Trait enrichment::Table

pub trait Table: DynClone {
    // Required methods
    fn find_table_row<'a>(
        &self,
        case: Case,
        condition: &'a [Condition<'a>],
        select: Option<&[String]>,
        index: Option<IndexHandle>,
    ) -> Result<ObjectMap, String>;
    fn find_table_rows<'a>(
        &self,
        case: Case,
        condition: &'a [Condition<'a>],
        select: Option<&[String]>,
        index: Option<IndexHandle>,
    ) -> Result<Vec<ObjectMap>, String>;
    fn add_index(
        &mut self,
        case: Case,
        fields: &[&str],
    ) -> Result<IndexHandle, String>;
    fn index_fields(&self) -> Vec<(Case, Vec<String>)>;
    fn needs_reload(&self) -> bool;
}

Enrichment tables represent additional data sources that can be used to enrich the event data passing through Vector.

Required Methods

fn find_table_row<'a>( &self, case: Case, condition: &'a [Condition<'a>], select: Option<&[String]>, index: Option<IndexHandle>, ) -> Result<ObjectMap, String>

Search the enrichment table data with the given condition. All conditions must match (AND).

Errors

Errors if no rows, or more than 1 row is found.

fn find_table_rows<'a>( &self, case: Case, condition: &'a [Condition<'a>], select: Option<&[String]>, index: Option<IndexHandle>, ) -> Result<Vec<ObjectMap>, String>

Search the enrichment table data with the given condition. All conditions must match (AND). Can return multiple matched records

fn add_index( &mut self, case: Case, fields: &[&str], ) -> Result<IndexHandle, String>

Hints to the enrichment table what data is going to be searched to allow it to index the data in advance.

Errors

Errors if the fields are not in the table.

fn index_fields(&self) -> Vec<(Case, Vec<String>)>

Returns a list of the field names that are in each index

fn needs_reload(&self) -> bool

Returns true if the underlying data has changed and the table needs reloading.

Implementors