As powerful as regular expression matching is, there are times when you need a more freeform expression to precisely select the events in which you are interested. Instead of following the eventex type with a series of attribute-regex pairs to match attributes, the type can be followed with a single expression. If the type and domain match and the expression's value is true, then the eventex matches. Attribute names can be used as variables in the expression.
...