Struct RawEvent

pub struct RawEvent<'a> {
    pub metadata: EventMetadata,
    pub len: u32,
    pub event_type: u16,
    pub nparams: u32,
    pub payload: &'a [u8],
}

A raw event, containing the metadata and payload

This struct is used to represent an event as it is read from a raw byte stream, with minimal parsing of the header. The payload is left as a raw byte buffer, which can be parsed later using the FromRawEvent trait.

Fields

metadata: EventMetadata

Metadata for the event, including timestamp and thread ID

len: u32

Length of the event in bytes, including the header

event_type: u16

Type of the event, represented as a 16-bit unsigned integer

nparams: u32

Number of parameters in the event, represented as a 32-bit unsigned integer

payload: &'a [u8]

The payload of the event, containing the raw bytes after the header

The payload contains nparams lengths of either u16 or u32 (depending on the event type) and the actual parameter values. The length of the payload is len - 26 bytes.

Implementations

impl<'e> RawEvent<'e>

pub fn from(buf: &[u8]) -> Result<RawEvent<'_>, Error>

Parse a byte slice into a RawEvent

This decodes the header while leaving the payload as a raw byte buffer.

pub fn trim(&mut self) -> Option<&'e [u8]>

Trim event payload

This limits the payload to the length actually indicated in the len field and returns the excess data. Useful when reading a raw event stream without any external structure

Example

use falco_event::events::{PayloadFromBytesError, RawEvent};
let mut events: &[u8] = &[ /* raw event bytes */ ];

while !events.is_empty() {
    let mut event = RawEvent::from(events)?;
    match event.trim() {
        Some(tail) => events = tail,
        None => return Err(PayloadFromBytesError::TruncatedEvent {
            wanted: event.len as usize,
            got: events.len(),
        })?
    }
}

pub fn scan(buf: &'e [u8]) -> impl Iterator<Item = Result<RawEvent<'e>, Error>>

Iterate over a buffer with multiple raw events

This function takes a byte slice and returns an iterator that yields RawEvent instances until the whole buffer is consumed.

pub unsafe fn from_ptr<'a>(buf: *const u8) -> Result<RawEvent<'a>, Error>

Parse a byte buffer (from a raw pointer) into a RawEvent

Safety

buf must point to a complete event, i.e.

• include the length field
• include nparams lengths
• have enough data bytes for all the fields (sum of lengths)

pub fn load<'a, T>(&'a self) -> Result<Event<T>, PayloadFromBytesError>

where T: FromRawEvent<'e>,

Load the event parameters into a strongly typed Event<T>

This method uses the FromRawEvent trait to parse the raw event payload into a specific type T. The returned Event<T> contains the metadata (copied from the raw event) and the parsed parameters.

pub fn params<T>(&self) -> Result<ParamIter<'e, T>, PayloadFromBytesError>

where T: LengthField,

Get an iterator over the event parameters

T must correspond to the type of the length field (u16 or u32, depending on the event type)

Trait Implementations

impl AnyEventPayload for RawEvent<'_>

const SOURCES: &'static [Option<&'static str>]

The sources of the events that this payload type can represent.

const EVENT_TYPES: &'static [u16]

The event types that this payload type can represent.

fn event_sources() -> Vec<&'static str>

Get all the event sources for this payload type

impl<'a> Debug for RawEvent<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl EventToBytes for RawEvent<'_>

fn binary_size(&self) -> usize

Get the binary size of the event.

fn write<W>(&self, writer: W) -> Result<(), Error>

where W: Write,

Write the event to a writer implementing [std::io::Write].

impl<'a, 'b> From<&'a RawEvent<'b>> for RawEvent<'b>

fn from(event: &'a RawEvent<'b>) -> RawEvent<'b>

Converts to this type from the input type.

impl<'a, 'b, T> TryFrom<&'b RawEvent<'a>> for Event<T>

where T: FromRawEvent<'a>,

type Error = PayloadFromBytesError

The type returned in the event of a conversion error.

fn try_from( raw: &'b RawEvent<'a>, ) -> Result<Event<T>, <Event<T> as TryFrom<&'b RawEvent<'a>>>::Error>

Performs the conversion.