Crate falco_event

Falco events

This crate provides support for working with Falco events.

This crate provides a strongly typed representation of the Falco event schema, allowing you to load and work with Falco events in a type-safe manner.

The events may come in multiple forms:

• a raw byte buffer, as received from the plugin API or an external source, using a data format compatible with the Falco libs ringbuffer scheme
• a raw event, which contains some metadata about the event, but all parameters are available only as a series of byte buffers
• a parsed event, which deserializes the raw fields into a Rust data type (either an event-specific type, or a generic enum encompassing all known event types)

Note: This crate does not provide the strongly typed event types themselves. These are implemented in the falco_event_schema crate. See the documentation for that crate for more information about working with strongly typed events.

Byte slice to raw event

To read an event from a &[u8] to a events::RawEvent, use events::RawEvent::from. It does some basic sanity checking on the slice, but does not validate e.g., that all event parameters are present and the event is not truncated.

There also exists events::RawEvent::from_ptr, which is useful if all you have is a raw pointer, but it’s unsafe for two reasons:

• it dereferences a raw pointer, which is unsafe enough
• it determines the length of the memory to access based on the event header

This method creates a slice from the pointer (based on the discovered length) and passes it to events::RawEvent::from.

Raw event to typed event

The building block to parse typed events is events::RawEvent::load, which tries to load all event parameters into a payload type T that implements the events::FromRawEvent trait. It depends on the payload type to do the actual parsing.

See the falco_event_schema crate for the types corresponding to the Falco event schema and examples of how to use them.

Event (raw or typed) to byte buffer

There is a trait (events::EventToBytes) that writes a serialized form of an event to a writer (i.e., a type that implements std::io::Write, for example Vec<u8>).

Modules

events

Types and traits for Falco events

fields

Types and traits for Falco event fields

types

Data types used in Falco events

Derive Macros

AnyEvent

Derive event-related traits for an enum

EventPayload

Derive event-related traits for a struct