match

The match operation evaluates a match pattern on each sequence to assign tags to specific sub-sequences of events. It is analogous to matching strings of characters in regular expressions, but is more powerful due to allowing IF clause conditions and with a more user-friendly syntax.

Syntax

match {<match pattern>}
  {if <match condition>}


<match pattern> = <state 1> >> <state 2> >> ...
<match condition> = <condition 1> and <condition 2> and ...
<state> = {<tag name>}({<event name include/exclude list>}){<quantifier>}
<event name include list> = <event name 1>|<event name 2>|...
<event name exclude list> = ^<event name 1>,<event name 2>,...
<quantifier> uses regular expression syntax = ONE OF
  *     - match zero or more times
  +     - match one or more times
  ?     - match zero or one time
  {n}   - match exactly n times
  {n,}  - match at least n times
  {n,m} - match from n to m times

Tag definitions

• Each element of the match pattern - tag - consists of a tag name, event name(s) enclosed in (), and a quantifier: Tag(event)quantifier. Tags are separated by the >> symbol.
• () brackets can contain one of the following:
  • (event) - one event name - match event with a specific name
  • () - empty - match event with any name
  • (event1 | event2 | ...) - list of included event names separated by | - match event with a name in the specified list
  • (^event1, event2, ...) - list of excluded event names prefixed by ^ and separated by , - match event with a name NOT in the specified list

Quantifiers

Quantifiers specify a range for the number of events to match to each tag and use the same syntax as regular expressions:

• none - exactly 1 match
• * - zero or more matches (optional tag)
• + - one or more matches
• ? - zero or one match (optional tag)
• {n} - exactly n matches
• {n,} - n or more matches
• {,m} - m or fewer matches (optional tag)
• {n,m} - between n and m matches

Each tag may use at most one quantifier.

Conditions

Syntax for IF clause conditions is the same as for the FILTER operation.

Tag shorthand

• Tags in the match pattern can be left without names if they don’t need to be referenced in the if clause or later SOL operations, for example: ... >> (event)+
• In many cases it is convenient to use match pattern shorthand by skipping (): - if tag has a name, it gets copied into the event name, for example: name+ becomes name(name)+ - if there is no tag name, () are added without an event name, for example: * becomes ()*

Special tags

• It is possible to match to the start or end of a sequence:
  • match start >> ... - has to start the match from the 1st event in a sequence
  • match ... >> end - has to end the match on the last event in a sequence

Examples

Match a single event

match event1

Match one of several events

match Tag(event1 | event2 | event3)

Match any event except a given event

match Tag(^event1)

Match any event except several specific events

match Tag(^event1, event2, event3)

Match two consecutive events

match event1 >> event2

Match two events with zero or more events in between

match event1 >> * >> event2

Match two events with at least one event in between

match event1 >> + >> event2

Optionally match an event

match event1?

Match zero or more occurrences of an event

match event1*

Match at least one occurrence of an event

match event1+

Match two occurrences of the same event

match First(event) >> * >> Second(event)

Match an event and give the tag a custom name

match Tag1(event1)

Match two events within a certain duration of each other

match event1 >> * >> event2
if duration(event1, event2) < 5min

Match from the start of a sequence

match start >> Event()

Match from the end of a sequence

match Event() >> end

Match events at start and end of sequence

match start >> event1 >> * >> event2 >> end

Explore several events before a specific event

match Before(){,5} >> event1

Explore several events after a specific event

match event1 >> After(){,5}

Match up to N events

match Span(){,N}

Match N or more events

match Span(){N,}

Match between M and N events

match Span(){M,N}

Match several events in any order

match Span(event1 | event2 | event3){3}
if length(unique(Span.name)) = 3

Match the last occurrence of an event

match LastOccurrence(event) >> (^event)* >> end

Find sequences without specific events

match start >> (^event1, event2)+ >> end

Match two events without specific events in between

match event1 >> (^event3, event4)* >> event2

Explore activity before a specific event by duration

match Before()* >> event1
if duration(Before, event1) <= 1h

Explore activity after a specific event by duration

match event1 >> After()*
if duration(event1, SUFFIX[0]) > 1h

Find occurrences of a value present in an array dimension

match event1
if 'value' in event1.array_dim1