pub struct SessionBuilder { /* private fields */ }Expand description
SessionBuilder is a builder for Session objects.
It allows for the configuration of analysis options, such as declaring
functions (both regular and aggregate), event types, and custom types,
before building an EventQL parsing session.
Implementations§
Source§impl SessionBuilder
impl SessionBuilder
Sourcepub fn declare_func<'a>(
self,
name: &'a str,
args: impl Into<FunArgsBuilder<'a>>,
result: Type,
) -> Self
pub fn declare_func<'a>( self, name: &'a str, args: impl Into<FunArgsBuilder<'a>>, result: Type, ) -> Self
Declares a new function with the given name, arguments, and return type.
This function adds a new entry to the session’s default scope, allowing the parser to recognize and type-check calls to this function.
§Arguments
name- The name of the function.args- The arguments the function accepts, which can be converted intoFunArgs.result- The return type of the function.
Sourcepub fn declare_func_when<'a>(
self,
test: bool,
name: &'a str,
args: impl Into<FunArgsBuilder<'a>>,
result: Type,
) -> Self
pub fn declare_func_when<'a>( self, test: bool, name: &'a str, args: impl Into<FunArgsBuilder<'a>>, result: Type, ) -> Self
Conditionally declares a new function with the given name, arguments, and return type.
This function behaves like declare_func but only declares the function
if the test argument is true. This is useful for conditionally
including functions based on configuration or features.
§Arguments
test- A boolean indicating whether to declare the function.name- The name of the function.args- The arguments the function accepts, which can be converted intoFunArgs.result- The return type of the function.
Sourcepub fn declare_agg_func<'a>(
self,
name: &'a str,
args: impl Into<FunArgsBuilder<'a>>,
result: Type,
) -> Self
pub fn declare_agg_func<'a>( self, name: &'a str, args: impl Into<FunArgsBuilder<'a>>, result: Type, ) -> Self
Declares a new aggregate function with the given name, arguments, and return type.
Similar to declare_func, but marks the function as an aggregate function.
Aggregate functions have specific rules for where they can be used in an EQL query.
§Arguments
name- The name of the aggregate function.args- The arguments the aggregate function accepts.result- The return type of the aggregate function.
Sourcepub fn declare_agg_func_when<'a>(
self,
test: bool,
name: &'a str,
args: impl Into<FunArgsBuilder<'a>>,
result: Type,
) -> Self
pub fn declare_agg_func_when<'a>( self, test: bool, name: &'a str, args: impl Into<FunArgsBuilder<'a>>, result: Type, ) -> Self
Conditionally declares a new aggregate function.
Behaves like declare_agg_func but only declares the function
if the test argument is true.
§Arguments
test- A boolean indicating whether to declare the aggregate function.name- The name of the aggregate function.args- The arguments the aggregate function accepts.result- The return type of the aggregate function.
Sourcepub fn declare_event_type_when(self, test: bool, tpe: Type) -> Self
pub fn declare_event_type_when(self, test: bool, tpe: Type) -> Self
Conditionally declares the expected type of event records.
This type information is crucial for type-checking event properties
accessed in EQL queries (e.g., e.id, e.data.value).
The declaration only happens if test is true.
§Arguments
test- A boolean indicating whether to declare the event type.tpe- TheTyperepresenting the structure of event records.
Sourcepub fn declare_event_type(self) -> EventTypeBuilder
pub fn declare_event_type(self) -> EventTypeBuilder
Declares the expected type of event records.
This type information is crucial for type-checking event properties
accessed in EQL queries (e.g., e.id, e.data.value).
§Arguments
tpe- TheTyperepresenting the structure of event records.
Sourcepub fn declare_custom_type_when(self, test: bool, name: &str) -> Self
pub fn declare_custom_type_when(self, test: bool, name: &str) -> Self
Conditionally declares a custom type that can be used in EQL queries.
This allows the type-checker to recognize and validate custom types
that might be used in type conversions or record definitions.
The declaration only happens if test is true.
§Arguments
test- A boolean indicating whether to declare the custom type.name- The name of the custom type.
Sourcepub fn declare_custom_type(self, name: &str) -> Self
pub fn declare_custom_type(self, name: &str) -> Self
Declares a custom type that can be used in EQL queries.
This allows the type-checker to recognize and validate custom types that might be used in type conversions or record definitions.
§Arguments
name- The name of the custom type.
Sourcepub fn use_stdlib(self) -> Self
pub fn use_stdlib(self) -> Self
Includes the standard library of functions and event types in the session.
This method pre-configures the SessionBuilder with a set of commonly
used functions (e.g., mathematical, string, date/time) and a default
event type definition. Calling this method is equivalent to calling
declare_func and declare_agg_func for all standard library functions,
and declare_event_type for the default event structure.