Struct TextQueryConfig 

pub struct TextQueryConfig {

    pub precedence: (TokenType, TokenType, TokenType),
    pub group_expression: &'static str,
    pub token_separator: &'static str,
    pub and_token: &'static str,
    pub or_token: &'static str,
    pub not_token: &'static str,
    pub eq_token: &'static str,
    pub not_eq_token: Option<&'static str>,
    pub eq_expression: Option<&'static str>,
    pub not_eq_expression: Option<&'static str>,
    pub convert_not_as_not_eq: bool,
    pub wildcard_multi: &'static str,
    pub wildcard_single: &'static str,
    pub str_quote: &'static str,
    pub str_quote_pattern: Option<&'static str>,
    pub str_quote_pattern_negation: bool,
    pub escape_char: &'static str,
    pub add_escaped: &'static [&'static str],
    pub filter_chars: &'static [&'static str],
    pub field_quote: Option<&'static str>,
    pub field_quote_pattern: Option<&'static str>,
    pub field_quote_pattern_negation: bool,
    pub field_escape: Option<&'static str>,
    pub field_escape_pattern: Option<&'static str>,
    pub startswith_expression: Option<&'static str>,
    pub not_startswith_expression: Option<&'static str>,
    pub startswith_expression_allow_special: bool,
    pub endswith_expression: Option<&'static str>,
    pub not_endswith_expression: Option<&'static str>,
    pub endswith_expression_allow_special: bool,
    pub contains_expression: Option<&'static str>,
    pub not_contains_expression: Option<&'static str>,
    pub contains_expression_allow_special: bool,
    pub wildcard_match_expression: Option<&'static str>,
    pub case_sensitive_match_expression: Option<&'static str>,
    pub case_sensitive_startswith_expression: Option<&'static str>,
    pub case_sensitive_endswith_expression: Option<&'static str>,
    pub case_sensitive_contains_expression: Option<&'static str>,
    pub re_expression: Option<&'static str>,
    pub not_re_expression: Option<&'static str>,
    pub re_escape_char: Option<&'static str>,
    pub re_escape: &'static [&'static str],
    pub re_escape_escape_char: Option<&'static str>,
    pub cidr_expression: Option<&'static str>,
    pub not_cidr_expression: Option<&'static str>,
    pub field_null_expression: &'static str,
    pub field_exists_expression: Option<&'static str>,
    pub field_not_exists_expression: Option<&'static str>,
    pub compare_op_expression: Option<&'static str>,
    pub compare_ops: &'static [(&'static str, &'static str)],
    pub convert_or_as_in: bool,
    pub convert_and_as_in: bool,
    pub in_expressions_allow_wildcards: bool,
    pub field_in_list_expression: Option<&'static str>,
    pub or_in_operator: Option<&'static str>,
    pub and_in_operator: Option<&'static str>,
    pub list_separator: &'static str,
    pub unbound_value_str_expression: Option<&'static str>,
    pub unbound_value_num_expression: Option<&'static str>,
    pub unbound_value_re_expression: Option<&'static str>,
    pub field_eq_field_expression: Option<&'static str>,
    pub field_eq_field_escaping_quoting: bool,
    pub deferred_start: Option<&'static str>,
    pub deferred_separator: Option<&'static str>,
    pub deferred_only_query: &'static str,
    pub bool_true: &'static str,
    pub bool_false: &'static str,
    pub query_expression: &'static str,
    pub state_defaults: &'static [(&'static str, &'static str)],
}

Configuration tokens for text-based query backends.

Mirrors pySigma’s TextQueryBackend class variables. Backends create a const or static instance of this struct and delegate to the text_convert_* free functions for the default conversion logic.

Fields

precedence: (TokenType, TokenType, TokenType)

group_expression: &'static str

token_separator: &'static str

and_token: &'static str

or_token: &'static str

not_token: &'static str

eq_token: &'static str

not_eq_token: Option<&'static str>

eq_expression: Option<&'static str>

not_eq_expression: Option<&'static str>

convert_not_as_not_eq: bool

wildcard_multi: &'static str

wildcard_single: &'static str

str_quote: &'static str

str_quote_pattern: Option<&'static str>

str_quote_pattern_negation: bool

escape_char: &'static str

add_escaped: &'static [&'static str]

filter_chars: &'static [&'static str]

field_quote: Option<&'static str>

field_quote_pattern: Option<&'static str>

field_quote_pattern_negation: bool

field_escape: Option<&'static str>

field_escape_pattern: Option<&'static str>

startswith_expression: Option<&'static str>

not_startswith_expression: Option<&'static str>

startswith_expression_allow_special: bool

endswith_expression: Option<&'static str>

not_endswith_expression: Option<&'static str>

endswith_expression_allow_special: bool

contains_expression: Option<&'static str>

not_contains_expression: Option<&'static str>

contains_expression_allow_special: bool

wildcard_match_expression: Option<&'static str>

case_sensitive_match_expression: Option<&'static str>

case_sensitive_startswith_expression: Option<&'static str>

case_sensitive_endswith_expression: Option<&'static str>

case_sensitive_contains_expression: Option<&'static str>

re_expression: Option<&'static str>

not_re_expression: Option<&'static str>

re_escape_char: Option<&'static str>

re_escape: &'static [&'static str]

re_escape_escape_char: Option<&'static str>

cidr_expression: Option<&'static str>

not_cidr_expression: Option<&'static str>

field_null_expression: &'static str

field_exists_expression: Option<&'static str>

field_not_exists_expression: Option<&'static str>

compare_op_expression: Option<&'static str>

compare_ops: &'static [(&'static str, &'static str)]

convert_or_as_in: bool

convert_and_as_in: bool

in_expressions_allow_wildcards: bool

field_in_list_expression: Option<&'static str>

or_in_operator: Option<&'static str>

and_in_operator: Option<&'static str>

list_separator: &'static str

unbound_value_str_expression: Option<&'static str>

unbound_value_num_expression: Option<&'static str>

unbound_value_re_expression: Option<&'static str>

field_eq_field_expression: Option<&'static str>

field_eq_field_escaping_quoting: bool

deferred_start: Option<&'static str>

deferred_separator: Option<&'static str>

deferred_only_query: &'static str

bool_true: &'static str

bool_false: &'static str

query_expression: &'static str

state_defaults: &'static [(&'static str, &'static str)]

Implementations

impl TextQueryConfig

pub fn needs_grouping(&self, outer: TokenType, inner: TokenType) -> bool

Check if inner needs parenthesisation when nested inside outer.