Skip to end of metadata
Go to start of metadata

There are three group operators: any, count, and repeat

Any

any n (E1,[el],Em). This matches if any n of eventexes E1 through Em match. In this eventex, n must be less than or equal to m. When n is not less than m, any behaves in the same way as a variable arity and operator, checking for matches of all the subexpressions. The following example shows how any can be used:

This eventex would match if any two of the three enclosed simple eventexes matched. The preceding eventex has the same semantics as this compound eventex:

 I think you'll agree that the first eventex is clearer than the second one is!

Count

count n (E). This matches after n of eventex E have matched. When the count eventex matches, the counter is reset and the expression begins looking for n more of eventex E. Consider the following eventex:

 The arrows on the event stream in the following diagram show where this eventex would match.


Repeat

repeat n (E). This matches after n of eventex E have matched. When the repeat eventex matches, the counter is not reset, and the eventex matches using a sliding window on the event stream, always matching the last n of the eventex given in the subexpression. Consider the following eventex:

The arrows on the event stream in the following diagram show where this eventex would match.


The repeat operator is not particularly interesting by itself, but is mostly used in concert with aggregators introduced in the next section.

Time Bounds

You can use relative time bounds with group operators, as shown in the following example:

This event expression has the same semantics as the any example given earlier, except the matches of the subexpressions must occur within three minutes.

Labels: