Filters

Filters are expressions that evaluate to either true or false. Basic filter operations do comparisons between fields and other fields or fixed values. The following are samples of valid filters:

token > 1000000
aggregateIdentifier = "1234"
payloadType = aggregateType
Basic operators:

Basic operators

  • =

  • >

  • <

  • != or <>

  • >=

  • <=

  • in

All comparison operators expect either the same type, or performs a String comparison.

Logical operators

Filter expressions can be combined using the logical operators

  • and

  • or

  • not

You can use parenthesis in the expression to change the evaulation orders.

Arithmetic operators

In expressions you can use basic arithmetic operators:

  • +

  • -

  • *

  • /

  • %

All expect for the '+' only work on numeric values. '+' on String does a concatenation.

Matching functions

Apart from these operators there are 2 matching functions:

  • contains: if both parameters are string values it is true when the first contains the second. If the first parameter is a list it returns true if the list contains the second value.

  • match: compares the value of the first paramater to a regular expression (regexp format same as in Java).

Function names may be used in the traditional ways, but for binary functions also in infix mode. So the following two samples are both valid:

contains(payloadData, "Smith")
payloadData contains "Smith"

Examples

select(payloadType, aggregateType, aggregateSequenceNumber, hour(timestamp) as time)

Returns only the payloadType, aggregateType, aggregateSequenceNumber fields and the hour of the timestamp for each event.

groupby(payloadType, count())

Counts the number of events per payloadType.

groupby([payloadType, aggregateType], count(), min(aggregateSequenceNumber))

Counts the number of events and finds the minimum aggregateSequenceNumber per combination of payloadType, aggregateType.

count(aggregateSequenceNumber > 100)

Counts the number of events with aggregateSequenceNumber > 100.