What is the purpose of the match section in a YARA-L rule?

The match section defines which fields to group by when correlating across multiple events in a multi-event rule, similar in concept to a GROUP BY clause in SQL — it's what lets a rule say "treat all these events as related if they share the same user" rather than evaluating every event in complete isolation.

events:
  $fail.metadata.event_type = "USER_LOGIN"
  $fail.security_result.action = "BLOCK"
  $fail.target.user.userid = $user

match:
  $user over 10m

condition:
  #fail > 5

In the example above, match: $user over 10m tells the rule to group failed login events by the shared $user value within a rolling 10-minute window, which is what makes the condition section's count check (#fail > 5) meaningful — it's counting failed logins per user, within that window, rather than a single global count across every user in the entire dataset.

Without a match section, a multi-event rule has no defined grouping key, which is why it's specifically required for rules that need to correlate related events belonging to the same entity or timeframe — simple single-event rules that only ever reference one event variable typically don't need a match section at all, since there's nothing to group.