Struct ferrisetw::parser::Parser

pub struct Parser<'schema, 'record> { /* private fields */ }

Represents a Parser

This structure provides a way to parse an ETW event (= extract its properties). Because properties may have variable length (e.g. strings), a Parser is only suited to a single EventRecord

Example

let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let parser = Parser::create(record, &schema);

    // There are several ways to define the type requested for `try_parse`
    // It is possible to use type inference...
    let property1: Option<String> = parser.try_parse("PropertyName").ok();

    // ...or to use the turbofish operator
    match parser.try_parse::<u32>("OtherPropertyName") {
        Ok(_) => println!("OtherPropertyName is a valid u32"),
        Err(_) => println!("OtherPropertyName is invalid"),
    }
};

Implementations

impl<'schema, 'record> Parser<'schema, 'record>

pub fn create( event_record: &'record EventRecord, schema: &'schema Schema ) -> Self

Use the create function to create an instance of a Parser

Arguments

• schema - The Schema from the ETW Event we want to parse

Example

let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
    let schema = schema_locator.event_schema(record).unwrap();
    let parser = Parser::create(record, &schema);
};

pub fn try_parse<T>(&self, name: &str) -> Result<T, ParserError>where Parser<'schema, 'record>: TryParse<T>,

Return a property from the event, or an error in case the parsing failed.

You must explicitly define T, the type you want to parse the property into.
In case this type is not compatible with the ETW type, ParserError::InvalidType is returned.