pub trait AggregateFunc: Send + Sync {
// Required methods
fn name(&self) -> &str;
fn apply(&self, events: &[Event], field: Option<&str>) -> Value;
// Provided methods
fn apply_shared(&self, events: &[SharedEvent], field: Option<&str>) -> Value { ... }
fn apply_refs(&self, events: &[&Event], field: Option<&str>) -> Value { ... }
fn apply_columnar(
&self,
buffer: &mut ColumnarBuffer,
field: Option<&str>,
) -> Value { ... }
}Expand description
Trait for implementing aggregation functions.
Aggregation functions compute summary values over collections of events. They are used in windowed stream processing to produce aggregate results.
§Required Methods
§Optional Methods
apply_shared: Optimized forArc<Event>(avoids cloning)apply_refs: For reference slices (internal use)
§Thread Safety
Implementations must be Send + Sync to work with parallel processing.
Required Methods§
Provided Methods§
Apply aggregation to shared events (avoids cloning in hot paths).
Override this for better performance when events are wrapped in Arc.
Sourcefn apply_refs(&self, events: &[&Event], field: Option<&str>) -> Value
fn apply_refs(&self, events: &[&Event], field: Option<&str>) -> Value
Apply aggregation to event references (internal helper)
Sourcefn apply_columnar(
&self,
buffer: &mut ColumnarBuffer,
field: Option<&str>,
) -> Value
fn apply_columnar( &self, buffer: &mut ColumnarBuffer, field: Option<&str>, ) -> Value
Apply aggregation to columnar buffer (SIMD-optimized for numeric aggregations).
Default implementation falls back to shared events. Override this for aggregations that can benefit from columnar data layout (sum, avg, min, max).