Struct EveOptions 

#[non_exhaustive]
pub struct EveOptions {
    pub in_iface: String,
    pub include_flow: bool,
    pub include_anomalies: bool,
    pub include_stats: bool,
    pub severity_numeric: fn(Severity) -> u8,
    pub custom_anomaly_type: &'static str,
}

Available on crate features emit-eve and emit only.

Options for EveJsonWriter.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

in_iface: String

Interface name embedded as in_iface. Default empty — the field is omitted when empty.

include_flow: bool

Include event_type: "flow" records for Ended (default true).

include_anomalies: bool

Include event_type: "anomaly" for FlowAnomaly + TrackerAnomaly (default true).

include_stats: bool

Include event_type: "stats" for Tick. Default false — high cardinality; opt in for verbose pipelines.

severity_numeric: fn(Severity) -> u8

Map flowscope’s Severity to the EVE severity field (numeric 1–4, lower = more severe). Default: identity mapping — Critical=1, Error=2, Warning=3, Info=4 (Suricata’s convention).

custom_anomaly_type: &'static str

EVE anomaly.type value used by EveJsonWriter::write_owned_anomaly when the OwnedAnomaly doesn’t carry a flowscope_kind. Default "applayer" — Suricata’s convention for application- layer detection events.

Schema-permissive: downstream tooling tolerates any string. Override for downstream detector frameworks that classify on a different axis.

Trait Implementations

impl Clone for EveOptions

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EveOptions

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for EveOptions

fn default() -> Self

Returns the “default value” for a type.