search

aws / event-ruler

Event Ruler is a Java library that allows matching many thousands of Events per second to any number of expressive and sophisticated rules.
Apache License 2.0
566 stars 63 forks source link

Some Queries #126

Closed sridhard closed 11 months ago

sridhard commented 11 months ago

Hi,

  1. For both numeric and string there is no "Not equal to" operation supported. How to implement "Not equal" using event-ruler. Should we use anything-but? or any alternate?
  2. When we write the rules, can we have multiple conditions for the same field? For example in the below rule we want to check whether the source starts with EC2 and source not equal to EC2TestMachine (JSON cannot have 2 keys with same name. So how to achieve this requirement) { "source": [ { "prefix": { "equals-ignore-case": "EC2" } } ], "source": [ { "anything-but": [ "EC2TestMachine" ] } ], }
  3. Is there any limit on the number of rules that matches a given event? for example: Suppose we had a 100 thousand rules. And the incoming event matches with 10 thousand rules. Then the rulesForJsonEvent() function will return all the 10 thousand matched rules? or is there any limit on this? also is there any performance impact when the matched rules are more?
  4. any way to write rule for "String does not contain". Is the below rule supported { "detail": { "state": [ { "anything-but": { "wildcard": "init" } } ] } }
jonessha commented 11 months ago
  1. Correct, anything-but is "not equal".
  2. Not possible today, but there is an issue for it: https://github.com/aws/event-ruler/issues/69
  3. I'm not aware of any limits in the code. So the only real "limit" would be when your memory is exhausted trying to return all the matches. There shouldn't be performance impact to the machine traversal (by design), but there could be some impact just in constructing the list of 10 thousand rules to return as a response.
  4. Not possible today, but there is an issue for it: https://github.com/aws/event-ruler/issues/72

Closing as I think I've answered your questions, but let me know if you have follow-ups.