Struct LogProcessor 

pub struct LogProcessor { /* private fields */ }

Thread-safe handle to the engine, swappable atomically for hot-reload.

Uses ArcSwap<Mutex<RuntimeEngine>> so that:

• Detection + correlation processing can acquire &mut RuntimeEngine via the inner Mutex.
• Hot-reload swaps the entire engine atomically without blocking in-flight batches (they hold an Arc to the old engine until their batch completes).

Implementations

impl LogProcessor

pub fn new(engine: RuntimeEngine, metrics: Arc<dyn MetricsHook>) -> Self

Create a new processor wrapping the given engine and metrics hook.

pub fn swap_engine(&self, new_engine: RuntimeEngine)

Atomically replace the engine with a new one.

In-flight batches continue against the old engine (they hold an Arc snapshot). New batches see the replacement on their next call to process_batch_lines.

pub fn engine_snapshot(&self) -> Guard<Arc<Mutex<RuntimeEngine>>>

Load a snapshot of the current engine for use during reload.

The caller can lock the returned guard to export state, build a new engine, import state, and then call swap_engine.

pub fn process_batch_lines( &self, batch: &[String], event_filter: &EventFilter, ) -> Vec<ProcessResult>

Process a batch of raw input lines through the engine.

1. Parses each line as JSON; on error, increments parse error metrics.
2. Applies the event_filter closure to extract payloads.
3. Evaluates all payloads via RuntimeEngine::process_batch.
4. Merges per-payload results back into per-line results.
5. Updates metrics (events processed, latency, match counts).

Returns one ProcessResult per input line.

pub fn process_batch_with_format( &self, batch: &[String], format: &InputFormat, event_filter: Option<&EventFilter>, ) -> Vec<ProcessResult>

Process a batch of raw input lines using the specified input format.

Unlike process_batch_lines, this method supports all input formats (JSON, syslog, plain, logfmt, CEF). The event_filter only applies to JSON-decoded events (it extracts multiple payloads from one JSON object, e.g. a records[] array). Non-JSON formats produce exactly one event per line.

Returns one ProcessResult per input line.

pub fn reload_rules(&self) -> Result<EngineStats, String>

Reload rules (and pipelines) without blocking in-flight event processing.

Builds a fresh RuntimeEngine with the same configuration as the current one, re-reads pipeline files from disk (if paths are set), loads rules into it, imports the old engine’s correlation state, and atomically swaps. In-flight batches that already hold an Arc to the old engine finish undisturbed.

If pipeline or rule loading fails, the old engine remains active.

pub fn rules_path(&self) -> PathBuf

Return the rules path from the current engine.

pub fn metrics(&self) -> &dyn MetricsHook

Return a reference to the metrics hook.

pub fn export_state(&self) -> Option<CorrelationSnapshot>

Export correlation state from the current engine.

pub fn import_state(&self, snapshot: &CorrelationSnapshot) -> bool

Import correlation state into the current engine.

pub fn stats(&self) -> EngineStats

Return summary statistics about the current engine.