Enum SchemaPredicate 

pub enum SchemaPredicate {
    FieldPresent(String),
    FieldAbsent(String),
    AnyOf(Vec<String>),
    Equals {
        field: String,
        value: String,
    },
    Matches {
        field: String,
        regex: Regex,
    },
    Compare {
        field: String,
        op: CompareOp,
        value: f64,
    },
    In {
        field: String,
        values: Vec<String>,
    },
    FieldEqualsField {
        left: String,
        right: String,
    },
    Not(Box<SchemaPredicate>),
    Any(Vec<SchemaPredicate>),
    All(Vec<SchemaPredicate>),
    HasAnyField,
}

A single condition over a parsed event used to recognize a schema.

Field names use the same dot-notation as Event::get_field, so nested shapes like Event.System.EventID or ecs.version work whether the event is nested or carries flattened dotted keys.

Variants

FieldPresent(String)

The named field is present (any non-absent value, including null).

FieldAbsent(String)

The named field is absent.

AnyOf(Vec<String>)

At least one of the named fields is present.

Equals

The field is present and its string-coerced value equals value (ASCII case-insensitive).

Fields

field: String

value: String

Matches

The field is present and its string-coerced value matches regex.

Fields

field: String

regex: Regex

Compare

The field is present, numeric-coercible, and compares to value under op. A non-numeric or absent field fails closed (no match).

Fields

field: String

op: CompareOp

value: f64

In

The field is present and its string-coerced value equals one of values (ASCII case-insensitive). The multi-value form of Equals.

Fields

field: String

values: Vec<String>

FieldEqualsField

Both fields are present, string-coercible, and equal (case-insensitive).

Fields

left: String

right: String

Not(Box<SchemaPredicate>)

Logical negation of the inner predicate.

Any(Vec<SchemaPredicate>)

At least one of the inner predicates holds (logical OR).

All(Vec<SchemaPredicate>)

All of the inner predicates hold (logical AND). Useful as a group under Not or Any.

HasAnyField

The event has at least one structured field. Used by the generic_json fallback to distinguish structured events from field-less ones (raw text, empty objects), which stay “unknown”.

Trait Implementations

impl Clone for SchemaPredicate

fn clone(&self) -> SchemaPredicate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SchemaPredicate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.