falco_event_serde/de/
mod.rs

1//! Deserialization support
2//!
3//! This module provides the deserialization support for Falco events in the form of an [`Event`]
4//! struct. The result of deserialization is not an event, but a vector of bytes that can be
5//! deserialized into an event using the `falco_event` crate.
6//!
7//! # Example
8//! ```
9//! use falco_event_schema::events::PPME_GENERIC_E;
10//! use falco_event_schema::fields::types::PT_SYSCALLID;
11//!
12//! // Use a JSON document as an example
13//! let json = r#"{
14//!     "ts": 1700000000,
15//!     "tid": 12345,
16//!     "GENERIC_E": {
17//!         "id": 1,
18//!         "native_id": 1001
19//!     }
20//! }"#;
21//!
22//! // Deserialize the JSON into a deserialized Falco event
23//! // This is not directly usable as an event, we have to convert and parse it first.
24//! let event: falco_event_serde::de::Event = serde_json::from_str(json).unwrap();
25//!
26//! // Convert the event to a byte vector
27//! let bytes = event.to_vec();
28//!
29//! // Now we can load the event using the falco_event crate
30//! let event = falco_event::events::RawEvent::from(&bytes).unwrap();
31//! let event = event.load::<PPME_GENERIC_E>().unwrap();
32//!
33//! // Check the deserialized parameters
34//! assert_eq!(event.params.id, Some(PT_SYSCALLID(1)));
35//! assert_eq!(event.params.native_id, Some(1001));
36//! ```
37mod events;
38mod payload;
39mod repr;
40
41pub use events::Event;
falco_event_serde/de/mod.rs

falco_event_serde/de/
mod.rs
