pub struct Parser<'schema, 'record> { /* private fields */ }
Expand description
Represents a Parser
This structure provides a way to parse an ETW event (= extract its properties).
Because properties may have variable length (e.g. strings), a Parser
is only suited to a single EventRecord
Example
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
let schema = schema_locator.event_schema(record).unwrap();
let parser = Parser::create(record, &schema);
// There are several ways to define the type requested for `try_parse`
// It is possible to use type inference...
let property1: Option<String> = parser.try_parse("PropertyName").ok();
// ...or to use the turbofish operator
match parser.try_parse::<u32>("OtherPropertyName") {
Ok(_) => println!("OtherPropertyName is a valid u32"),
Err(_) => println!("OtherPropertyName is invalid"),
}
};
Implementations§
source§impl<'schema, 'record> Parser<'schema, 'record>
impl<'schema, 'record> Parser<'schema, 'record>
sourcepub fn create(
event_record: &'record EventRecord,
schema: &'schema Schema
) -> Self
pub fn create( event_record: &'record EventRecord, schema: &'schema Schema ) -> Self
Use the create
function to create an instance of a Parser
Arguments
schema
- The Schema from the ETW Event we want to parse
Example
let my_callback = |record: &EventRecord, schema_locator: &SchemaLocator| {
let schema = schema_locator.event_schema(record).unwrap();
let parser = Parser::create(record, &schema);
};
sourcepub fn try_parse<T>(&self, name: &str) -> Result<T, ParserError>where
Parser<'schema, 'record>: TryParse<T>,
pub fn try_parse<T>(&self, name: &str) -> Result<T, ParserError>where Parser<'schema, 'record>: TryParse<T>,
Return a property from the event, or an error in case the parsing failed.
You must explicitly define T
, the type you want to parse the property into.
In case this type is not compatible with the ETW type, ParserError::InvalidType
is returned.