A find statement can specify conditions that determine whether there is a match for the specified event pattern. The following table provides an overview of the conditions you can specify.

A where clause filters which events match. A where clause consists of the where keyword followed by a Boolean expression that refers to the events you are interested in.

Coassignment variables specified in the find statement are in scope in the find where clause. Also available in the find where clause are any parameter values and key values. However, each where clause cannot use or-terms (coassignments that are not required as they are on one side of an or operator in the pattern) from both sides of an or operator in the pattern. Each where clause can only use coassignments from at most one side of every or operator in the pattern. Different where clauses can use coassignments from different sides of an or operator (see Query or operator). Thus, when writing where clauses which apply to either side of an or, use separate where clauses for each condition. They cannot be combined into a single where clause with an or or and operator in the where clause; they may require both sides to be evaluated.

For example, instead of

write the following:

For where clauses that do not use any coassignments, all of the Boolean expressions must evaluate to true for the events to match.

For where clauses that use or-terms, they only apply if the events they make use of are matched by the pattern. If they use or-terms that have not been matched by the pattern, then those where clauses are ignored as they cannot be evaluated.

All of the where clauses that can be evaluated must be true for the pattern to match. If a single where clause combines (with an and or or operator) conditions on an or-term and a normal coassignment, then the entire where clause is ignored if the or-term is not matched.

The where clause is optional. You can specify zero, one or more where clauses.

A within clause sets the time period during which events in the match set must have been added to their windows. A pattern can specify zero, one, or more within clauses. These must appear after any find where clauses and before any without clauses. The format of a within clause is as follows. The between clause is optional.

The durationExpression must be a time literal (such as 2 min 3 seconds) or it must evaluate to a float value. A float expression can use constants and parameters. It indicates a number of seconds.

For example, consider the following find statement:

If specified, the between clause lists two or more items. Each item can be a coassigned event in the pattern. A wait coassignment can also be specified. These items define a range. See Query condition ranges. For example:

Now assume that the following events arrive:

As mentioned earlier, a find statement can specify multiple within clauses. This is useful when the pattern of interest refers to multiple events and you specify a between range as part of each within clause. When you specify multiple within clauses they must all be satisfied for there to be a match.

A without clause specifies event types, which must be specified in the inputs block of the query, whose presence prevents a match. For example, if a potential match set contains 3 events, it can be a match only if a type specified in a without clause was not added to a window neither after the first event nor before the third event. Any event type that can be used in the find pattern can be used in the without clause.

Optionally, after each without clause, you can specify one where clause, which is referred to as a without where clause to distinguish it from a find where clause. The following table compares find where clauses and without where clauses.

The absence of an event of a type specified in a without clause has the same effect as the presence of an event for which the without where clause evaluates to false.

In addition to being able to refer to parameters and coassignment identifiers in the event pattern, a without where clause can refer to the one event mentioned in its without clause. When a without where clause evaluates to true, the presence of the without event prevents a match. If a without where clause is false, then that without event instance is ignored; that is, a match is possible.

A without clause cannot use the -> or and pattern operators. However, you can specify multiple without clauses. If there are multiple without clauses each one can refer to only its own coassignment and not coassignments in other without clauses. However, all without clauses can make use of the pattern's standard coassignments, such as od.user in the example at the end of this topic.

If there are multiple without clauses a matching event for any one of them prevents a pattern match. Multiple without clauses can use the same type and the same coassignment, which is useful only when their where conditions are different.

Typically, a without where clause references the event in its without clause, but this is not a requirement.

Optionally, after each without clause, you can specify a between clause, which lists two or more coassigned events. It can also list a wait coassignment. For an event to cause a match, the type specified in the without clause cannot be added to the window between the points specified in the between clause. See Query condition ranges.

Any without clauses must be after any find where clauses and within clauses. If you specify both optional clauses, the without where clause must be before the between clause.

When a without clause includes both optional clauses, where and between, the format looks like this:

As mentioned previously, a find where clause applies to the event pattern while a without where clause applies to the event specified in its without clause. The following table shows the resulting behavior according to the type of the where clause and the value of its Boolean expression:

Consider the following find statement:

Now suppose the following events arrive: