Struct SessionBuilder 

pub struct SessionBuilder { /* private fields */ }

SessionBuilder is a builder for Session objects.

It allows for the configuration of analysis options, such as declaring functions (both regular and aggregate), and event types before building an EventQL parsing session.

Implementations

impl SessionBuilder

pub fn declare_func<'a>( &mut self, name: &'a str, args: impl Into<FunArgsBuilder<'a>>, result: Type, )

Declares a new function with the given name, arguments, and return type.

This function adds a new entry to the session’s default scope, allowing the parser to recognize and type-check calls to this function.

Arguments

• name - The name of the function.
• args - The arguments the function accepts, which can be converted into FunArgs.
• result - The return type of the function.

pub fn declare_agg_func<'a>( &mut self, name: &'a str, args: impl Into<FunArgsBuilder<'a>>, result: Type, )

Declares a new aggregate function with the given name, arguments, and return type.

Similar to declare_func, but marks the function as an aggregate function. Aggregate functions have specific rules for where they can be used in an EQL query.

Arguments

• name - The name of the aggregate function.
• args - The arguments the aggregate function accepts.
• result - The return type of the aggregate function.

pub fn set_default_event_type(&mut self, tpe: Type)

Conditionally declares the expected type of event records.

This type information is crucial for type-checking event properties accessed in EQL queries (e.g., e.id, e.data.value). The declaration only happens if test is true.

Arguments

• test - A boolean indicating whether to declare the event type.
• tpe - The Type representing the structure of event records.

pub fn declare_type(&mut self) -> EventTypeBuilder<'_>

Declares the expected type of event records.

This type information is crucial for type-checking event properties accessed in EQL queries (e.g., e.id, e.data.value).

Arguments

• tpe - The Type representing the structure of event records.

pub fn use_stdlib(self) -> Self

Includes the standard library of functions and event types in the session.

This method pre-configures the SessionBuilder with a set of commonly used functions (e.g., mathematical, string, date/time) and a default event type definition. Calling this method is equivalent to calling declare_func and declare_agg_func for all standard library functions, and declare_event_type for the default event structure.

pub fn build(self) -> Session

Builds the Session object with the configured analysis options.

This consumes the SessionBuilder and returns a Session instance ready for tokenizing, parsing, and analyzing EventQL queries.

Trait Implementations

impl Default for SessionBuilder

fn default() -> SessionBuilder

Returns the “default value” for a type.