Struct SchemaClassifier 

pub struct SchemaClassifier { /* private fields */ }

Recognizes the schema of parsed events from a set of signatures.

Signatures are sorted once at construction (specificity descending, then name ascending) so classify returns the best match with a single in-order scan.

Implementations

impl SchemaClassifier

pub fn new(signatures: Vec<SchemaSignature>) -> SchemaClassifier

Build a classifier from an explicit signature set.

pub fn builtin() -> SchemaClassifier

Build a classifier from the built-in signatures only.

pub fn with_user_signatures(user: Vec<SchemaSignature>) -> SchemaClassifier

Build a classifier from the built-ins plus user-supplied signatures. User signatures are added to (not replacing) the built-ins; a user signature with a higher specificity than a built-in wins on overlap.

pub fn classify<E>(&self, event: &E) -> Option<SchemaMatch>

where E: Event + ?Sized,

Classify an event. Returns the highest-specificity matching schema, or None when the event matches no signature (“unknown”).

pub fn classify_all<E>(&self, event: &E) -> Vec<String>

where E: Event + ?Sized,

All matching schema names for an event, most specific first. Useful for tuning signatures (seeing what else an event could match). Deduplicated by name while preserving order.

pub fn schema_names(&self) -> Vec<&str>

Distinct schema names this classifier can produce, most specific first.

Trait Implementations

impl Clone for SchemaClassifier

fn clone(&self) -> SchemaClassifier

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SchemaClassifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for SchemaClassifier

fn default() -> SchemaClassifier

Returns the “default value” for a type.