Struct QueryBuilder 

pub struct QueryBuilder { /* private fields */ }

Query builder for constructing flexible event queries.

Supports building XPath queries with convenience methods while allowing raw XPath for advanced scenarios.

Implementations

impl QueryBuilder

pub fn new() -> Self

Create a new query builder.

pub fn xpath(self, xpath: impl Into<Cow<'static, str>>) -> Self

Set a raw XPath query expression.

When set, this takes precedence over other builder fields. Example: "Event/System[EventID=4688]"

pub fn level(self, level: EventLevel) -> Self

Filter by event level (1=Critical to 5=Verbose).

pub fn provider(self, name: impl Into<Cow<'static, str>>) -> Self

Filter by provider/source name.

pub fn event_id(self, id: u32) -> Self

Filter by specific event ID.

pub fn reverse(self) -> Self

Query in reverse order (newest to oldest).

Note: Not supported on Debug/Analytic channels or .evt files.

pub fn max_results(self, count: usize) -> Self

Limit maximum number of results returned.

pub fn with_event_data(self) -> Self

Parse EventData fields into the data HashMap.

When enabled, extracts fields from event XML. Common field names are cached as static strings for performance.

pub fn with_message(self) -> Self

Parse event message using publisher metadata.

When enabled, formats the event message using the provider’s message template. Returns None if publisher metadata is unavailable.

pub fn should_parse_event_data(&self) -> bool

Check if EventData parsing is enabled.

pub fn should_parse_message(&self) -> bool

Check if message parsing is enabled.

pub fn build_xpath(&self) -> String

Build the final XPath query string.

Returns the XPath expression that will be passed to Windows Event Log API. If raw XPath was set, returns that. Otherwise, builds XPath from builder fields.

pub fn is_reverse(&self) -> bool

Get whether query should be reversed.

pub fn max_results_limit(&self) -> Option<usize>

Get maximum results limit if set.

Trait Implementations

impl Clone for QueryBuilder

fn clone(&self) -> QueryBuilder

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for QueryBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for QueryBuilder

fn default() -> Self

Returns the “default value” for a type.