Struct SchemaPredicateConfig 

pub struct SchemaPredicateConfig {

    pub field_present: Option<String>,
    pub field_absent: Option<String>,
    pub any_of: Option<Vec<String>>,
    pub equals: Option<FieldValueConfig>,
    pub matches: Option<FieldValueConfig>,
    pub gt: Option<FieldNumberConfig>,
    pub gte: Option<FieldNumberConfig>,
    pub lt: Option<FieldNumberConfig>,
    pub lte: Option<FieldNumberConfig>,
    pub in_set: Option<FieldValuesConfig>,
    pub field_equals_field: Option<FieldPairConfig>,
    pub not: Option<Box<SchemaPredicateConfig>>,
    pub any: Option<Vec<SchemaPredicateConfig>>,
    pub all: Option<Vec<SchemaPredicateConfig>>,
}

A predicate as written in YAML: a single-key map, for example field_present: ecs.version or equals: { field: type, value: alert }. Exactly one form must be set per list entry. The not/any/all group forms nest predicate lists to express OR and NOT within one signature.

Fields

field_present: Option<String>

field_present: <field>

field_absent: Option<String>

field_absent: <field>

any_of: Option<Vec<String>>

any_of: [<field>, ...]

equals: Option<FieldValueConfig>

equals: { field: <field>, value: <value> }

matches: Option<FieldValueConfig>

matches: { field: <field>, value: <regex> }

gt: Option<FieldNumberConfig>

gt: { field: <field>, value: <number> }

gte: Option<FieldNumberConfig>

gte: { field: <field>, value: <number> }

lt: Option<FieldNumberConfig>

lt: { field: <field>, value: <number> }

lte: Option<FieldNumberConfig>

lte: { field: <field>, value: <number> }

in_set: Option<FieldValuesConfig>

in: { field: <field>, values: [...] }

field_equals_field: Option<FieldPairConfig>

field_equals_field: { left: <field>, right: <field> }

not: Option<Box<SchemaPredicateConfig>>

not: <predicate>

any: Option<Vec<SchemaPredicateConfig>>

any: [<predicate>, ...]

all: Option<Vec<SchemaPredicateConfig>>

all: [<predicate>, ...]

Trait Implementations

impl Clone for SchemaPredicateConfig

fn clone(&self) -> SchemaPredicateConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SchemaPredicateConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SchemaPredicateConfig

fn default() -> SchemaPredicateConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SchemaPredicateConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.