Event pattern
Updated at：2025-11-03
Overview
Event patterns are used by the event bus to filter relevant events. Event bus EventBridge filters events using event patterns and routes them to appropriate event targets. Currently, Phase I supports specified value matching only, while Phase II introduces prefix matching, inclusion matching, suffix matching, exclusion matching, and numerical matching.
Note
- Event patterns are matched character by character with exact precision. Pay attention to case sensitivity, as no string normalization is performed during the matching process.
- Values to be matched follow JSON rules: Quoted strings, numbers, and unquoted keywords true, false, and null.
- In event pattern matching, each Key supports AND semantics, and the value of the Key supports OR semantics.
Specified value matching
You can set a field's value for matching purposes. For instance, the following event pattern only captures events where the source is Baidu Cloud Compute (BCC) and the event name is cluster_resume_failed. The process of assigning events from sources and filtering them through event patterns is described below.
- Events received from event sources
事件1
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}
事件2
1{
2 "data": {
3 "info": "System exception occurred",
4 "advice": "Please contact the administrator"
5 },
6 "id": "*****",
7 "source": "BCE_BCC",
8 "specversion": "1.0",
9 "type": "RepairDeviceFault",
10 "subject": "*****",
11 "time": "2020-11-19T21:04:41+08:00",
12 "level": "CRITICAL",
13 "accountId": "*****",
14 "eventBusId": "eb-8a33f060",
15 "eventBusName": "default",
16 "eventAlias": "Device error",
17 "eventAliasEn": "DeviceFault",
18 "region": "bj",
19 "recvTimestamp": "2020-11-19T21:04:41+08:00"
20}- Event pattern
Plain Text
1{
2 "source":["BCE_BCC"],
3 "type":["cluster_resume_failed"]
4 }- Events after pattern filtering:
Plain Text
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}Prefix matching
You can specify the value prefix of a field for matching. For example, the following example event pattern only matches events where the type starts with cluster_. The process where events are assigned from event sources and filtered through event patterns is described below.
- Events received from event sources
事件1
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}
事件2
1{
2 "data": {
3 "info": "System exception occurred",
4 "advice": "Please contact the administrator"
5 },
6 "id": "*****",
7 "source": "BCE_BCC",
8 "specversion": "1.0",
9 "type": "RepairDeviceFault",
10 "subject": "*****",
11 "time": "2020-11-19T21:04:41+08:00",
12 "level": "CRITICAL",
13 "accountId": "*****",
14 "eventBusId": "eb-8a33f060",
15 "eventBusName": "default",
16 "eventAlias": "Device error",
17 "eventAliasEn": "DeviceFault",
18 "region": "bj",
19 "recvTimestamp": "2020-11-19T21:04:41+08:00"
20}- Event pattern
Plain Text
1`{
2 "type":[
3 {
4 "prefix":"cluster_"
5 }
6 ]
7 }- Events after pattern filtering:
Plain Text
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}Suffix matching
You can specify the value prefix of a field for matching. For example, the following example event pattern only matches events where the type ends with _failed. The process where events are assigned from event sources and filtered through event patterns is described below.
- Events received from event sources
事件1
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}
事件2
1{
2 "data": {
3 "info": "System exception occurred",
4 "advice": "Please contact the administrator"
5 },
6 "id": "*****",
7 "source": "BCE_BCC",
8 "specversion": "1.0",
9 "type": "RepairDeviceFault",
10 "subject": "*****",
11 "time": "2020-11-19T21:04:41+08:00",
12 "level": "CRITICAL",
13 "accountId": "*****",
14 "eventBusId": "eb-8a33f060",
15 "eventBusName": "default",
16 "eventAlias": "Device error",
17 "eventAliasEn": "DeviceFault",
18 "region": "bj",
19 "recvTimestamp": "2020-11-19T21:04:41+08:00"
20}- Event pattern
Plain Text
1{
2 "type":[
3 {
4 "suffix":"_failed"
5 }
6 ]
7 }- Events after pattern filtering:
Plain Text
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}Inclusion matching
You can specify that a certain field contains a specific field value for matching. The event pattern only matches events where the type contains Device.The process where events are assigned from event sources and filtered through event patterns is described below.
