Function parse_packet_projected 

pub fn parse_packet_projected<'a>(
    registry: &ProtocolRegistry,
    link_type: u16,
    data: &'a [u8],
    projections: &HashMap<String, HashSet<String>>,
) -> Vec<(&'static str, ParseResult<'a>)>

Parse a packet with field projection.

Uses parse_projected() for each protocol, only extracting the fields in the projection config. This can significantly reduce CPU usage when queries only need a subset of fields.

Arguments

• registry - Protocol registry containing parser definitions
• link_type - Link layer type (e.g., 1 for Ethernet)
• data - Raw packet bytes
• projections - Per-protocol field projections (protocol name -> field names)

Returns

Vector of (protocol_name, parse_result) pairs. Parse results only contain the fields that were requested in the projection config.

Example

use std::collections::{HashMap, HashSet};
use pcapsql_core::protocol::{default_registry, parse_packet_projected};

let registry = default_registry();

// Only extract ports from TCP
let mut projections = HashMap::new();
projections.insert("tcp", ["src_port", "dst_port"].iter().map(|s| s.to_string()).collect());

let results = parse_packet_projected(&registry, 1, &packet_data, &projections);