Enum SchemaPredicate 

pub enum SchemaPredicate {
    FieldPresent(String),
    FieldAbsent(String),
    AnyOf(Vec<String>),
    Equals {
        field: String,
        value: String,
    },
    Matches {
        field: String,
        regex: Regex,
    },
    HasAnyField,
}

A single condition over a parsed event used to recognize a schema.

Field names use the same dot-notation as Event::get_field, so nested shapes like Event.System.EventID or ecs.version work whether the event is nested or carries flattened dotted keys.

Variants

FieldPresent(String)

The named field is present (any non-absent value, including null).

FieldAbsent(String)

The named field is absent.

AnyOf(Vec<String>)

At least one of the named fields is present.

Equals

The field is present and its string-coerced value equals value (ASCII case-insensitive).

Fields

field: String

value: String

Matches

The field is present and its string-coerced value matches regex.

Fields

field: String

regex: Regex

HasAnyField

The event has at least one structured field. Used by the generic_json fallback to distinguish structured events from field-less ones (raw text, empty objects), which stay “unknown”.

Trait Implementations

impl Clone for SchemaPredicate

fn clone(&self) -> SchemaPredicate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SchemaPredicate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.