Skip to main content

AnalysisOptions

Struct AnalysisOptions 

Source
pub struct AnalysisOptions {
    pub default_scope: Scope,
    pub default_event_type: Type,
    pub custom_types: HashSet<StrRef>,
    pub data_sources: FxHashMap<StrRef, Type>,
}
Expand description

Configuration options for static analysis.

This structure contains the type information needed to perform static analysis on EventQL queries, including the default scope with built-in functions and the type information for event records.

Fields§

§default_scope: Scope

The default scope containing built-in functions and their type signatures.

§default_event_type: Type

Type information for event records being queried.

§custom_types: HashSet<StrRef>

Custom types that are not defined in the EventQL reference.

This set allows users to register custom type names that can be used in type conversion expressions (e.g., field AS CustomType). Custom type names are case-insensitive.

§data_sources: FxHashMap<StrRef, Type>

Per-data-source type overrides.

When a query targets a named data source, this map is checked first. If a match is found, the associated type is used instead of default_event_type. Keys are case-insensitive data source names.

Trait Implementations§

Source§

impl Default for AnalysisOptions

Source§

fn default() -> AnalysisOptions

Returns the “default value” for a type. Read more

Auto Trait Implementations§

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.