Transactions with conditional Endswidth or different ordering of events.

[ocallender]

I have a series of events that always start with EventTypeName = "Node Down" but there are three scenarios I'm trying to capture.

1. "Node Down" --> "Node Up"

2. "Node Down" --> "Node Rebooted" ---> "Node Up"

3. "Node Down" --> "Node Up" --> "Node Rebooted"

Is there a way to capture all three of these scenarios?   I'm trying to categorize transactions based on whether or not a Node Rebooted event is present in the transaction or not present.

I tried using OR with endswith but it only matches the first event.