Struct FlowEventNdjsonWriter 

pub struct FlowEventNdjsonWriter<W: Write> { /* private fields */ }

Available on crate features emit-ndjson and emit only.

Newline-delimited JSON writer for FlowEvent streams.

Implementations

impl<W: Write> FlowEventNdjsonWriter<W>

pub fn new(sink: W) -> Self

Construct with default options.

pub fn with_options(sink: W, options: NdjsonOptions) -> Self

Construct with custom options.

pub fn write_lifecycle<T, K>(&mut self, ev: &T) -> Result<()>

where T: LifecycleEvent<K>, K: Serialize + Clone,

Emit any LifecycleEvent — both the tracker’s FlowEvent and the typed driver’s Event (issue #97). The Event is projected to its FlowEvent form first, so NDJSON output keeps one schema regardless of source. Events with no projection (e.g. Event::ParserClosed) are skipped.

pub fn write_event<K>(&mut self, ev: &FlowEvent<K>) -> Result<()>

where K: Serialize,

Write one event to the sink. Skipped variants (per NdjsonOptions) produce no output.

pub fn write_owned_anomaly(&mut self, a: &OwnedAnomaly) -> Result<()>

Write a canonical crate::OwnedAnomaly as one NDJSON record.

Requires the serde feature on flowscope; OwnedAnomaly derives Serialize behind that feature. Output shape:

{
  "kind": "PortScanTRW",
  "severity": "warning",
  "ts": { "sec": 1700000000, "nsec": 0 },
  "src_ip": "10.0.0.1",
  "src_port": 33000,
  ...,
  "observations": [["verdict", "scanner"]],
  "metrics": [["log_likelihood", 3.7]],
  "flowscope_kind": null
}

pub fn write_flow_record(&mut self, rec: &FlowRecord) -> Result<()>

Available on crate feature ipfix only.

Write one finalised crate::FlowRecord as a JSON line. The serialization is whatever FlowRecord’s #[derive(Serialize)] produces — the full IPFIX IE field set, IE-named keys.

Issue #16 — emitter unification at the FlowRecord layer. Pairs with write_event for the FlowEvent shape. The two outputs have different schemas: write_event(Ended) emits the flowscope FlowEvent::Ended JSON shape; write_flow_record emits the IPFIX-keyed shape that downstream IPFIX-consuming pipelines expect.

Requires the ipfix feature.

pub fn flush(&mut self) -> Result<()>

Flush buffered output to the sink.

pub fn finish(self) -> Result<W>

Flush and recover the underlying sink.