Enum CompiledMatcher 

pub enum CompiledMatcher {
    Exact {
        value: String,
        case_insensitive: bool,
    },
    Contains {
        value: String,
        case_insensitive: bool,
    },
    StartsWith {
        value: String,
        case_insensitive: bool,
    },
    EndsWith {
        value: String,
        case_insensitive: bool,
    },
    Regex(Regex),
    Cidr(IpNet),
    NumericEq(f64),
    NumericGt(f64),
    NumericGte(f64),
    NumericLt(f64),
    NumericLte(f64),
    Exists(bool),
    FieldRef {
        field: String,
        case_insensitive: bool,
    },
    Null,
    BoolEq(bool),
    Expand {
        template: Vec<ExpandPart>,
        case_insensitive: bool,
    },
    TimestampPart {
        part: TimePart,
        inner: Box<CompiledMatcher>,
    },
    Not(Box<CompiledMatcher>),
    AnyOf(Vec<CompiledMatcher>),
    AllOf(Vec<CompiledMatcher>),
}

A pre-compiled matcher for a single value comparison.

All string matchers store their values in the form needed for comparison (Unicode-lowercased for case-insensitive). The case_insensitive flag controls whether the input is lowercased before comparison.

Variants

Exact

Exact string equality.

Fields

value: String

case_insensitive: bool

Contains

Substring containment.

Fields

value: String

case_insensitive: bool

StartsWith

String starts with prefix.

Fields

value: String

case_insensitive: bool

EndsWith

String ends with suffix.

Fields

value: String

case_insensitive: bool

Regex(Regex)

Compiled regex pattern (flags baked in at compile time).

Cidr(IpNet)

CIDR network match for IP addresses.

NumericEq(f64)

Numeric equality.

NumericGt(f64)

Numeric greater-than.

NumericGte(f64)

Numeric greater-than-or-equal.

NumericLt(f64)

Numeric less-than.

NumericLte(f64)

Numeric less-than-or-equal.

Exists(bool)

Field existence check. true = field must exist, false = must not exist.

FieldRef

Compare against another field’s value.

Fields

field: String

case_insensitive: bool

Null

Match null / missing values.

BoolEq(bool)

Boolean equality.

Expand

Placeholder expansion: %fieldname% is resolved from the event at match time.

Fields

template: Vec<ExpandPart>

case_insensitive: bool

TimestampPart

Extract a time component from a timestamp field value and match it.

Fields

part: TimePart

inner: Box<CompiledMatcher>

Not(Box<CompiledMatcher>)

Negated matcher: matches if the inner matcher does NOT match.

AnyOf(Vec<CompiledMatcher>)

Match if ANY child matches (OR).

AllOf(Vec<CompiledMatcher>)

Match if ALL children match (AND).

Implementations

impl CompiledMatcher

pub fn matches(&self, value: &Value, event: &Event<'_>) -> bool

Check if this matcher matches a JSON value from an event.

The event parameter is needed for FieldRef to access other fields. The field_name is the name of the field being matched (for FieldRef comparison).

pub fn matches_keyword(&self, event: &Event<'_>) -> bool

Check if this matcher matches any string value in the event. Used for keyword detection (field-less matching).

Avoids allocating a Vec of all strings and a String per value by using matches_str with a short-circuiting traversal.

Trait Implementations

impl Clone for CompiledMatcher

fn clone(&self) -> CompiledMatcher

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CompiledMatcher

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.