Struct ExtractFieldInfo

pub struct ExtractFieldInfo<P: ExtractPlugin> {
    pub name: &'static str,
    pub field_type: ExtractFieldTypeId,
    pub is_list: bool,
    pub arg: ExtractArgType,
    pub display_name: Option<&'static str>,
    pub description: &'static str,
    pub add_output: bool,
    pub func: ExtractLambda<P>,
}

A description of an extracted field

You should create instances of this struct by calling field.

This struct is used to automatically generate the schema definition for the Falco plugin framework

Fields

name: &'static str

the name of the extracted field, generally of the form <plugin>.<field>

field_type: ExtractFieldTypeId

the type of the extracted field

is_list: bool

if true, the extract function returns a Vec of values, not a single one

arg: ExtractArgType

the type of argument the extract function takes

display_name: Option<&'static str>

the display name for the extracted field, defaulting to the name

description: &'static str

a description for the extracted field, mandatory but defaults to the name

add_output: bool

suggest that this field be included in output for compatible event sources

func: ExtractLambda<P>

the function implementing the actual extraction

Implementations

impl<P: ExtractPlugin> ExtractFieldInfo<P>

pub const fn with_display(self, display_name: &'static str) -> Self

Set the display name fdr the extracted field

pub const fn with_description(self, description: &'static str) -> Self

Set the description for the extracted field

pub const fn add_output(self) -> Self

Suggest this field to be appended to the output string for compatible event sources

Trait Implementations

impl<P: ExtractPlugin> Debug for ExtractFieldInfo<P>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<P: ExtractPlugin> Serialize for ExtractFieldInfo<P>

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.