Enum WindowState 

pub enum WindowState {
    EventCount {
        timestamps: VecDeque<i64>,
    },
    ValueCount {
        entries: VecDeque<(i64, String)>,
    },
    Temporal {
        rule_hits: HashMap<String, VecDeque<i64>>,
    },
    NumericAgg {
        entries: VecDeque<(i64, f64)>,
    },
}

Per-group mutable state within a time window.

Each variant matches the type of aggregation being performed.

Variants

EventCount

For event_count: timestamps of matching events.

Fields

timestamps: VecDeque<i64>

ValueCount

For value_count: (timestamp, field_value) pairs.

Fields

entries: VecDeque<(i64, String)>

Temporal

For temporal / temporal_ordered: rule_ref -> list of hit timestamps.

Fields

rule_hits: HashMap<String, VecDeque<i64>>

NumericAgg

For value_sum, value_avg, value_percentile, value_median: (timestamp, numeric_value) pairs.

Fields

entries: VecDeque<(i64, f64)>

Implementations

impl WindowState

pub fn new_for(corr_type: CorrelationType) -> Self

Create a new empty window state for the given correlation type.

pub fn evict(&mut self, cutoff: i64)

Remove all entries older than the cutoff timestamp.

pub fn is_empty(&self) -> bool

Returns true if this state has no entries.

pub fn latest_timestamp(&self) -> Option<i64>

Returns the most recent timestamp in this window, or None if empty.

pub fn clear(&mut self)

Clear all entries from the window state (used by CorrelationAction::Reset).

pub fn push_event_count(&mut self, ts: i64)

Record an event_count hit.

pub fn push_value_count(&mut self, ts: i64, value: String)

Record a value_count hit with the field value.

pub fn push_temporal(&mut self, ts: i64, rule_ref: &str)

Record a temporal hit for a specific rule reference.

pub fn push_numeric(&mut self, ts: i64, value: f64)

Record a numeric aggregation value.

pub fn check_condition( &self, condition: &CompiledCondition, corr_type: CorrelationType, rule_refs: &[String], extended_expr: Option<&ConditionExpr>, ) -> Option<f64>

Evaluate the window state against the correlation condition.

Returns Some(aggregated_value) if the condition is satisfied, None otherwise.

For temporal correlations with an extended expression, the expression is evaluated against the set of rules that have fired in the window.

Trait Implementations

impl Clone for WindowState

fn clone(&self) -> WindowState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WindowState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.