falco_plugin/plugin/source/
event_batch.rs

1use falco_event::events::EventToBytes;
2
3/// # An object that describes a batch of events
4///
5/// This is only available by reference, not by ownership, since the data needs to outlive
6/// the plugin API call and is stored elsewhere (in a wrapper struct that's not exposed to
7/// plugin developers)
8#[derive(Debug)]
9pub struct EventBatch<'a> {
10    alloc: &'a bumpalo::Bump,
11    pointers: bumpalo::collections::Vec<'a, *const u8>,
12}
13
14impl EventBatch<'_> {
15    pub(in crate::plugin::source) fn new(alloc: &mut bumpalo::Bump) -> EventBatch {
16        let pointers = bumpalo::collections::Vec::new_in(alloc);
17        EventBatch { alloc, pointers }
18    }
19
20    /// # Add an event to a batch
21    ///
22    /// The event can be any type, but please note that the framework may have different
23    /// opinions on this. For example, only source plugins with the `syscall` source can generate
24    /// events other than [`source::PluginEvent`](`crate::source::PluginEvent`)
25    ///
26    /// **Note**: to generate such events, you may use
27    /// the [`source::SourcePluginInstance::plugin_event`](`crate::source::SourcePluginInstance::plugin_event`)
28    /// helper method.
29    pub fn add(&mut self, event: impl EventToBytes) -> std::io::Result<()> {
30        let mut event_buf = bumpalo::collections::Vec::new_in(self.alloc);
31        event.write(&mut event_buf)?;
32        self.pointers.push(event_buf.as_ptr());
33        Ok(())
34    }
35
36    /// # Reserve space for a specific number of events
37    ///
38    /// If your plugin knows it's going to generate a specific number of events
39    /// in a particular batch, it can call this method to preallocate some space
40    /// and save a bit of overhead.
41    ///
42    /// The passed value is only a hint, the actual batch can be smaller or larger
43    /// than the reserved size, but that mostly defeats the purpose of reserving
44    /// space
45    pub fn reserve(&mut self, num_events: usize) {
46        self.pointers.reserve(num_events);
47    }
48
49    pub(in crate::plugin::source) fn get_events(&self) -> &[*const u8] {
50        self.pointers.as_slice()
51    }
52}
falco_plugin/plugin/source/event_batch.rs

falco_plugin/plugin/source/
event_batch.rs
