Enum EqlQueryPayloadV3 

pub enum EqlQueryPayloadV3 {
    SteVec(SteVecQueryPayloadV3),
    Encrypted(EncryptedQueryPayloadV3),
    Selector(String),
}

EQL v3 query operand — the query-side counterpart of EqlCiphertextV3.

Two shapes: a scalar operand {v, i, <term>} (enveloped, no k/c) for the eql_v3.query_<name> twins, or the bare jsonb containment needle {sv: [{s, hm|op}]} for eql_v3.query_jsonb (a containment operand is never enveloped).

Variants

SteVec(SteVecQueryPayloadV3)

Bare jsonb containment needle {sv: [{s, hm|op}]}. Listed first: it is the only shape carrying sv, so untagged matching is unambiguous.

Encrypted(EncryptedQueryPayloadV3)

Scalar query operand {v, i, hm?, bf?, ob?, op?} (an object).

Selector(String)

A bare tokenized-selector hash (hex) for a jsonb path query (->/->>). Unlike the other variants it is not an encrypted operand — v3 has no encrypted-selector envelope; the selector is used directly as text. Serializes as a bare JSON string, so untagged matching is unambiguous against the two object variants above.

Trait Implementations

impl Debug for EqlQueryPayloadV3

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for EqlQueryPayloadV3

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for EqlQueryPayloadV3

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.