Where condition
A find statement can specify a where clause that filters which events match the specified event pattern.
Note: You can specify a find where clause that applies to the event pattern, and you can also specify a without where clause that is part of a without clause. Any where clauses that you want to apply to the event pattern must precede any within or without clauses.
Specify the where keyword followed by a Boolean expression that refers to the events you are interested in. The Boolean expression must evaluate to true for the events to match.
The where clause is optional. You can specify zero, one or more where clauses.
Coassignment variables specified in the find or select statements are in scope in a find where clause. Also available in a find where clause are any parameter values and key values.
Example:
find Withdrawal:w1 -> Withdrawal:w2
where w2.country != w1.country {
log "Suspicious withdrawal: " + w2.toString() at INFO;
}