pub struct Parser<Templates = NoCompute, Masks = NoCompute> { /* private fields */ }Expand description
Tipping (Token Interdependency Parsing) log parser
use fancy_regex::Regex;
let msgs = vec![
"User 'admin' logged in from IP address 192.168.1.10",
"Attempt to access unauthorized resource by user 'guest'",
"Database connection failed due to timeout",
"Processing request for data retrieval with queryId: 34521",
];
let special_whites = vec![];
let special_blacks = vec![Regex::new(r"(?:[0-9]{1,3}\.){3}[0-9]{1,3}").unwrap()];
let symbols = "'{}|,".chars().collect();
let (event_ids, masks, templates) = tipping_rs::Parser::default()
.with_threshold(0.5)
.with_special_whites(special_whites)
.with_special_blacks(special_blacks)
.with_symbols(symbols)
.with_filter_alphabetic(true)
.with_filter_numeric(false)
.with_filter_impure(false)
.compute_templates()
.compute_masks()
.parse(&msgs);Implementations§
Source§impl Parser
impl Parser
Sourcepub fn with_threshold(self, value: f32) -> Self
pub fn with_threshold(self, value: f32) -> Self
Sets value as threshold. The threshold determines if an interdependency
link should be considered during key node computation or not. The
threshod should be 0 <= threshold <= 1.
Sourcepub fn with_special_whites(self, value: Vec<Regex>) -> Self
pub fn with_special_whites(self, value: Vec<Regex>) -> Self
Sets value as spcial white regexes. White regexes are never parameterized.
Sourcepub fn with_special_blacks(self, value: Vec<Regex>) -> Self
pub fn with_special_blacks(self, value: Vec<Regex>) -> Self
Sets value as special black regexes. Black regexes are always parameterized.
Sourcepub fn with_symbols(self, value: HashSet<char>) -> Self
pub fn with_symbols(self, value: HashSet<char>) -> Self
Sets value as symbols. Symbolds are characters that are used alongside the
white spaces to split string during tokenization.
Sourcepub fn with_filter_alphabetic(self, value: bool) -> Self
pub fn with_filter_alphabetic(self, value: bool) -> Self
The value determines if alphabetic tokens should be used during key node computation.
Sourcepub fn with_filter_numeric(self, value: bool) -> Self
pub fn with_filter_numeric(self, value: bool) -> Self
The value determines if numeric tokens should be used during key node computation.
Sourcepub fn with_filter_impure(self, value: bool) -> Self
pub fn with_filter_impure(self, value: bool) -> Self
The value determines if impure tokens should be used during key node computation.
Source§impl Parser<NoCompute, NoCompute>
impl Parser<NoCompute, NoCompute>
Sourcepub fn parse<Message: AsRef<str> + Sync>(
self,
messages: &[Message],
) -> Vec<Option<usize>>
pub fn parse<Message: AsRef<str> + Sync>( self, messages: &[Message], ) -> Vec<Option<usize>>
Parses the input messages and returns Clusters.
Clusters: AVec<Option<usize>>representing potential cluster IDs. EachOption<usize>corresponds to the cluster ID of the message at the same index, orNoneif the message couldn’t be parsed.
Source§impl Parser<Compute, NoCompute>
impl Parser<Compute, NoCompute>
Sourcepub fn parse<Message: AsRef<str> + Sync>(
self,
messages: &[Message],
) -> (Vec<Option<usize>>, Vec<HashSet<String>>)
pub fn parse<Message: AsRef<str> + Sync>( self, messages: &[Message], ) -> (Vec<Option<usize>>, Vec<HashSet<String>>)
Parses the input messages and returns Clusters, and Templates.
-
Clusters: AVec<Option<usize>>representing potential cluster IDs. EachOption<usize>corresponds to the cluster ID of the message at the same index, orNoneif the message couldn’t be parsed. -
Templates: AVec<HashSet<String>>where each set of templates is aligned with the corresponding cluster ID in theClustersvector.
Source§impl Parser<NoCompute, Compute>
impl Parser<NoCompute, Compute>
Sourcepub fn parse<Message: AsRef<str> + Sync>(
self,
messages: &[Message],
) -> (Vec<Option<usize>>, HashMap<String, String>)
pub fn parse<Message: AsRef<str> + Sync>( self, messages: &[Message], ) -> (Vec<Option<usize>>, HashMap<String, String>)
Parses the input messages and returns Clusters, Masks.
-
Clusters: AVec<Option<usize>>representing potential cluster IDs. EachOption<usize>corresponds to the cluster ID of the message at the same index, orNoneif the message couldn’t be parsed. -
Masks: A table mapping each message to its parameter masks.
Source§impl Parser<Compute, Compute>
impl Parser<Compute, Compute>
Sourcepub fn parse<Message: AsRef<str> + Sync>(
self,
messages: &[Message],
) -> (Vec<Option<usize>>, Vec<HashSet<String>>, HashMap<String, String>)
pub fn parse<Message: AsRef<str> + Sync>( self, messages: &[Message], ) -> (Vec<Option<usize>>, Vec<HashSet<String>>, HashMap<String, String>)
Parses the input messages and returns Clusters, Templates, and Masks.
-
Clusters: AVec<Option<usize>>representing potential cluster IDs. EachOption<usize>corresponds to the cluster ID of the message at the same index, orNoneif the message couldn’t be parsed. -
Templates: AVec<HashSet<String>>where each set of templates is aligned with the corresponding cluster ID in theClustersvector. -
Masks: A table mapping each message to its parameter masks.
Trait Implementations§
Auto Trait Implementations§
impl<Templates, Masks> Freeze for Parser<Templates, Masks>
impl<Templates, Masks> RefUnwindSafe for Parser<Templates, Masks>where
Templates: RefUnwindSafe,
Masks: RefUnwindSafe,
impl<Templates, Masks> Send for Parser<Templates, Masks>
impl<Templates, Masks> Sync for Parser<Templates, Masks>
impl<Templates, Masks> Unpin for Parser<Templates, Masks>
impl<Templates, Masks> UnwindSafe for Parser<Templates, Masks>where
Templates: UnwindSafe,
Masks: UnwindSafe,
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Source§impl<T> CloneToUninit for Twhere
T: Clone,
impl<T> CloneToUninit for Twhere
T: Clone,
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more