注意事項
事件模式匹配的原則如下:
事件必須包含事件模式中列出的所有字段名,且事件模式里的字段名必須和事件中的字段名具有相同的嵌套結構。
事件模式是逐個字符精確匹配的 ,需注意大小寫,匹配過程中不會對字符串進行任何標準化的操作。
要匹配的值遵循JSON規則:用引號引起來的字符串、數字以及不帶引號的關鍵字true、false和null。
事件模式支持OR的語義,事件模式匹配中各個Key支持AND語義,Key的Value值支持數組OR的語義。
指定值匹配
您可以指定某個字段的值進行匹配。例如,以下示例事件模式只匹配source是阿里云對象存儲OSS的事件。下表介紹事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
"acs.oss"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
前綴匹配
您可以指定某個字段的值的前綴進行匹配。例如,以下示例事件模式只匹配source字段以acs.開頭的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"source":[
{
"prefix":"acs."
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
包含匹配
您可以指定某個字段包含特定字段值進行匹配。例如,在以下示例一,事件模式只匹配type中包含Normal的事件。在以下示例二,事件模式匹配type中包含Normal或者Error的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
示例一:匹配"type"
字段包含"Normal"
的事件
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| 無 |
示例二:匹配"type"
字段包含"Normal"
或者"Error"
的事件
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"type":[
{
"contains": "Normal"
},
{
"contains": "Error"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserNormalEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserErrorEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"UserOtherEvent",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| 無 |
后綴匹配
您可以指定某個字段的值的后綴進行匹配。例如,以下示例事件模式只匹配subject中前綴為acs:oss:cn-hangzhou:1234567:xls-papk/、后綴為.jpg或后綴為.txt的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
{
"prefix":"acs:oss:cn-hangzhou:1234567:xls-papk/"
},
{
"suffix":".txt"
},
{
"suffix":".jpg"
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.png",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
除外匹配
您可以指定某個字段除了提供的值之外的任何值進行匹配。您可以將anything-but與字符串和數值一起使用。例如,以下示例事件模式只匹配state不是initializing
和x-limit不是123
的所有事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
以下模式顯示單個anything-but匹配,首先是字符串,然后是數值。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
| {
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"x-limit":[
{
"anything-but":123
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"running",
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| 無 |
以下示例事件模式只匹配state不是stopped
和overloaded
的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| {
"data":{
"state":[
{
"anything-but":[
"stopped",
"overloaded"
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"stopped"
}
}
| 無 |
以下示例事件模式只匹配x-limit不是100
、200
和300
的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"data":{
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":200
}
}
| 無 |
以下示例事件模式只匹配state前綴不是init的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
| {
"data":{
"state":[
{
"anything-but":{
"prefix":"init"
}
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"pending"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"initializing"
}
}
| 無 |
以下示例事件模式只匹配source不是云服務器 ECS的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":[
"acs.ecs"
]
}
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
|
{
"data":{
"meetingName":"marketing-meeting",
"action":"meeting_start",
"time":1590592494070,
"meetingUUID":"hz-20864c8f-b10d-45cd-9935-884bca1b****"
},
"id":"45ef4dewdwe1-7c35-447a-bd93-fab****",
"source":"acs.aliyuncvc",
"specversion":"1.0",
"subject":"acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672",
"time":"2020-07-21 20:22:01.961000",
"type":"aliyuncvc:MeetingEvent:MeetingStateEvent"
}
| 無 |
以下示例事件模式只匹配source不是阿里云服務的事件,即匹配您的自定義應用發出的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"x-limit":456
}
}
| {
"source":[
{
"anything-but":{
"prefix":"acs."
}
}
]
}
| 無 |
數值匹配
您可以指定某個字段的數值或范圍。例如,以下示例事件模式只匹配c-count大于0小于等于5、d-count小于10和x-limit等于301.8的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
| {
"data":{
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"numeric":[
"=",
301.8
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":300
}
}
| 無 |
重要 數值匹配只有在值為JSON數值時才生效,并且取值范圍僅限于-1.0e9到+1.0e9,精確到15位數字,小數點后6位。
IP地址匹配
您可以指定data中字段的IP地址。例如,以下示例事件模式中只匹配source-ip為10.0.0.0/24
的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
| {
"data":{
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"source-ip":"192.168.0.123"
}
}
| 無 |
多模式匹配
您可以將多個規則組合為更復雜的事件模式。例如,以下示例事件模式中結合了前綴匹配、除外匹配、IP地址匹配和數值匹配,您可以通過設置多模式匹配精確過濾您想獲取的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
| {
"source":[
{
"prefix":"acs."
}
],
"data":{
"state":[
{
"anything-but":"initializing"
}
],
"source-ip":[
{
"cidr":"10.0.0.0/24"
}
],
"c-count":[
{
"numeric":[
">",
0,
"<=",
5
]
}
],
"d-count":[
{
"numeric":[
"<",
10
]
}
],
"x-limit":[
{
"anything-but":[
100,
200,
300
]
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"pending",
"source-ip":"10.0.0.123"
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"c-count":5,
"d-count":7,
"x-limit":301.8,
"state":"initializing",
"source-ip":"192.168.0.123"
}
}
| 無 |
匹配數組
事件模式中每個字段的值均為一個包含一個或多個值的數組,如果數組中的任一值匹配事件中的值,則模式匹配。如果事件中的值也是數組,只要與事件模式的數組的交集不是空集,則模式匹配。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:1112223:xls-papk/game_apk/123.jpg",
"acs:oss:cn-hangzhou:4455667:xls-papk/game_apk/123.jpg"
]
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":[
"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"acs:acs.aliyuncvc:cn-hangzhou:<yourAccountId>:215672"
],
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100
}
}
|
匹配空值
您可以創建一個事件模式與含有null值或空字符串的事件進行匹配。例如,以下示例模式匹配eventVersion值為空字符串的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"eventVersion":[
""
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "1.0",
"responseElements": null
}
}
| 無 |
以下示例事件模式只匹配responseElements值為空值的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
| {
"data":{
"responseElements":[
null
]
}
}
| {
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": null
}
}
|
{
"version": "0",
"id": "7adc8c1a-645d-4476-bdef-5d6fb57f****",
"datacontenttype": "Instance Launch Successful",
"source": "acs.oss",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "cn-hangzhou",
"resources": [
],
"data": {
"eventVersion": "",
"responseElements": "lss"
}
}
| 無 |
說明 進行模式匹配時,null值和空字符串是不等同的。用于匹配空字符串的模式不會匹配到null值。
存在匹配
您可以指定data中存在或不存在某個字段。例如,以下示例匹配不包含state字段的事件。下表介紹示例事件從事件源發出經過事件模式過濾的過程。
從事件源接收的事件 | 事件模式 | 模式過濾后的事件 |
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
| {
"data":{
"state":[
{
"exists": false
}
]
}
}
| {
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
}
}
|
{
"id":"7adc8c1a-645d-4476-bdef-5d6fb57f****",
"source":"acs.oss",
"specversion":"1.0",
"type":"oss:ObjectCreated:PostObject",
"datacontenttype":"application/json",
"dataschema":"http://example.com/test.json",
"subject":"acs:oss:cn-hangzhou:1234567:xls-papk/game_apk/123.jpg",
"time":"2020-08-17T16:04:46.149Asia/Shanghai",
"data":{
"name":"test",
"scope":100,
"state":"terminated"
}
}
| 無 |