Enum GroupByField 

pub enum GroupByField {
    Direct(String),
    Aliased {
        alias: String,
        mapping: HashMap<String, String>,
    },
}

A group-by field, potentially aliased per referenced rule.

Variants

Direct(String)

Simple field name, same across all referenced rules.

Aliased

Aliased: maps rule_ref -> actual field name in that rule’s events.

Fields

alias: String

mapping: HashMap<String, String>

Implementations

impl GroupByField

pub fn name(&self) -> &str

Get the display name of this group-by field.

pub fn resolve(&self, rule_refs: &[&str]) -> &str

Resolve the actual field name to look up in an event, given which rule (by ID or name) produced the detection match.

Tries to find the rule in the alias mapping by any of the provided identifiers (ID, name, etc.).

Trait Implementations

impl Clone for GroupByField

fn clone(&self) -> GroupByField

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GroupByField

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.