Enum FieldValue 

pub enum FieldValue<'data> {
    UInt8(u8),
    UInt16(u16),
    UInt32(u32),
    UInt64(u64),
    Int64(i64),
    Bool(bool),
    IpAddr(IpAddr),
    MacAddr([u8; 6]),
    Str(&'data str),
    Bytes(&'data [u8]),
    OwnedString(CompactString),
    OwnedBytes(Vec<u8>),
    List(Vec<FieldValue<'data>>),
    Null,
}

Possible field value types (maps to Arrow types).

FieldValue supports zero-copy parsing where possible:

• Str and Bytes reference packet data directly
• OwnedString and OwnedBytes are used when values must be constructed

The lifetime parameter 'data ties the value to the packet/buffer data.

Variants

UInt8(u8)

Unsigned 8-bit integer

UInt16(u16)

Unsigned 16-bit integer

UInt32(u32)

Unsigned 32-bit integer

UInt64(u64)

Unsigned 64-bit integer

Int64(i64)

Signed 64-bit integer

Bool(bool)

Boolean value

IpAddr(IpAddr)

IP address (v4 or v6)

MacAddr([u8; 6])

MAC address (6 bytes)

Str(&'data str)

Zero-copy string reference into packet data. Use for strings that exist verbatim in the packet (e.g., TLS SNI, SSH version).

Bytes(&'data [u8])

Zero-copy byte slice reference into packet data. Use for payload or binary data that exists verbatim in the packet.

OwnedString(CompactString)

Owned string for constructed values (DNS names, joined lists, enum names). Uses CompactString for small-string optimization (inline up to 24 bytes).

OwnedBytes(Vec<u8>)

Owned bytes for constructed/decoded data.

List(Vec<FieldValue<'data>>)

List of values (for multi-valued fields like DNS answers). All elements should be of the same type. Note: Uses Vec because FieldValue is recursive (SmallVec inline storage causes infinite size).

Null

Null/missing value

Implementations

impl<'data> FieldValue<'data>

pub fn mac(bytes: &[u8]) -> Self

Create a MAC address from bytes.

pub fn ipv4(bytes: &[u8]) -> Self

Create an IPv4 address from bytes.

pub fn ipv6(bytes: &[u8]) -> Self

Create an IPv6 address from bytes.

pub fn format_mac(mac: &[u8; 6]) -> String

Format a MAC address as a string.

pub fn is_null(&self) -> bool

Check if this is a null value.

pub fn as_u64(&self) -> Option<u64>

Try to get as u64.

pub fn as_i64(&self) -> Option<i64>

Try to get as i64.

pub fn as_u16(&self) -> Option<u16>

Try to get as u16.

pub fn as_str(&self) -> Option<&str>

Try to get as str reference.

pub fn as_bytes(&self) -> Option<&[u8]>

Try to get as bytes reference.

pub fn as_string(&self) -> Option<String>

Try to get as string (owned, allocates).

pub fn as_list(&self) -> Option<&[FieldValue<'data>]>

Try to get as list reference.

pub fn list_len(&self) -> Option<usize>

Get the number of elements if this is a list, or None otherwise.

pub fn to_owned(&self) -> FieldValue<'static>

Convert to an owned version (for caching). Copies borrowed data into owned variants.

Trait Implementations

impl<'data> Clone for FieldValue<'data>

fn clone(&self) -> FieldValue<'data>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'data> Debug for FieldValue<'data>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'data> Display for FieldValue<'data>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a, 'b> PartialEq<FieldValue<'b>> for FieldValue<'a>

fn eq(&self, other: &FieldValue<'b>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.