Use "any" when you want to flag an event if even one condition is true. This is the most common use case in SPAN.
Even one issue is enough → use "any"
Simple thinking: "If anything looks wrong, flag it."
Use "all" when multiple conditions together define a situation.
Both must be true → use "all"
Simple thinking: "All conditions together define the rule."
In SPAN, rules are mainly used to detect issues.
So it's best to keep: event.type = "flagged"
This keeps your workflow simple and consistent. Every time something looks incorrect, the system flags it. No confusion, no multiple action types.
This is one of the most important tips. Whenever a rule flags an event, the user will see the reason.
So make sure it is:
Good examples:
Avoid vague messages like "Error detected".
Goal: The reviewer should instantly understand what went wrong.
These are used when working with numbers like duration, time, or counts.
Here are the main ones:
These are useful when:
Example thinking:
"Duration should not be less than 0.1"
"Start time should not be greater than end time"
These are useful when working with labels, categories, or lists.
Common ones include:
These are especially useful for validating:
Example thinking:
"Labels should not contain 'serve_error'"
"Primary category should be one of these values"
Facts are simply the event data you can check.
In SPAN, the most commonly used facts are:
Time-related
Tag-related
Category-related
You don’t need to use all of them - just pick what is relevant to your workflow.
Instead of starting with JSON, start with a simple thought: "What mistake do I want to catch?"
Then convert it:
That’s all a rule is.
Writing rules in SPAN is not about coding - it's about clarity. You are simply defining what "incorrect" looks like in your workflow and letting the system check it automatically. Start with a few simple rules. As you observe patterns, keep improving them.
Over time, these small checks will:
And that's what makes rules such a powerful feature in SPAN.