Struct DraftConfig 

pub struct DraftConfig {

    pub max_fields: usize,
    pub min_fields: usize,
    pub min_prevalence: f64,
    pub max_value_cardinality: usize,
    pub min_token_len: usize,
    pub max_baseline_token_prevalence: f64,
    pub include_fields: Vec<String>,
    pub exclude_fields: Vec<String>,
    pub title: Option<String>,
    pub rule_id: Option<String>,
    pub date: Option<String>,
    pub logsource_category: Option<String>,
    pub logsource_product: Option<String>,
    pub logsource_service: Option<String>,
    pub evaluate_baseline: bool,
}

Tunables for a draft run. Default is a sensible starting point; the CLI exposes each as a flag.

Fields

max_fields: usize

Maximum fields in a selection. Kept small so drafts stay readable.

min_fields: usize

Relaxation floor: verification may drop failing fields down to this count, below it drafting errors instead of emitting an over-broad rule.

min_prevalence: f64

Fraction (0.0-1.0) of exemplars a field must appear in to be a candidate. The default 1.0 keeps AND-selections sound.

max_value_cardinality: usize

A field whose distinct exemplar values do not exceed this cap is “enumerable” and emitted as an OR value list.

min_token_len: usize

Minimum length of a shared prefix/suffix/token before it becomes a startswith/endswith/contains pattern, so short generic fragments are never chosen.

max_baseline_token_prevalence: f64

A contains token matching more than this fraction of baseline events is rejected as too generic.

include_fields: Vec<String>

Force these fields into the selection (a warning is recorded when a forced field is absent from some exemplars).

exclude_fields: Vec<String>

Never consider these fields.

title: Option<String>

Rule title override; derived from the dominant marker when unset.

rule_id: Option<String>

Rule id. The core is deterministic and never generates one; the CLI passes a fresh UUIDv4. Unset omits the id key (lint reports it).

date: Option<String>

Rule date (YYYY-MM-DD). Defaults to today (UTC) when unset; tests pass a fixed date for byte-identical output.

logsource_category: Option<String>

Logsource overrides; each set dimension wins over inference.

logsource_product: Option<String>

logsource_service: Option<String>

evaluate_baseline: bool

Evaluate the final draft against the baseline (the baseline is still used for contrastive scoring when this is off).

Trait Implementations

impl Clone for DraftConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DraftConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DraftConfig

fn default() -> Self

Returns the “default value” for a type.