Event operators combine event expressions into even more complex event expressions using operators that relate subexpressions sub-expressions to each other. Bear in mind that you're not interested in a forensic exercise in which you examine logs of event occurrences. Rather, you apply event patterns to live, real-time event streams. This colors the semantics slightly.
The following binary event operators are available:
A or B. Eventex A matches or eventex B matches. There is no expectation of order. If either subexpression matches, then the entire expression matches. In the following example, the expression would match if the user viewed a page with the string "bar.html" in its URL or received a phone call from a number with area code 801.
...
A and B. Eventex A matches and eventex B matches in any order. In the following example, the expression would match if the user viewed a page that contained the string "bar.html" in its URL and viewed another page that contained the string "foo.html." There are two events, both of which must occur independently for this match to occur. Once a match occurs the state machine resets, so you'll need to see both urls again before another match.
| Code Block | ||||
|---|---|---|---|---|
| ||||
select when web pageview url re#bar.html#
and web pageview url re#foo.html# |
...