Struct ieql::query::query::CompiledQueryGroup

pub struct CompiledQueryGroup {
    pub queries: Vec<CompiledQuery>,
    pub regex_collected: RegexSet,
    pub regex_collected_query_index: Vec<usize>,
    pub always_run_queries: Vec<CompiledQuery>,
    pub regex_feed: ScopeContent,
}

Represents a group of compiled queries. This type has several internal optimizations that makes scanning using a CompiledQueryGroup far more efficient than scanning using compiled queries alone.

Namely, this type provides:

• proper multithreading support
• runtime optimizations for query execution

For information about how each of these optimizations are implemented, see the documentation for scan_concurrently() and the various fields.

There are few cases—if not none at all—when a CompiledQueryGroup should be mutable.

Fields

queries: Vec<CompiledQuery>

Contains the compiled queries that make up the compiled query group.

Importantly, this vector is highly ordered, meaning that changing the order of this array will lead to the entire scanning system breaking.

regex_collected: RegexSet

Contains every single RegEx pattern of every query's triggers.

This highly efficient RegEx matching system allows for the CompiledQueryGroup's scanning mechanism to know in advance which of its queries will potentially match on a document, without having to execute every individual query.

regex_collected_query_index: Vec<usize>

This index relates every RegEx pattern in regex_collected to its source query in queries.

For example, the 1st element of this vector corresponds to the 1st RegEx pattern in regex_collected and denotes the index of its source query in queries.

always_run_queries: Vec<CompiledQuery>

Contains the queries that cannot be optimized using the methods above, and therefore must be run on every document.

These queries typically are those that contain some sort of inverse boolean operator, therefore making it possible for the query to match even when none of its triggers match.

Queries that have a threshold with a requires value of 0 and queries whose ScopeContent doesn't match the majority are also included here as unoptimizable.

regex_feed: ScopeContent

The type of content that should be fed to the RegEx patterns in regex_collected.

Trait Implementations

impl Clone for CompiledQueryGroup

fn clone(&self) -> CompiledQueryGroup

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CompilableTo<CompiledQueryGroup> for QueryGroup

fn compile(&self) -> Result<CompiledQueryGroup, Issue>

Compiles the QueryGroup into a CompiledQueryGroup. Like all compilation operations, this is expensive.

impl From<CompiledQuery> for CompiledQueryGroup

fn from(query: CompiledQuery) -> CompiledQueryGroup

This helper function creates a CompiledQueryGroup for single queries, enabling multithreading support for single queries without any significant 'hacks.'

impl Scanner for CompiledQueryGroup

fn scan_single(&self, document: &CompiledDocument) -> OutputBatch

Scan a single document and return the output.

fn scan_batch(&self, documents: &CompiledDocumentBatch) -> OutputBatch

Scan a batch of documents and return the output. This function is singlethreaded and often not very performant.

fn scan_concurrently(&self, threads: u8) -> AsyncScanInterface

Launch a 'scan engine' and create an asynchronous and concurrent scanning system. In most cases, this is what you'll want to use.