本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
根据事件字段值匹配事件
您可以使用所有 JSON 数据类型和值来匹配事件。以下示例展示事件和与之匹配的事件模式。
字段匹配
您可以匹配字段的值。以下 Amazon A EC2 uto Scaling 事件为例。
{
"version": "0",
"id": "3e3c153a-8339-4e30-8c35-687ebef853fe",
"detail-type": "EC2 Instance Launch Successful",
"source": "aws.autoscaling",
"account": "123456789012",
"time": "2015-11-11T21:31:47Z",
"region": "us-east-1",
"resources": [],
"detail": {
"eventVersion": "",
"responseElements": null
}
}对于以上事件，您可以使用 "responseElements" 字段进行匹配。
{
"source": ["aws.autoscaling"],
"detail-type": ["EC2 Instance Launch Successful"],
"detail": {
"responseElements": [null]
}
}值匹配
请考虑以下 Amazon Macie 事件，该事件已被截断。
{
"version": "0",
"id": "0948ba87-d3b8-c6d4-f2da-732a1example",
"detail-type": "Macie Finding",
"source": "aws.macie",
"account": "123456789012",
"time": "2021-04-29T23:12:15Z",
"region":"us-east-1",
"resources": [
],
"detail": {
"schemaVersion": "1.0",
"id": "64b917aa-3843-014c-91d8-937ffexample",
"accountId": "123456789012",
"partition": "aws",
"region": "us-east-1",
"type": "Policy:IAMUser/S3BucketEncryptionDisabled",
"title": "Encryption is disabled for the S3 bucket",
"description": "Encryption is disabled for the Amazon S3 bucket. The data in the bucket isn’t encrypted
using server-side encryption.",
"severity": {
"score": 1,
"description": "Low"
},
"createdAt": "2021-04-29T15:46:02Z",
"updatedAt": "2021-04-29T23:12:15Z",
"count": 2,
.
.
.以下事件模式匹配严重性分数为 1 且计数为 2 的任何事件。
{
"source": ["aws.macie"],
"detail-type": ["Macie Finding"],
"detail": {
"severity": {
"score": [1]
},
"count":[2]
}
}