注意事项
事件模式匹配的原则如下:
事件必须包含事件模式中列出的所有字段名,且事件模式里的字段名必须和事件中的字段名具有相同嵌套结构。
事件模式是逐个字符精确匹配的 ,需注意大小写,匹配过程中不会对字符串进行任何标准化的操作。
要匹配的值遵循JSON规则:用引号引起来的字符串、数字以及不带引号的关键字true、false和null。
事件模式支持OR的语义,事件模式匹配中各个Key支持AND语义,Key的Value值支持数组OR的语义。
指定值匹配
您可以指定某个字段的值进行匹配。例如,以下示例事件模式只匹配source是阿里云对象存储OSS的事件。下表介绍事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
"acs.oss"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
前缀匹配
您可以指定某个字段的值的前缀进行匹配。例如,以下示例事件模式只匹配source字段以acs.开头的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
{
"prefix":"acs."
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
包含匹配
您可以指定某个字段包含特定字段值进行匹配。例如,在以下示例一,事件模式只匹配type中包含Normal的事件。在以下示例二,事件模式匹配type中包含Normal或者Error的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
示例一:匹配"type"
字段包含"Normal"
的事件
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| 无 |
示例二:匹配"type"
字段包含"Normal"
或者"Error"
的事件
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
},
{
"contains": "Error"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserOtherEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| 无 |
后缀匹配
您可以指定某个字段的值的后缀进行匹配。例如,以下示例事件模式只匹配subject中前缀为acs:oss:cn-hangzhou:1234567:xls-papk/、后缀为.jpg或后缀为.txt的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
{
"prefix":"acs:oss:cn-hangzhou:1234567:xls-papk/"
},
{
"suffix":".txt"
},
{
"suffix":".jpg"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
除外匹配
您可以指定某个字段除了提供的值之外的任何值进行匹配。您可以将anything-but与字符串和数值一起使用。例如,以下示例事件模式只匹配state不是initializing
和x-limit不是123
的所有事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
以下模式显示单个anything-but匹配,首先是字符串,然后是数值。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
| {
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"x-limit":[
{
"anything-but":123
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| 无 |
以下示例事件模式只匹配state不是stopped
和overloaded
的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| {
"data":{
"state":[
{
"anything-but":[
"stopped",
"overloaded"
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"stopped"
}
}
| 无 |
以下示例事件模式只匹配x-limit不是100
、200
和300
的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"data":{
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":200
}
}
| 无 |
以下示例事件模式只匹配state前缀不是init的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
| {
"data":{
"state":[
{
"anything-but":{
"prefix":"init"
}
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"initializing"
}
}
| 无 |
以下示例事件模式只匹配source不是云服务器 ECS的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":[
"acs.ecs"
]
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"id": "45ef4dewdwe1-7c35-447a-bd93-fab****",
"source": "acs.ecs",
"specversion": "1.0",
"subject": "acs.ecs:cn-hangzhou:123456789098****:215672",
"time": "2020-11-19T21:04:41Z",
"type": "ecs:Disk:ConvertToPostpaidCompleted",
"aliyunaccountid": "123456789098****",
"aliyunpublishtime": "2020-11-19T21:04:42Z",
"aliyuneventbusname": "default",
"aliyunregionid": "cn-hangzhou",
"aliyunpublishaddr": "172.25.XX.XX",
"data": {
"result": "accomplished",
"diskName": "e2e-ecs-xxxxxxxx",
"diskId": "d-gx3hn2vc0fxxxxxxxx"
}
}
| 无 |
以下示例事件模式只匹配source不是阿里云服务的事件,即匹配您的自定义应用发出的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":{
"prefix":"acs."
}
}
]
}
| 无 |
数值匹配
您可以指定某个字段的数值或范围。例如,以下示例事件模式只匹配c-count大于0小于等于5、d-count小于10和x-limit等于301.8的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
| {
"data":{
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"numeric":[
"=",
301.8
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":300
}
}
| 无 |
重要 数值匹配只有在值为JSON数值时才生效,并且取值范围仅限于-1.0e9到+1.0e9,精确到15位数字,小数点后6位。
IP地址匹配
您可以指定data中字段的IP地址。例如,以下示例事件模式中只匹配source-ip为10.0.0.0/24
的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
| {
"data":{
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"192.168.0.123"
}
}
| 无 |
多模式匹配
您可以将多个规则组合为更复杂的事件模式。例如,以下示例事件模式中结合了前缀匹配、除外匹配、IP地址匹配和数值匹配,您可以通过设置多模式匹配精确过滤您想获取的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
| {
"source":[
{
"prefix":"acs."
}
],
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
],
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"initializing",
"source-ip":"192.168.0.123"
}
}
| 无 |
匹配数组
事件模式中每个字段的值均为一个包含一个或多个值的数组,如果数组中的任一值匹配事件中的值,则模式匹配。如果事件中的值也是数组,只要与事件模式的数组的交集不是空集,则模式匹配。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
匹配空值
您可以创建一个事件模式与含有null值或空字符串的事件进行匹配。例如,以下示例模式匹配eventVersion值为空字符串的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"eventVersion":[
""
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "1.0",
"responseElements": null
}
}
| 无 |
以下示例事件模式只匹配responseElements值为空值的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"responseElements":[
null
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": "lss"
}
}
| 无 |
说明 进行模式匹配时,null值和空字符串是不等同的。用于匹配空字符串的模式不会匹配到null值。
存在匹配
您可以指定data中存在或不存在某个字段。例如,以下示例匹配不包含state字段的事件。下表介绍示例事件从事件源发出经过事件模式过滤的过程。
从事件源接收的事件 | 事件模式 | 模式过滤后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
| {
"data":{
"state":[
{
"exists": false
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| 无 |