rsigma_eval/event/
kv.rs

1use std::borrow::Cow;
2
3use serde_json::Value;
4
5use super::{Event, EventValue};
6
7/// Flat key-value event (e.g., from logfmt, syslog structured data).
8///
9/// No nested access (no dot-notation traversal), no arrays.
10/// All values are strings.
11#[derive(Debug, Clone)]
12pub struct KvEvent {
13    fields: Vec<(String, String)>,
14}
15
16impl KvEvent {
17    pub fn new(fields: Vec<(String, String)>) -> Self {
18        Self { fields }
19    }
20
21    pub fn fields(&self) -> &[(String, String)] {
22        &self.fields
23    }
24}
25
26impl Event for KvEvent {
27    fn get_field(&self, path: &str) -> Option<EventValue<'_>> {
28        self.fields
29            .iter()
30            .find(|(k, _)| k == path)
31            .map(|(_, v)| EventValue::Str(Cow::Borrowed(v.as_str())))
32    }
33
34    fn any_string_value(&self, pred: &dyn Fn(&str) -> bool) -> bool {
35        self.fields.iter().any(|(_, v)| pred(v.as_str()))
36    }
37
38    fn all_string_values(&self) -> Vec<Cow<'_, str>> {
39        self.fields
40            .iter()
41            .map(|(_, v)| Cow::Borrowed(v.as_str()))
42            .collect()
43    }
44
45    fn to_json(&self) -> Value {
46        let map: serde_json::Map<String, Value> = self
47            .fields
48            .iter()
49            .map(|(k, v)| (k.clone(), Value::String(v.clone())))
50            .collect();
51        Value::Object(map)
52    }
53}
54
55#[cfg(test)]
56mod tests {
57    use super::*;
58    use serde_json::json;
59
60    #[test]
61    fn kv_get_field() {
62        let event = KvEvent::new(vec![
63            ("host".into(), "web01".into()),
64            ("status".into(), "200".into()),
65        ]);
66        assert_eq!(
67            event.get_field("host"),
68            Some(EventValue::Str(Cow::Borrowed("web01")))
69        );
70        assert_eq!(event.get_field("missing"), None);
71    }
72
73    #[test]
74    fn kv_all_string_values() {
75        let event = KvEvent::new(vec![("a".into(), "one".into()), ("b".into(), "two".into())]);
76        let vals = event.all_string_values();
77        assert_eq!(vals.len(), 2);
78    }
79
80    #[test]
81    fn kv_to_json() {
82        let event = KvEvent::new(vec![("key".into(), "val".into())]);
83        let j = event.to_json();
84        assert_eq!(j, json!({"key": "val"}));
85    }
86}
rsigma_eval/event/kv.rs

rsigma_eval/event/
kv.rs