- Events received from event sources
事件1
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}
事件2
1{
2 "data": {
3 "info": "System exception occurred",
4 "advice": "Please contact the administrator"
5 },
6 "id": "*****",
7 "source": "BCE_BCC",
8 "specversion": "1.0",
9 "type": "RepairDeviceFault",
10 "subject": "*****",
11 "time": "2020-11-19T21:04:41+08:00",
12 "level": "CRITICAL",
13 "accountId": "*****",
14 "eventBusId": "eb-8a33f060",
15 "eventBusName": "default",
16 "eventAlias": "Device error",
17 "eventAliasEn": "DeviceFault",
18 "region": "bj",
19 "recvTimestamp": "2020-11-19T21:04:41+08:00"
20}- Event pattern
Plain Text
1{
2 "type":[
3 {
4 "contains":"Device"
5 }
6 ]
7 }- Events after pattern filtering:
Plain Text
1{
2 "data": {
3 "info": "System exception occurred",
4 "advice": "Please contact the administrator"
5 },
6 "id": "*****",
7 "source": "BCE_BCC",
8 "specversion": "1.0",
9 "type": "RepairDeviceFault",
10 "subject": "*****",
11 "time": "2020-11-19T21:04:41+08:00",
12 "level": "CRITICAL",
13 "accountId": "*****",
14 "eventBusId": "eb-8a33f060",
15 "eventBusName": "default",
16 "eventAlias": "Device error",
17 "eventAliasEn": "DeviceFault",
18 "region": "bj",
19 "recvTimestamp": "2020-11-19T21:04:41+08:00"
20}Exclusion matching
You can specify any value for a field except the provided value for matching. For example, matching events where the level is anything except CRITICAL. The table below describes the process where example events are assigned from event sources and filtered through event patterns.
- Events received from event sources
事件1
1{
2 "data": {
3 "advice": "Recommended solution",
4 "info": "Exception message"
5 },
6 "level": "WARNING",
7 "subject": "*****",
8 "source": "BCE_BCC",
9 "type": "cluster_resume_failed",
10 "accountId": "*****",
11 "eventBusId": "eb-8a33f060",
12 "eventBusName": "default",
13 "eventAlias": "Cluster recovery service failed",
14 "specversion": "1.0",
15 "id": "*****",
16 "time": "2020-11-19T21:04:41+08:00",
17 "region": "bj",
18 "eventAliasEn": "CLUSTER_RESUME_FAILED"
19}
事件2
1{
2 "data": {
3 "info": "System exception occurred",
4 "advice": "Please contact the administrator"
5 },
6 "id": "*****",
7 "source": "BCE_BCC",
8 "specversion": "1.0",
9 "type": "RepairDeviceFault",
10 "subject": "*****",
11 "time": "2020-11-19T21:04:41+08:00",
12 "level": "CRITICAL",
13 "accountId": "*****",
14 "eventBusId": "eb-8a33f060",
15 "eventBusName": "default",
16 "eventAlias": "Device error",
17 "eventAliasEn": "DeviceFault",
18 "region": "bj",
19 "recvTimestamp": "2020-11-19T21:04:41+08:00"
20}- Event pattern
Plain Text
1{
2 "level":[
3 {
4 "anything-but":"CRITICAL"
5 }
6 ]
7 }- Events after pattern filtering:
Plain Text
1{
2 "data": {
3 "info": "System exception occurred",
4 "advice": "Please contact the administrator"
5 },
6 "id": "*****",
7 "source": "BCE_BCC",
8 "specversion": "1.0",
9 "type": "RepairDeviceFault",
10 "subject": "*****",
11 "time": "2020-11-19T21:04:41+08:00",
12 "level": "CRITICAL",
13 "accountId": "*****",
14 "eventBusId": "eb-8a33f060",
15 "eventBusName": "default",
16 "eventAlias": "Device error",
17 "eventAliasEn": "DeviceFault",
18 "region": "bj",
19 "recvTimestamp": "2020-11-19T21:04:41+08:00"
20}Combination usage
The above various pattern matching methods can be used in combination. For example, matching events where the type prefix is cluster_ or the suffix is _failed, and the level is not CRITICAL. The event pattern structure is as follows:
Plain Text
1{
2 "type":[
3 {
4 "prefix":"cluster_"
5 },
6 {
7 "suffix":"_failed"
8 }
9 ],
10 "level":[
11 {
12 "anything-but":"CRITICAL"
13 }
14 ]
15 }