Struct RawEvent

pub struct RawEvent<'a> {
    pub metadata: EventMetadata,
    pub len: u32,
    pub event_type: u16,
    pub nparams: u32,
    pub payload: &'a [u8],
}

Expand description

A raw event, containing the metadata and payload

This struct is used to represent an event as it is read from a raw byte stream, with minimal parsing of the header. The payload is left as a raw byte buffer, which can be parsed later using the FromRawEvent trait.

Fields§

§metadata: EventMetadata

Metadata for the event, including timestamp and thread ID

§len: u32

Length of the event in bytes, including the header

§event_type: u16

Type of the event, represented as a 16-bit unsigned integer

§nparams: u32

Number of parameters in the event, represented as a 32-bit unsigned integer

§payload: &'a [u8]

The payload of the event, containing the raw bytes after the header

The payload contains nparams lengths of either u16 or u32 (depending on the event type) and the actual parameter values. The length of the payload is len - 26 bytes.

Implementations§

§

impl<'e> RawEvent<'e>

pub fn from(buf: &[u8]) -> Result<RawEvent<'_>, Error>

Parse a byte slice into a RawEvent

This decodes the header while leaving the payload as a raw byte buffer.

pub fn trim(&mut self) -> Option<&'e [u8]>

Trim event payload

This limits the payload to the length actually indicated in the len field and returns the excess data. Useful when reading a raw event stream without any external structure

Example

use falco_event::events::{PayloadFromBytesError, RawEvent};
let mut events: &[u8] = &[ /* raw event bytes */ ];

while !events.is_empty() {
    let mut event = RawEvent::from(events)?;
    match event.trim() {
        Some(tail) => events = tail,
        None => return Err(PayloadFromBytesError::TruncatedEvent {
            wanted: event.len as usize,
            got: events.len(),
        })?
    }
}

pub fn scan(buf: &'e [u8]) -> impl Iterator<Item = Result<RawEvent<'e>, Error>>

Iterate over a buffer with multiple raw events

This function takes a byte slice and returns an iterator that yields RawEvent instances until the whole buffer is consumed.

pub unsafe fn from_ptr<'a>(buf: *const u8) -> Result<RawEvent<'a>, Error>

Parse a byte buffer (from a raw pointer) into a RawEvent

§Safety

buf must point to a complete event, i.e.

include the length field
include nparams lengths
have enough data bytes for all the fields (sum of lengths)

pub fn load<'a, T>(&'a self) -> Result<Event<T>, PayloadFromBytesError>
where T: FromRawEvent<'e>,

Load the event parameters into a strongly typed Event<T>

This method uses the FromRawEvent trait to parse the raw event payload into a specific type T. The returned Event<T> contains the metadata (copied from the raw event) and the parsed parameters.