Skip to main content

to_rule

Function to_rule 

Source
pub async fn to_rule(t: &Transport, selector: &str) -> Result<(String, Rule)>
Expand description

Resolve a selector like to_rule_id and return the stored rule too.

Reuse the first read only when it echoes the selector. Kibana matches rule_id through KQL, which decodes escapes, so r\\n can return the rule stored as r\n; that rule must be read again by its own rule_id.