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "source":[
        {
            "prefix":"acs."
        }
    ]
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

包含匹配

您可以指定某個欄位包含特定欄位值進行匹配。例如,在以下樣本一,事件模式只匹配type中包含Normal的事件。在以下樣本二,事件模式比對type中包含Normal或者Error的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

樣本一:匹配"type"欄位包含"Normal"的事件

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserNormalEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
  "type":[
    {
      "contains": "Normal"
    }
  ]
}

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserNormalEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserErrorEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

樣本二:匹配"type"欄位包含"Normal"或者"Error"的事件

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserNormalEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
  "type":[
    {
      "contains": "Normal"
    },
    {
      "contains": "Error"
    }
  ]
}

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserNormalEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserErrorEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserErrorEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"UserOtherEvent",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

尾碼匹配

您可以指定某個欄位的值的尾碼進行匹配。例如,以下樣本事件模式只匹配subject中首碼為acs:oss:cn-hangzhou:1234567:xls-papk/、尾碼為.jpg或尾碼為.txt的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "subject":[
        {
            "prefix":"acs:oss:cn-hangzhou:1234567:xls-papk/"
        },
        {
            "suffix":".txt"
        },
        {
            "suffix":".jpg"
        }
    ]
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

除外匹配

您可以指定某個欄位除了提供的值之外的任何值進行匹配。您可以將anything-but與字串和數值一起使用。例如,以下樣本事件模式只匹配state不是initializingx-limit不是123的所有事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

以下模式顯示單個anything-but匹配,首先是字串,然後是數值。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"running",
        "x-limit":456
    }
}
{
    "data":{
        "state":[
            {
                "anything-but":"initializing"
            }
        ],
        "x-limit":[
            {
                "anything-but":123
            }
        ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"running",
        "x-limit":456
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}

以下樣本事件模式只匹配state不是stoppedoverloaded的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"terminated"
    }
}
{
    "data":{
        "state":[
            {
                "anything-but":[
                    "stopped",
                    "overloaded"
                ]
            }
        ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"terminated"
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"stopped"
    }
}

以下樣本事件模式只匹配x-limit不是100200300的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
{
    "data":{
        "x-limit":[
            {
                "anything-but":[
                    100,
                    200,
                    300
                ]
            }
        ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":200
    }
}

以下樣本事件模式只匹配state首碼不是init的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"pending"
    }
}
{
    "data":{
        "state":[
            {
                "anything-but":{
                    "prefix":"init"
                }
            }
        ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"pending"
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"initializing"
    }
}

以下樣本事件模式只匹配source不是Elastic Compute Service的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
{
    "source":[
        {
            "anything-but":[
                "acs.ecs"
            ]
        }
    ]
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
{
    "data":{
        "meetingName":"marketing-meeting",
        "action":"meeting_start",
        "time":1590592494070,
        "meetingUUID":"hz-20864c8f-b10d-45cd-9935-884bca1b****"
    },
    "id":"45ef4dewdwe1-7c35-447a-bd93-fab****",
    "source":"acs.aliyuncvc",
    "specversion":"1.0",
    "subject":"acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672",
    "time":"2020-07-21 20:22:01.961000",
    "type":"aliyuncvc:MeetingEvent:MeetingStateEvent"
}

以下樣本事件模式只匹配source不是阿里雲服務的事件,即匹配您的自訂應用發出的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "x-limit":456
    }
}
{
    "source":[
        {
            "anything-but":{
                "prefix":"acs."
            }
        }
    ]
}

數值匹配

您可以指定某個欄位的數值或範圍。例如,以下樣本事件模式只匹配c-count大於0小於等於5、d-count小於10和x-limit等於301.8的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8
    }
}
{
    "data":{
        "c-count":[
            {
                "numeric":[
                    ">",
                    0,
                    "<=",
                    5
                ]
            }
        ],
        "d-count":[
            {
                "numeric":[
                    "<",
                    10
                ]
            }
        ],
        "x-limit":[
            {
                "numeric":[
                    "=",
                    301.8
                ]
            }
        ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":300
    }
}

