usiem/events/
ifield.rs

1use serde::{Deserialize, Serialize};
2
3use crate::prelude::{types::LogString, SiemField, SiemIp};
4
5#[derive(Serialize, Deserialize, Debug, Clone, Default)]
6pub enum PreStoredField<T> {
7    Invalid,
8    #[default]
9    None,
10    Some(T),
11}
12
13#[derive(Serialize, Deserialize, Debug, Clone, Default)]
14pub struct InternalField {
15    pub original: SiemField,
16    pub array: Box<PreStoredField<Vec<LogString>>>,
17    pub text: Box<PreStoredField<LogString>>,
18    pub nu64: Box<PreStoredField<u64>>,
19    pub ni64: Box<PreStoredField<i64>>,
20    pub nf64: Box<PreStoredField<f64>>,
21    pub ip: Box<PreStoredField<SiemIp>>,
22}
23
24impl From<SiemField> for InternalField {
25    fn from(val: SiemField) -> Self {
26        let mut ifield = InternalField {
27            original: val,
28            ..Default::default()
29        };
30        match &ifield.original {
31            SiemField::F64(v) => {
32                ifield.nf64 = Box::new(PreStoredField::Some(*v));
33            }
34            SiemField::I64(v) => {
35                ifield.ni64 = Box::new(PreStoredField::Some(*v));
36            }
37            SiemField::Date(v) => {
38                ifield.ni64 = Box::new(PreStoredField::Some(*v));
39            }
40            SiemField::U64(v) => {
41                ifield.nu64 = Box::new(PreStoredField::Some(*v));
42            }
43            SiemField::IP(v) => {
44                ifield.ip = Box::new(PreStoredField::Some(*v));
45            }
46            _ => {}
47        }
48        ifield
49    }
50}
usiem/events/ifield.rs

usiem/events/
ifield.rs
