Enum TimestampFallback 

pub enum TimestampFallback {
    WallClock,
    Skip,
}

Behavior when no timestamp field is found or parseable in an event.

Variants

WallClock

Use wall-clock time (Utc::now()). Good for real-time streaming.

Skip

Skip the event from correlation processing. Detections still fire, but the event does not update any correlation state. Recommended for batch/replay of historical logs where wall-clock time is meaningless.

Trait Implementations

impl Clone for TimestampFallback

fn clone(&self) -> TimestampFallback

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TimestampFallback

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TimestampFallback

fn default() -> TimestampFallback

Returns the “default value” for a type.

impl PartialEq for TimestampFallback

fn eq(&self, other: &TimestampFallback) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for TimestampFallback

impl Eq for TimestampFallback

impl StructuralPartialEq for TimestampFallback