Enum CorrelationEventMode 

pub enum CorrelationEventMode {
    None,
    Full,
    Refs,
}

How to include events in correlation results.

Can be overridden per-correlation via the rsigma.correlation_event_mode custom attribute.

Variants

None

Don’t include events (default). Zero memory overhead.

Full

Include full event bodies, individually compressed with deflate. Typical cost: 100–1000 bytes per event.

Refs

Include only event references (timestamp + optional ID). Minimal memory: ~40 bytes per event.

Trait Implementations

impl Clone for CorrelationEventMode

fn clone(&self) -> CorrelationEventMode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorrelationEventMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorrelationEventMode

fn default() -> CorrelationEventMode

Returns the “default value” for a type.

impl Display for CorrelationEventMode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromStr for CorrelationEventMode

type Err = String

The associated error which can be returned from parsing.

fn from_str(s: &str) -> Result<Self, Self::Err>

Parses a string s to return a value of this type.

impl PartialEq for CorrelationEventMode

fn eq(&self, other: &CorrelationEventMode) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for CorrelationEventMode

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Copy for CorrelationEventMode

impl Eq for CorrelationEventMode

impl StructuralPartialEq for CorrelationEventMode