Acting on pattern matches
When a query finds a set of events that matches the specified pattern it executes the statements in its find block. The find block specifies one or more statements that operate on the matching event(s). The items available in a find block include:
Any parameters defined in the
parameters section.
Coassignment variables specified in the event pattern.
In the case of an aggregating find statement, only the projection expression can use the coassignments from the pattern. The find block can use projection coassignments, but it cannot use coassignments from the pattern.
Key values.
Actions that are defined in the same query after the
find block. Any expression in the
find statement pattern or block can reference an action defined after the
find block.