Enum EventInputDecoded 

pub enum EventInputDecoded {
    Json(JsonEvent<'static>),
    Kv(KvEvent),
    Plain(PlainEvent),
}

A decoded event ready for Sigma rule evaluation.

Static dispatch enum — avoids Box<dyn Event> on the hot path while supporting all input formats through a single type.

Variants

Json(JsonEvent<'static>)

Kv(KvEvent)

Plain(PlainEvent)

Trait Implementations

impl Debug for EventInputDecoded

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Event for EventInputDecoded

fn get_field(&self, path: &str) -> Option<EventValue<'_>>

Look up a field by name. Supports dot-notation for nested access.

fn any_string_value(&self, pred: &dyn Fn(&str) -> bool) -> bool

Check if any string value anywhere in the event satisfies a predicate. Used by keyword detection.

fn all_string_values(&self) -> Vec<Cow<'_, str>>

Collect all string values in the event.

fn to_json(&self) -> Value

Materialize the event as a serde_json::Value.