AWS Eventbridge规则能否匹配数组内的对象？

Question

我将为您进行中文翻译，以下是翻译结果：

我正在尝试使用事件桥规则匹配事件。但是，如果事件的数组包含具有特定属性的对象，则需要匹配该事件，我不知道如何做到这一点。

一个示例事件：

{
    "version": "0",
    "id": "396bfea8-6311-c1ab-44cf-d44d93014a89",
    "detail-type": "ExampleEvent",
    "source": "example.com",
    "account": "207772098559",
    "time": "2020-05-31T19:44:55Z",
    "region": "eu-west-1",
    "resources": [],
    "detail": {
        "Id": "2fbf7f1b0b0f462ba16b6076812f1b77",
        "Data": {
            "entities": [
                {
                    "entityType": "task",
                    "action": "update",
                    "entityId": "bbf74ec6-8762-48d6-b09f-23a97834fc2f"
                },
                {
                    "entityType": "note",
                    "action": "update",
                    "entityId": "bbf74ec6-8762-48d6-b09f-23a97834fc2f"
                }
            ]
        }
    }
}

我希望规则能匹配实体集合中包含任何同时具有任务实体类型和更新动作的项目。我想象它看起来像下面这样，但是这会出现错误“不被识别的匹配类型entityType”，因为它认为数组内部的对象意味着我正在尝试使用支持的匹配类型之一。

{
    "source": [
        "example.com"
    ],
    "detail-type": [
        "ExampleEvent"
    ],
    "detail": {
        "Data": {
            "entities": [
                {
                    "entityType": [
                        "Task"
                    ],
                    "action": [
                        "update"
                    ]
                }
            ]
        }
    }
}

- cnash

---

Eventbridge支持使用模式进行基于内容的过滤，包括对数组的支持。你看过了吗？ - undefined

是的，我已经查阅了文档并尝试过了。问题中的第二个代码块是我对事件过滤模式的尝试。问题在于数组示例只展示了简单的数组匹配，例如："items": [ "item1", "item2" ]会被匹配为"items": [ "item1" ]但是如何匹配以下结构呢？"items": [ { "key" : "item1" }, { "key" : "item2" } ] - undefined

@cnash你解决了这个问题吗？ - undefined

还没有。我最终使用了一个Lambda函数来更详细地解析事件并实现我想要的功能。虽然我仍然希望避免这样做，但是我还没有时间去进一步研究。 - undefined

Answer 1

希望我回答了你的问题，而你并不是试图从事件中提取单个实体，相反，我认为你是在问如何匹配此事件。

这是对象数组的匹配事件。我删除了数组是匹配事件，并将Task实体类型过滤器转换为小写，因为它是区分大小写的。

{
  "source": [
    "example.com"
  ],
  "detail-type": [
    "ExampleEvent"
  ],
  "detail": {
    "Data": {
      "entities": {
        "entityType": [
          "task"
        ],
        "action": [
          "update"
        ]
      }

    }
  }
}

例子2：

这是另一个更嵌套且混合数组和对象的示例。正如您所看到的，它对待数组和对象相同。这是一个产生高磁盘空间的Redshift警报。

{
  "version": "0",
  "id": "c4c1c1c9-6542-e61b-6ef0-8c4d36933a92",
  "detail-type": "CloudWatch Alarm State Change",
  "source": "aws.cloudwatch",
  "account": "123456789012",
  "time": "2019-10-02T17:04:40Z",
  "region": "us-east-1",
  "resources": ["arn:aws:cloudwatch:us-east-1:123456789012:alarm:ServerMemoryTooHigh"],
  "detail": {
    "alarmName": "ServerDiskSpaceTooHigh",
    "configuration": {
      "description": "Goes into alarm when server Disk Space utilization is too high!",
      "metrics": [{
        "id": "30b6c6b2-a864-43a2-4877-c09a1afc3b87",
        "metricStat": {
          "metric": {
            "dimensions": {
              "InstanceId": "i-12345678901234567"
            },
            "name": "PercentageDiskSpaceUsed",
            "namespace": "AWS/Redshift"
          },
          "period": 300,
          "stat": "Average"
        },
        "returnData": true
      }]
    },
    "previousState": {
      "reason": "Threshold Crossed: 1 out of the last 1 datapoints [0.0666851903306472 (01/10/19 13:46:00)] was not greater than the threshold (50.0) (minimum 1 datapoint for ALARM -> OK transition).",
      "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-01T13:56:40.985+0000\",\"startDate\":\"2019-10-01T13:46:00.000+0000\",\"statistic\":\"Average\",\"period\":300,\"recentDatapoints\":[0.0666851903306472],\"threshold\":50.0}",
      "timestamp": "2019-10-01T13:56:40.987+0000",
      "value": "OK"
    },
    "state": {
      "reason": "Threshold Crossed: 1 out of the last 1 datapoints [99.50160229693434 (02/10/19 16:59:00)] was greater than the threshold (50.0) (minimum 1 datapoint for OK -> ALARM transition).",
      "reasonData": "{\"version\":\"1.0\",\"queryDate\":\"2019-10-02T17:04:40.985+0000\",\"startDate\":\"2019-10-02T16:59:00.000+0000\",\"statistic\":\"Average\",\"period\":300,\"recentDatapoints\":[99.50160229693434],\"threshold\":50.0}",
      "timestamp": "2019-10-02T17:04:40.989+0000",
      "value": "ALARM"
    }
  }
}

这里是匹配的事件：

{
  "detail-type": ["CloudWatch Alarm State Change"],
  "source": ["aws.cloudwatch"],
  "detail": {
    "configuration": {
      "metrics": {
        "metricStat": {
          "metric": {
            "name": ["PercentageDiskSpaceUsed"],
            "namespace": ["AWS/Redshift"]
          }
        }
      }
    },
    "state": {
      "value": ["ALARM"]
    }
  }
}

- vfrank66