match_on and match_with Operator Reference
Used to filter resources conditionally in match_on and match_with arrays. All objects in the array follow AND logic.
| Operator | Type | Description |
|---|---|---|
property |
String | (Required) The property to evaluate. Supports dot notation traversal (domain.owner). |
value |
Any | Exact equality check. Supports Tera. |
not |
Any | Inequality check. Supports Tera. |
contains |
String | Substring match for strings, or element match for arrays. Supports Tera. |
excludes |
String | Ensures substring or element is missing. Supports Tera. |
exists |
Boolean | Checks if property is present and not null. |
empty |
Boolean | Checks if property is missing, null, "", or []. |
greater |
Number | Strictly greater than (>). |
lower |
Number | Strictly less than (<). |
regexp |
String | Regular expression match. Supports Tera templating. |
expression |
String | Evaluates a Tera template directly; matches if result is exactly "true". |
or |
Array | Used to nest condition objects with logical OR (e.g., Disjunctive Normal Form). |
Notes on expression
- The template must render exactly the string
"true"to match — a common pattern is{% if <condition> %}true{% endif %}. - Inside
[[link_resources]]match_withexpressions, bothorigin_resourceandtarget_resourceare available; in other contexts typically onlyorigin_resource. - Tera’s
inoperator is not supported in these expressions and fails with a render error. Use tests instead:is containing(...)for substring/multi-value cell matching andis ending_with(...)for suffix matching.
# Multi-value cell: link when the algorithm name appears in the endpoint's `algorithms` list
{ expression = "{% if origin_resource.algorithms is containing(target_resource.name) %}true{% endif %}" }
# Suffix match: link a certificate to its parent domain
{ expression = "{% if origin_resource.name is ending_with(target_resource.name) %}true{% endif %}" }