falco_plugin/plugin/source/
event_batch.rs

1use falco_event::events::EventToBytes;
2
3/// # An object that describes a batch of events
4///
5/// This is only available by reference, not by ownership, since the data needs to outlive
6/// the plugin API call and is stored elsewhere (in a wrapper struct that's not exposed to
7/// plugin developers)
8#[derive(Debug)]
9pub struct EventBatch<'a> {
10    alloc: &'a bumpalo::Bump,
11    pointers: bumpalo::collections::Vec<'a, *const u8>,
12}
13
14impl EventBatch<'_> {
15    pub(in crate::plugin::source) fn new(alloc: &bumpalo::Bump) -> EventBatch {
16        let pointers = bumpalo::collections::Vec::new_in(alloc);
17        EventBatch { alloc, pointers }
18    }
19
20    /// # Add an event to a batch
21    ///
22    /// The event can be any type, but please note that the framework may have different
23    /// opinions on this. For example, only source plugins with the `syscall` source can generate
24    /// events other than [`source::PluginEvent`](`crate::source::PluginEvent`)
25    ///
26    /// **Note**: to generate such events, you may use
27    /// the [`source::SourcePluginInstance::plugin_event`](`crate::source::SourcePluginInstance::plugin_event`)
28    /// helper method.
29    pub fn add(&mut self, event: impl EventToBytes) -> std::io::Result<()> {
30        let mut event_buf =
31            bumpalo::collections::Vec::with_capacity_in(event.binary_size(), self.alloc);
32        event.write(&mut event_buf)?;
33        self.pointers.push(event_buf.as_ptr());
34        Ok(())
35    }
36
37    /// # Reserve space for a specific number of events
38    ///
39    /// If your plugin knows it's going to generate a specific number of events
40    /// in a particular batch, it can call this method to preallocate some space
41    /// and save a bit of overhead.
42    ///
43    /// The passed value is only a hint, the actual batch can be smaller or larger
44    /// than the reserved size, but that mostly defeats the purpose of reserving
45    /// space
46    pub fn reserve(&mut self, num_events: usize) {
47        self.pointers.reserve(num_events);
48    }
49
50    pub(in crate::plugin::source) fn get_events(&self) -> &[*const u8] {
51        self.pointers.as_slice()
52    }
53}
falco_plugin/plugin/source/event_batch.rs

falco_plugin/plugin/source/
event_batch.rs
