Trait enrichment::Table

source ·
pub trait Table: DynClone {
    // Required methods
    fn find_table_row<'a>(
        &self,
        case: Case,
        condition: &'a [Condition<'a>],
        select: Option<&[String]>,
        index: Option<IndexHandle>,
    ) -> Result<ObjectMap, String>;
    fn find_table_rows<'a>(
        &self,
        case: Case,
        condition: &'a [Condition<'a>],
        select: Option<&[String]>,
        index: Option<IndexHandle>,
    ) -> Result<Vec<ObjectMap>, String>;
    fn add_index(
        &mut self,
        case: Case,
        fields: &[&str],
    ) -> Result<IndexHandle, String>;
    fn index_fields(&self) -> Vec<(Case, Vec<String>)>;
    fn needs_reload(&self) -> bool;
}
Expand description

Enrichment tables represent additional data sources that can be used to enrich the event data passing through Vector.

Required Methods§

source

fn find_table_row<'a>( &self, case: Case, condition: &'a [Condition<'a>], select: Option<&[String]>, index: Option<IndexHandle>, ) -> Result<ObjectMap, String>

Search the enrichment table data with the given condition. All conditions must match (AND).

§Errors

Errors if no rows, or more than 1 row is found.

source

fn find_table_rows<'a>( &self, case: Case, condition: &'a [Condition<'a>], select: Option<&[String]>, index: Option<IndexHandle>, ) -> Result<Vec<ObjectMap>, String>

Search the enrichment table data with the given condition. All conditions must match (AND). Can return multiple matched records

source

fn add_index( &mut self, case: Case, fields: &[&str], ) -> Result<IndexHandle, String>

Hints to the enrichment table what data is going to be searched to allow it to index the data in advance.

§Errors

Errors if the fields are not in the table.

source

fn index_fields(&self) -> Vec<(Case, Vec<String>)>

Returns a list of the field names that are in each index

source

fn needs_reload(&self) -> bool

Returns true if the underlying data has changed and the table needs reloading.

Implementors§