Struct GroupKey 

pub struct GroupKey(pub Vec<Option<String>>);

Composite key for group-by partitioning.

Each element corresponds to a GroupByField value extracted from an event. None means the field was absent from the event.

Tuple Fields

0: Vec<Option<String>>

Implementations

impl GroupKey

pub fn extract( event: &Event<'_>, group_by: &[GroupByField], rule_refs: &[&str], ) -> Self

Extract a group key from an event given the group-by fields and the rule reference identifiers (ID, name, etc.) that produced the detection match.

pub fn from_pairs(pairs: &[(String, String)], group_by: &[GroupByField]) -> Self

Build a group key from explicit field-value pairs (for chaining).

pub fn to_pairs(&self, group_by: &[GroupByField]) -> Vec<(String, String)>

Convert to field-name/value pairs for output.

Trait Implementations

impl Clone for GroupKey

fn clone(&self) -> GroupKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GroupKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Hash for GroupKey

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for GroupKey

fn eq(&self, other: &GroupKey) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for GroupKey

impl StructuralPartialEq for GroupKey