Struct QueryFilter 

pub struct QueryFilter { /* private fields */ }

A composable filter for querying audit entries.

All set fields are ANDed together. Unset fields (None) are ignored.

use libro::query::QueryFilter;
use libro::EventSeverity;

let filter = QueryFilter::new()
    .source("daimon")
    .severity(EventSeverity::Security);

Implementations

impl QueryFilter

pub fn new() -> Self

pub fn source(self, source: impl Into<String>) -> Self

Filter by source.

pub fn severity(self, severity: EventSeverity) -> Self

Filter by severity level.

pub fn agent_id(self, agent_id: impl Into<String>) -> Self

Filter by agent ID.

pub fn after(self, after: DateTime<Utc>) -> Self

Filter to entries after this timestamp (exclusive).

pub fn before(self, before: DateTime<Utc>) -> Self

Filter to entries before this timestamp (exclusive).

pub fn min_severity(self, min: EventSeverity) -> Self

Filter to entries with severity >= the given level.

pub fn action(self, action: impl Into<String>) -> Self

Filter by action.

pub fn matches(&self, entry: &AuditEntry) -> bool

Test whether a single entry matches this filter.

pub fn apply<'a>(&self, entries: &'a [AuditEntry]) -> Vec<&'a AuditEntry>

Filter a slice of entries, returning references to matches.

Trait Implementations

impl Clone for QueryFilter

fn clone(&self) -> QueryFilter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for QueryFilter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for QueryFilter

fn default() -> QueryFilter

Returns the “default value” for a type.