As powerful as regular expression matching is, there are times when you need a more freeform expression to precisely select the events in which you are interested. Instead of following the eventex type with a series of attribute-regex pairs to match attributes, the type can be followed with a single expression. If If the type and domain match and the expression's value is true, then the eventex matches. Attribute names can be used as variables in the expression, but attribute expressions actually have the full power of expressions, for good or bad.
Attribute expressions are introduced to a primitive eventex with the where keyword. For example, the following two eventexes mean the same thing:
...