Struct EveJsonWriter 

pub struct EveJsonWriter<W>
where
    W: Write,
{ /* private fields */ }

Available on crate features emit-eve and emit only.

Suricata EVE JSON writer. One JSON object per line.

Each write_event call: clears the per-event JSON Map, fills the required + optional fields, calls serde_json::to_writer straight into the sink, then writes the trailing newline. No intermediate string allocation per event.

Implementations

impl<W> EveJsonWriter<W>

where W: Write,

pub fn new(sink: W) -> Self

Construct with default options.

pub fn with_options(sink: W, options: EveOptions) -> Self

Construct with custom options.

pub fn write_event<K>(&mut self, ev: &FlowEvent<K>) -> Result<()>

where K: KeyFields,

Write one event. Skipped variants per EveOptions produce no output and return Ok(()).

pub fn flush(&mut self) -> Result<()>

Flush the underlying sink.

pub fn finish(self) -> Result<W>

Flush and recover the underlying sink.

pub fn write_owned_anomaly(&mut self, a: &OwnedAnomaly) -> Result<()>

Emit event_type: "anomaly" from a canonical crate::OwnedAnomaly.

Schema mapping:

• kind → anomaly.event
• severity → severity (via EveOptions::severity_numeric)
• (src_ip, src_port, dest_ip, dest_port, proto) → top-level fields (each omitted if None)
• observations → anomaly.labels.<label>: <value>
• metrics → anomaly.metrics.<label>: <number>
• anomaly.type ← EveOptions::custom_anomaly_type unless flowscope_kind.is_some(), in which case the typed kind’s crate::AnomalyFields::anomaly_type takes precedence (for bridged events).

See crate::OwnedAnomaly for canonical detector- shaped emission. Use Self::write_event for flowscope-internal FlowEvent variants.