Struct ItemTrace 

pub struct ItemTrace {
    pub field: Option<String>,
    pub matcher: MatcherKind,
    pub pattern: Option<String>,
    pub actual: Option<Value>,
    pub matched: bool,
    pub reason: MatchReason,
}

A single field-or-keyword leaf in a detection trace.

Fields

field: Option<String>

The field name tested (None for keyword items).

matcher: MatcherKind

The kind of matcher applied.

pattern: Option<String>

The pattern the matcher tested against, when meaningful.

actual: Option<Value>

The event value at field, when present.

matched: bool

Whether this leaf matched.

reason: MatchReason

The reason for the verdict.

Trait Implementations

impl Clone for ItemTrace

fn clone(&self) -> ItemTrace

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ItemTrace

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for ItemTrace

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.