注意事項
事件模式比對的原則如下:
事件必須包含事件模式中列出的所有欄位名,且事件模式裡的欄位名必須和事件中的欄位名具有相同的嵌套結構。
事件模式是逐個字元精確匹配的 ,需注意大小寫,匹配過程中不會對字串進行任何標準化的操作。
要匹配的值遵循JSON規則:用引號引起來的字串、數字以及不帶引號的關鍵字true、false和null。
事件模式支援OR的語義,事件模式比對中各個Key支援AND語義,Key的Value值支援數組OR的語義。
指定值匹配
您可以指定某個欄位的值進行匹配。例如,以下樣本事件模式只匹配source是阿里雲Object Storage Service的事件。下表介紹事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
"acs.oss"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
首碼匹配
您可以指定某個欄位的值的首碼進行匹配。例如,以下樣本事件模式只匹配source欄位以acs.開頭的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
{
"prefix":"acs."
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
包含匹配
您可以指定某個欄位包含特定欄位值進行匹配。例如,在以下樣本一,事件模式只匹配type中包含Normal的事件。在以下樣本二,事件模式比對type中包含Normal或者Error的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
樣本一:匹配"type"
欄位包含"Normal"
的事件
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| 無 |
樣本二:匹配"type"
欄位包含"Normal"
或者"Error"
的事件
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
},
{
"contains": "Error"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserOtherEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| 無 |
尾碼匹配
您可以指定某個欄位的值的尾碼進行匹配。例如,以下樣本事件模式只匹配subject中首碼為acs:oss:cn-hangzhou:1234567:xls-papk/、尾碼為.jpg或尾碼為.txt的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
{
"prefix":"acs:oss:cn-hangzhou:1234567:xls-papk/"
},
{
"suffix":".txt"
},
{
"suffix":".jpg"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
除外匹配
您可以指定某個欄位除了提供的值之外的任何值進行匹配。您可以將anything-but與字串和數值一起使用。例如,以下樣本事件模式只匹配state不是initializing
和x-limit不是123
的所有事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
以下模式顯示單個anything-but匹配,首先是字串,然後是數值。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
| {
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"x-limit":[
{
"anything-but":123
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| 無 |
以下樣本事件模式只匹配state不是stopped
和overloaded
的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| {
"data":{
"state":[
{
"anything-but":[
"stopped",
"overloaded"
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"stopped"
}
}
| 無 |
以下樣本事件模式只匹配x-limit不是100
、200
和300
的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"data":{
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":200
}
}
| 無 |
以下樣本事件模式只匹配state首碼不是init的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
| {
"data":{
"state":[
{
"anything-but":{
"prefix":"init"
}
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"initializing"
}
}
| 無 |
以下樣本事件模式只匹配source不是Elastic Compute Service的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":[
"acs.ecs"
]
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"data":{
"meetingName":"marketing-meeting",
"action":"meeting_start",
"time":1590592494070,
"meetingUUID":"hz-20864c8f-b10d-45cd-9935-884bca1b****"
},
"id":"45ef4dewdwe1-7c35-447a-bd93-fab****",
"source":"acs.aliyuncvc",
"specversion":"1.0",
"subject":"acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672",
"time":"2020-07-21 20:22:01.961000",
"type":"aliyuncvc:MeetingEvent:MeetingStateEvent"
}
| 無 |
以下樣本事件模式只匹配source不是阿里雲服務的事件,即匹配您的自訂應用發出的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":{
"prefix":"acs."
}
}
]
}
| 無 |
數值匹配
您可以指定某個欄位的數值或範圍。例如,以下樣本事件模式只匹配c-count大於0小於等於5、d-count小於10和x-limit等於301.8的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
| {
"data":{
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"numeric":[
"=",
301.8
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":300
}
}
| 無 |
重要 數值匹配只有在值為JSON數值時才生效,並且取值範圍僅限於-1.0e9到+1.0e9,精確到15位元字,小數點後6位。
IP地址匹配
您可以指定data中欄位的IP地址。例如,以下樣本事件模式中只匹配source-ip為10.0.0.0/24
的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
| {
"data":{
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"192.168.0.123"
}
}
| 無 |
多模式比對
您可以將多個規則群組合為更複雜的事件模式。例如,以下樣本事件模式中結合了首碼匹配、除外匹配、IP地址匹配和數值匹配,您可以通過設定多模式比對精確過濾您想擷取的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
| {
"source":[
{
"prefix":"acs."
}
],
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
],
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"initializing",
"source-ip":"192.168.0.123"
}
}
| 無 |
匹配數組
事件模式中每個欄位的值均為一個包含一個或多個值的數組,如果數組中的任一值匹配事件中的值,則模式比對。如果事件中的值也是數組,只要與事件模式的數組的交集不是空集,則模式比對。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
匹配空值
您可以建立一個事件模式與含有null值或Null 字元串的事件進行匹配。例如,以下樣本模式比對eventVersion值為空白字串的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"eventVersion":[
""
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "1.0",
"responseElements": null
}
}
| 無 |
以下樣本事件模式只匹配responseElements值為空白值的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"responseElements":[
null
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": "lss"
}
}
| 無 |
說明 進行模式比對時,null值和Null 字元串是不等同的。用於匹配Null 字元串的模式不會匹配到null值。
存在匹配
您可以指定data中存在或不存在某個欄位。例如,以下樣本匹配不包含state欄位的事件。下表介紹樣本事件從事件來源發出經過事件模式過濾的過程。
從事件來源接收的事件 | 事件模式 | 模式過濾後的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
| {
"data":{
"state":[
{
"exists": false
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| 無 |