Filter Rule Parameters

Only events that match your filter rules will be routed to the associated targets. These filter rules must have the same structure as the events.

This section describes the restrictions of filter rules as well as the operators, condition expressions, and matching fields.

Restrictions

Event filter rules must meet the following requirements:

Top-level fields can only be source, type, subject, or data.
Top-level fields must include source, and source only supports the StringIn operator.
The data field allows max. 5 subfields, and each can have max. 5 levels.
Each field can have max. 5 conditions in an OR relationship.
Multiple fields are ANDed with each other.
A field that appears more than once at the same level will be used where it appears the last time.

Operators

Table 1 lists the operators that can be used in event filter rules.

**Table 1** Operators
Operator	Input Value	Condition Value	Description
StringIn	String/String[]	String[] values	Check if the input value matches any condition value.
StringNotIn	String/String[]	String[] values	Check if the input value does not match any condition value.
StringStartsWith	String/String[]	String[] values	Check if the input value prefix matches any condition value.
StringNotStartsWith	String/String[]	String[] values	Check if the input value prefix does not match any condition value.
StringEndsWith	String/String[]	String[] values	Check if the input value suffix matches any condition value.
StringNotEndsWith	String/String[]	String[] values	Check if the input value suffix does not match any condition value.
NumberIn	Number/Number[]	Number[] values	Check if the input value matches any condition value.
NumberNotIn	Number/Number[]	Number[] values	Check if the input value does not match any condition value.
NumberLessThan	Number/Number[]	Number value	Check if the input value is less than the condition value.
NumberNotLessThan	Number/Number[]	Number value	Check if the input value is greater than or equal to the condition value.
NumberGreaterThan	Number/Number[]	Number value	Check if the input value is greater than the condition value.
NumberNotGreaterThan	Number/Number[]	Number value	Check if the input value is less than or equal to the condition value.
NumberInRange	Number/Number[]	Number[][] values	Check if the input value is within any condition value range.
NumberNotInRange	Number/Number[]	Number[][] values	Check if the input value is not within any condition value range.
IsNull	-	None	Check if the input value is null or undefined.
IsNotNull	-	None	Check if the input value is neither null nor undefined.
IsTrue	Boolean	None	Check if the input value is true.
IsNotTrue	Boolean	None	Check if the input value is false.

Condition Expressions

Table 2 lists the condition expressions that can be used in event filter rules.

**Table 2** Condition expressions
Field Name	Type	Required	Description
op	String	Yes	Operator
value	JSON Type	No	Condition value
values	JSON Array	No	Condition value range

Matching Fields

Table 3 lists the matching fields that can be used in event filter rules.

**Table 3** Matching fields
Field Name	Condition Value Type	Example
source	JSON array	Event source. The condition value is in the JSON array. This field can only be used with the StringIn operator. Example: [{"op": "StringIn", "values": ["HC.OBS"]]
type	JSON array	Event type. The condition value is in the JSON array. Example: [{"op": "StringIn", "values": ["object:put"]]
subject	JSON array	Event body. The condition value is in the JSON array. Example: [{"op": "StringEndsWith", "values": [".jpg"]]
data	JSON object	Event data. The condition value is in the JSON object, and can be nested in max. 5 layers. Example: {"state": [{"op": "StringIn", "values": ["running"]]}]