Struct LogSourceExtractor 

pub struct LogSourceExtractor { /* private fields */ }

Derives an event LogSource from configurable fields plus static defaults, for conflict-based logsource pruning on the evaluation hot path.

Each dimension is resolved independently in precedence order: the value of the configured event field, then the static default, then unset (None). A present-but-blank field value is treated as unset.

Example

use rsigma_eval::LogSourceExtractor;
use rsigma_eval::event::JsonEvent;
use serde_json::json;

let extractor = LogSourceExtractor::new();
let ev = json!({"product": "windows"});
let event = JsonEvent::borrow(&ev);

let ls = extractor.extract(&event);
assert_eq!(ls.product.as_deref(), Some("windows"));
assert_eq!(ls.category, None); // absent fields stay unset (fail-open)

Implementations

impl LogSourceExtractor

pub fn new() -> Self

Create an extractor that reads the literal product, service, and category fields with no static defaults.

pub fn with_field_names( self, product_field: impl Into<String>, service_field: impl Into<String>, category_field: impl Into<String>, ) -> Self

Override the event field names read for each dimension.

pub fn with_custom_fields(self, custom_fields: Vec<(String, String)>) -> Self

Set the extra (custom dimension, event field) mappings read into LogSource::custom. Each pair reads the event field and stores it under the custom dimension key; absent fields fall back to the static custom default (if any) and are otherwise omitted (fail-open).

pub fn with_defaults(self, defaults: LogSource) -> Self

Set the static per-dimension defaults applied when a field is absent. product, service, category, and the custom map are consulted.

pub fn extract<E: Event>(&self, event: &E) -> LogSource

Extract the event’s logsource. Each dimension resolves to the configured field value, then the static default, then None/absent (fail-open).

Trait Implementations

impl Clone for LogSourceExtractor

fn clone(&self) -> LogSourceExtractor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LogSourceExtractor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LogSourceExtractor

fn default() -> Self

Returns the “default value” for a type.