Struct JoinBuffer 

pub struct JoinBuffer { /* private fields */ }

Buffer for join operations - stores events from each source and correlates them

Implementations

impl JoinBuffer

pub fn new( sources: Vec<String>, join_keys: FxHashMap<String, String>, window_duration: Duration, ) -> Self

Create a new JoinBuffer for correlating events from multiple sources

Arguments

• sources - Names of the source streams to join
• join_keys - Map of source name to the field used as join key for that source
• window_duration - How long to keep events for potential correlation

pub const fn with_join_type(self, join_type: JoinType) -> Self

Set the join type (Inner, Left, Right, Full)

pub const fn with_max_events(self, max_events: usize) -> Self

Set the maximum number of events to keep per source/key combination

pub fn add_event(&mut self, source_name: &str, event: Event) -> Option<Event>

Add an event from a source stream and attempt to correlate

Arguments

• source_name - Which source stream this event came from
• event - The event to add

Returns

If events from all sources with matching keys exist within the window, returns a correlated event containing fields from all sources.

pub fn stats(&self) -> JoinBufferStats

Get statistics about the buffer state (for debugging)

impl JoinBuffer

pub fn checkpoint(&self) -> JoinCheckpoint

Create a checkpoint of the join buffer state.

pub fn restore(&mut self, cp: &JoinCheckpoint)

Restore join buffer state from a checkpoint.

Trait Implementations

impl Debug for JoinBuffer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.