重要

數值匹配只有在值為JSON數值時才生效,並且取值範圍僅限於-1.0e9到+1.0e9,精確到15位元字,小數點後6位。

IP地址匹配

您可以指定data中欄位的IP地址。例如,以下樣本事件模式中只匹配source-ip10.0.0.0/24的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "source-ip":"10.0.0.123"
    }
}
{
    "data":{
        "source-ip":[
            {
                "cidr":"10.0.0.0/24"
            }
        ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "source-ip":"10.0.0.123"
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "source-ip":"192.168.0.123"
    }
}

說明

IP地址目前只支援IPv4地址。

多模式比對

您可以將多個規則群組合為更複雜的事件模式。例如,以下樣本事件模式中結合了首碼匹配、除外匹配、IP地址匹配和數值匹配,您可以通過設定多模式比對精確過濾您想擷取的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8,
        "state":"pending",
        "source-ip":"10.0.0.123"
    }
}
{
    "source":[
        {
            "prefix":"acs."
        }
    ],
    "data":{
        "state":[
            {
                "anything-but":"initializing"
            }
        ],
        "source-ip":[
            {
                "cidr":"10.0.0.0/24"
            }
        ],
        "c-count":[
            {
                "numeric":[
                    ">",
                    0,
                    "<=",
                    5
                ]
            }
        ],
        "d-count":[
            {
                "numeric":[
                    "<",
                    10
                ]
            }
        ],
        "x-limit":[
            {
                "anything-but":[
                    100,
                    200,
                    300
                ]
            }
        ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8,
        "state":"pending",
        "source-ip":"10.0.0.123"
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "c-count":5,
        "d-count":7,
        "x-limit":301.8,
        "state":"initializing",
        "source-ip":"192.168.0.123"
    }
}

匹配數組

事件模式中每個欄位的值均為一個包含一個或多個值的數組,如果數組中的任一值匹配事件中的值,則模式比對。如果事件中的值也是數組,只要與事件模式的數組的交集不是空集,則模式比對。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "subject":[
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
        "acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
    ]
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":[
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
    ],
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":[
        "acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
        "acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
    ],
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100
    }
}

匹配空值

您可以建立一個事件模式與含有null值或Null 字元串的事件進行匹配。例如,以下樣本模式比對eventVersion值為空白字串的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
{
    "data":{
        "eventVersion":[
            ""
        ]
    }
}
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "1.0",
    "responseElements": null
   }
}

以下樣本事件模式只匹配responseElements值為空白值的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
{
    "data":{
        "responseElements":[
            null
        ]
    }
}
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": null
   }
}
{
  "version": "0",
  "id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
  "datacontenttype": "Instance Launch Successful",
  "source": "acs.oss",
  "account": "123456789012",
  "time": "2015-11-11T21:31:47Z",
  "region": "cn-hangzhou",
  "resources": [
   ],
  "data": {
    "eventVersion": "",
    "responseElements": "lss"
   }
}

說明

進行模式比對時,null值和Null 字元串是不等同的。用於匹配Null 字元串的模式不會匹配到null值。

存在匹配

您可以指定data中存在或不存在某個欄位。例如,以下樣本匹配不包含state欄位的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。

從事件來源接收的事件

事件模式

模式過濾後的事件

{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
    }
}
{
    "data":{
        "state":[
            {
               "exists": false
            }
         ]
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
    }
}
{
    "id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
    "source":"acs.oss",
    "specversion":"1.0",
    "type":"oss:ObjectCreated:PostObject",
    "datacontenttype":"application/json",
    "dataschema":"http://example.com/test.json",
    "subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
    "time":"2020-08-17T16:04:46.149Asia/Shanghai",
    "data":{
        "name":"test",
        "scope":100,
        "state":"terminated"
    }
}