Skip to main content
Question

Match events without an 'additional fields' entry

  • July 29, 2025
  • 5 replies
  • 46 views

jeff_bryner
Forum|alt.badge.img+2

We get chrome events for password reuse which are helpful and mostly include and ‘additional field’ entry for the category of URL

 

additional.fields["localized_url_category"] = "INTERNET_AND_TECHNOLOGY__WEB_DESIGN_AND_DEVELOPMENT"

 

Is it possible to filter out ones that have a category? i.e. only select ones that are unknown? 

 

I’ve tried 

 

$e.additional.fields["LOCALIZED_URL_CATEGORY"] !=/_+/

 

since most categories have an underscore, but it still selects unknowns. I’ve also tried =””  but it doesn’t appear to affect the selection criteria. 

5 replies

AbdElHafez
Staff
Forum|alt.badge.img+12
  • Staff
  • August 1, 2025

You could try ; $e.additional.fields["LOCALIZED_URL_CATEGORY"] !=/_{1}/ , this will exclude all entries with only one underscore “_” .


jeff_bryner
Forum|alt.badge.img+2
  • Author
  • New Member
  • August 1, 2025

Thanks! 
Tried that and I still get events where there are categories as well as events without categories. 

I’m thinking the field isn’t really searchable?


AbdElHafez
Staff
Forum|alt.badge.img+12
  • Staff
  • August 1, 2025

No it is searchable even using the key-value pairs separately, e.g; additional.fields.key = "LOCALIZED_URL_CATEGORY" AND additional.fields.value.string_value != /_{1}/


AbdElHafez
Staff
Forum|alt.badge.img+12
  • Staff
  • August 1, 2025

Could you share a sample of the field values from the query $e.additional.fields["LOCALIZED_URL_CATEGORY"] !=/_{1}/   ?
Is this field multi-valued ? 


jeff_bryner
Forum|alt.badge.img+2
  • Author
  • New Member
  • August 1, 2025

Oh, this worked; pulled events where there is no category: 

 

metadata.product_event_type = "PASSWORD_REUSE"

AND

additional.fields.key != "LOCALIZED_URL_CATEGORY"

 

Thanks for the help!