Struct Eql

pub struct Eql<'a> { /* private fields */ }

Namespace client for Eql APIs

Implementations

impl<'a> Eql<'a>

pub fn new(transport: &'a Transport) -> Self

Creates a new instance of Eql

pub fn transport(&self) -> &Transport

pub fn delete<'b>(&'a self, parts: EqlDeleteParts<'b>) -> EqlDelete<'a, 'b>

Eql Delete API

Deletes an async EQL search by ID. If the search is still running, the search request will be cancelled. Otherwise, the saved search results are deleted.

pub fn get<'b>(&'a self, parts: EqlGetParts<'b>) -> EqlGet<'a, 'b>

Eql Get API

Returns async results from previously executed Event Query Language (EQL) search

pub fn get_status<'b>( &'a self, parts: EqlGetStatusParts<'b>, ) -> EqlGetStatus<'a, 'b>

Eql Get Status API

Returns the status of a previously submitted async or stored Event Query Language (EQL) search

pub fn search<'b>(&'a self, parts: EqlSearchParts<'b>) -> EqlSearch<'a, 'b, ()>

Eql Search API

Returns results matching a query expressed in Event Query Language (EQL)