Struct CorrelationBody 

pub struct CorrelationBody {
    pub correlation_type: CorrelationType,
    pub group_key: Vec<(String, String)>,
    pub aggregated_value: f64,
    pub timespan_secs: u64,
    pub events: Option<Vec<Value>>,
    pub event_refs: Option<Vec<EventRef>>,
}

Correlation-specific result fields.

Fields

correlation_type: CorrelationType

Type of correlation.

group_key: Vec<(String, String)>

Group-by field names and their values for this match.

aggregated_value: f64

The aggregated value that triggered the condition (count, sum, avg, …).

timespan_secs: u64

The time window in seconds.

events: Option<Vec<Value>>

Full event bodies, included when correlation_event_mode is Full.

event_refs: Option<Vec<EventRef>>

Lightweight event references, included when correlation_event_mode is Refs.

Trait Implementations

impl Clone for CorrelationBody

fn clone(&self) -> CorrelationBody

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorrelationBody

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for CorrelationBody

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.