Struct LogGroup 

pub struct LogGroup {
    pub id: Uuid,
    pub variables: HashMap<usize, Token>,
    /* private fields */
}

Represents a logical grouping of similar log records.

A LogGroup is characterized by a base event (a Record) and a collection of example records that match the group’s pattern. It also tracks variables (wildcards) within the log pattern.

Fields

id: Uuid

The unique identifier for this log group.

variables: HashMap<usize, Token>

A map of variable positions (offset) to their Token type within the event pattern.

Implementations

impl LogGroup

pub fn new(event: Record) -> Self

Creates a new LogGroup from an initial Record.

The provided event becomes the base record for the group, and is also added as the first example.

Arguments

• event - The initial Record that defines this log group.

Returns

A new LogGroup instance.

pub fn add_example(&mut self, rec: Record)

Adds a new example Record to the log group.

This method also attempts to discover new variables (wildcards) by comparing the new record with the group’s base event and updates the group’s variable map.

Arguments

• rec - The Record to add as an example.

pub fn event(&self) -> &Record

Returns a reference to the base event (Record) of this log group.

This record represents the generalized pattern of the log group.

Returns

A reference to the Record that is the base event.

pub fn base_record(&self) -> &Record

Returns a reference to the base record of the log group.

This is an alias for event().

Returns

A reference to the Record that is the base record.

pub fn examples(&self) -> &Vec<Record>

Returns a slice of the example records stored in this log group.

These are the actual log lines that have been clustered into this group.

Returns

A slice (&Vec<Record>) of the example records.

pub fn discover_variables(&self, rec: &Record) -> Result<Vec<Wildcard>, Error>

Compares a given Record with the log group’s base event to identify variable positions.

Positions where the tokens differ between the record and the base event, and are not already identified as variables, are considered new variables.

Arguments

• rec - The Record to compare against the base event.

Returns

A Result containing a Vec<Wildcard> representing the newly discovered variable positions, or an anyhow::Error if the comparison fails.

pub fn len(&self) -> usize

Returns the total number of example records stored in this LogGroup.

Returns

The number of examples as a usize.

pub fn is_empty(&self) -> bool

Checks if the log group contains any example records.

Returns

true if the log group has no examples, false otherwise.

pub fn get_examples(&self) -> Vec<&Record>

Returns a vector of references to the example records for this group.

Returns

A Vec<&Record> containing references to all example records.

pub fn get_id(&self) -> Uuid

Returns the unique identifier (Uuid) associated with this LogGroup.

This ID is typically the same as the Uuid of the Record that created the group.

Returns

The Uuid of the log group.

pub fn get_time(&self) -> DateTime<Utc>

Returns the creation timestamp of the base event in the LogGroup as a DateTime<Utc>.

This timestamp is derived from the Uuid of the base event.

Returns

A DateTime<Utc> representing the creation time of the base event.

Trait Implementations

impl Clone for LogGroup

fn clone(&self) -> LogGroup

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LogGroup

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for LogGroup

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the LogGroup for display.

This implementation provides a human-readable summary of the log group, including its ID, first seen timestamp, base event, number of examples, and number of wildcards.

Arguments

• f - The formatter to write into.

Returns

A fmt::Result indicating success or failure of the formatting operation.