Filtering event rules using customized JSON event patterns

Event rules are used to receive notifications about specific events. To apply additional filters to your event rules, you can customize event patterns for those rules. Advanced filtering options include:

• Suffix filtering - match against characters at the end of a value

• $or matching - use a single rule to check if conditions across several different fields are true

• Equals-ignore-case - ignore case sensitivity

This topic includes JSON samples for commonly used event patterns and additional information on the EventBridge console's rule builder. For more event pattern examples, see Content filtering in Amazon EventBridge event patterns in the Amazon EventBridge User Guide.

JSON samples for common use cases

CloudWatch alarm that specifies that alarmName must exist

The following JSON sample uses exists matching to match any event that has an alarmName field.

{
  "detail": {
    "alarmName": [ { "exists": true } ]
  }
}

Amazon EC2 instance state changed to "terminated", "stopping", "stopped", or "shutting-down"

The following JSON sample matches terminated, stopping, stopped, and shutting-down state changes for an Amazon EC2 instance.

{
  "detail": {
    "state": ["terminated", "stopping", "stopped", "shutting-down"]
  }
}

Amazon EC2 instance state change notification using $or matching

The following JSON sample matches running or terminated state changes for an Amazon EC2 instance.

{
  "detail": {
    "$or": [
      {
        "state": [
          "running"
        ]
      },
      {
        "state": [
          "terminated"
        ]
      }
    ]
  }
}

Using the EventBridge console's rule builder

For assistance while building your event patterns, you can use the EventBridge console's rule builder. Use the Event Pattern Builder and the in-place tester to try out your patterns.

Note

You can test event rules in Event Pattern Builder without creating the rule.

When you test an event pattern in Event Pattern Builder, remove the source and detail type fields from your event pattern.