Without condition
In a find statement, a without clause specifies an event type whose presence prevents a match.
Specify the without keyword followed by an event type coassigned to an identifier.
An event type that you specify in a without clause must be specified in the inputs block of the query. A pattern can specify zero, one, or more without clauses.
Optionally, after each without clause, you can specify one where clause, which is referred to as a without where clause to distinguish it from a find where clause. When a where clause is part of a without clause:
The Boolean expression must evaluate to
true for the presence of the specified event to prevent a match. In other words, when the Boolean expression evaluates to
false, then there can be a match even when the specified event is in the window.
The
where clause applies to the event specified in its
without clause.
The Boolean expression can refer to parameters, coassignment identifiers in the event pattern, and the coassignment identifier in the
without clause.
A without clause cannot use the -> or and pattern operators. However, you can specify multiple without clauses. If there are multiple without clauses each one can refer to only its own coassignment and not coassignments in other without clauses. However, all without clauses can make use of the pattern's standard coassignments.
If there are multiple without clauses, a matching event for any one of them prevents a pattern match. Multiple without clauses can use the same type and the same coassignment, which is useful only when their where conditions are different.
Typically, a without where clause references the event in its without clause, but this is not a requirement.
Optionally, after each
without clause, you can specify a
between clause, which lists two or more coassigned events or
wait operators. For an event to cause a match, the type specified in the
without clause cannot be added to the window between the points specified in the
between clause. See
Between clause.
Any without clauses must be after any find where clauses and within clauses. If you specify both optional clauses, the without where clause must be before the between clause.
Example:
find OuterDoorOpened as od -> InnerDoorOpened as id
where od.user = id.user
without SecurityCodeEntered as sce where od.user = sce.user {
emit Alert("Intruder "+id.user);
}