Event Group

An event group describes the criteria events should meet to be part of a rule.

Event groups can be of the following types:

Type Description
Required The rule cannot be triggered if no event matches this event group. This is the default type.
Excluded The rule is NOT triggered if an event matches this event group.
Optional If any events match this event group and if other criteria are met, they are part of the triggering rule.

An event group can have the following parts:

  • Conditions on the number of events
  • A filtering clause
  • A grouping clause
  • A set of having clause
  • Upper limits on the number of groups and events that can be created while this rule is run. This is a safeguard against a memory overflow.

An event group is defined as follows: 

Event Group <identifier> [ Is ( Required | Optional | Excluded ) ] [ With Delayed Evaluation ]
[ At Least <integer> Events ]
[ At Most <integer> Events ]
[ <identifier environment> ]
[ Where <expression> ]
[ With The Same <expression> [ As <identifier> ]
( , <expression> [ As <identifier> ] )* ]
( Having <having clause> )*
[ Limits <integer> Groups And <integer> Events ]

When the At Least parameter is defined, it requires at least an integer more than 0. If it is omitted, this implies at least 1.

If the Where clause is defined, it must match the expressions. It is evaluated as a Boolean. For details, see Expressions.

Default Limits are 10000 groups and 100000 events.