As powerful as regular expression matching is, there are times when you need a more freeform expression to precisely select the events in which you are interested. Instead of following the eventex type with a series of attribute-regex pairs to match attributes, the type can be followed with a single expression. If the type and domain match and the expression's value is true, then the eventex matches. Such expressions actually have the full power of expressions. Attribute names can cannot be used as variables in the expression, but attribute expressions actually have the full power of expressions; just be careful to remember that normal identifiers are always interpreted as event attributesevent attribute values must be obtained using the event:attr function.
Attribute expressions are introduced to a primitive eventex with the where keyword. For example, the following two eventexes mean the same thing:
| Code Block |
|---|
| language | javascript |
|---|
| theme | Confluence |
|---|
|
select when web pageview where event:attr("url").match(re#/archives/\d{4}/#)
select when web pageview url re#/archives/\d{4}/# |
...
| Code Block |
|---|
| language | javascript |
|---|
| theme | Confluence |
|---|
|
select when web pageview where event:attr("url").extract(re#/archives/(\d{4})/#).head() > 2003 |
...
| Code Block |
|---|
| language | javascript |
|---|
| theme | Confluence |
|---|
|
select when web pageview where event:attr("url").extract(re#/archives/(\d{4})/#).head() > 2003 &&
event:attr("title").match("Utah") |
Attribute expressions provide a powerful and flexible way to match individual events.