Enum WindowState 

pub enum WindowState {
    EventCount {
        timestamps: VecDeque<i64>,
    },
    ValueCount {
        entries: VecDeque<(i64, String)>,
    },
    Temporal {
        rule_hits: HashMap<String, VecDeque<i64>>,
    },
    NumericAgg {
        entries: VecDeque<(i64, f64)>,
    },
}

Per-group mutable state within a time window.

Each variant matches the type of aggregation being performed.

Variants

EventCount

For event_count: timestamps of matching events.

Fields

timestamps: VecDeque<i64>

ValueCount

For value_count: (timestamp, field_value) pairs.

Fields

entries: VecDeque<(i64, String)>

Temporal

For temporal / temporal_ordered: rule_ref -> list of hit timestamps.

Fields

rule_hits: HashMap<String, VecDeque<i64>>

NumericAgg

For value_sum, value_avg, value_percentile, value_median: (timestamp, numeric_value) pairs.

Fields

entries: VecDeque<(i64, f64)>

Implementations

impl WindowState

pub fn new_for(corr_type: CorrelationType) -> Self

Create a new empty window state for the given correlation type.

pub fn evict(&mut self, cutoff: i64)

Remove all entries older than the cutoff timestamp.

pub fn is_empty(&self) -> bool

Returns true if this state has no entries.

pub fn latest_timestamp(&self) -> Option<i64>

Returns the most recent timestamp in this window, or None if empty.

pub fn earliest_timestamp(&self) -> Option<i64>

Returns the oldest timestamp in this window, or None if empty.

Entries are appended in arrival order, so the front of each deque holds the earliest timestamp. For temporal state the minimum is taken across all per-rule deques.

pub fn truncate_oldest(&mut self, cap: usize, preserve_front: bool)

Enforce a per-group entry cap by dropping the oldest entries.

cap is the maximum number of retained entries (clamped to at least 1). For temporal state the cap applies to each referenced rule’s hit deque independently, since the deques are what grow with event rate.

When preserve_front is set (session windows), the oldest entry is kept and truncation happens behind it: the front entry anchors the session’s total-span cap (timespan), so dropping it would silently let the session extend past the cap. Truncation can only under-count; it never extends a window.

pub fn clear(&mut self)

Clear all entries from the window state (used by CorrelationAction::Reset).

pub fn push_event_count(&mut self, ts: i64)

Record an event_count hit.

pub fn push_value_count(&mut self, ts: i64, value: String)

Record a value_count hit with the field value.

pub fn push_temporal(&mut self, ts: i64, rule_ref: &str)

Record a temporal hit for a specific rule reference.

pub fn push_numeric(&mut self, ts: i64, value: f64)

Record a numeric aggregation value.

pub fn check_condition( &self, condition: &CompiledCondition, corr_type: CorrelationType, rule_refs: &[String], extended_expr: Option<&ConditionExpr>, ) -> Option<f64>

Evaluate the window state against the correlation condition.

Returns Some(aggregated_value) if the condition is satisfied, None otherwise.

For temporal correlations with an extended expression, the expression is evaluated against the set of rules that have fired in the window.

impl WindowState

pub fn entry_count(&self) -> usize

Number of retained entries in this window. For temporal state this is the total across all per-rule hit deques.

pub fn current_value( &self, corr_type: CorrelationType, rule_refs: &[String], percentile: Option<u64>, ) -> Option<f64>

Compute the current aggregate value for this window without applying the correlation’s threshold condition.

Unlike check_condition, which returns None when the threshold is not met, this returns the raw “got” value the introspection surface reports so an operator can see the gap to the threshold. Returns None only when no value is defined (an empty percentile/median window, or a state/type mismatch).

Trait Implementations

impl Clone for WindowState

fn clone(&self) -> WindowState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WindowState

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for WindowState

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for WindowState

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.