Trait vector::enrichment_tables::Table
source · pub trait Table: DynClone {
// Required methods
fn find_table_row<'a>(
&self,
case: Case,
condition: &'a [Condition<'a>],
select: Option<&[String]>,
index: Option<IndexHandle>,
) -> Result<BTreeMap<KeyString, Value>, String>;
fn find_table_rows<'a>(
&self,
case: Case,
condition: &'a [Condition<'a>],
select: Option<&[String]>,
index: Option<IndexHandle>,
) -> Result<Vec<BTreeMap<KeyString, Value>>, String>;
fn add_index(
&mut self,
case: Case,
fields: &[&str],
) -> Result<IndexHandle, String>;
fn index_fields(&self) -> Vec<(Case, Vec<String>)>;
fn needs_reload(&self) -> bool;
}Expand description
Enrichment tables represent additional data sources that can be used to enrich the event data passing through Vector.
Required Methods§
sourcefn find_table_row<'a>(
&self,
case: Case,
condition: &'a [Condition<'a>],
select: Option<&[String]>,
index: Option<IndexHandle>,
) -> Result<BTreeMap<KeyString, Value>, String>
fn find_table_row<'a>( &self, case: Case, condition: &'a [Condition<'a>], select: Option<&[String]>, index: Option<IndexHandle>, ) -> Result<BTreeMap<KeyString, Value>, String>
Search the enrichment table data with the given condition. All conditions must match (AND).
§Errors
Errors if no rows, or more than 1 row is found.
sourcefn find_table_rows<'a>(
&self,
case: Case,
condition: &'a [Condition<'a>],
select: Option<&[String]>,
index: Option<IndexHandle>,
) -> Result<Vec<BTreeMap<KeyString, Value>>, String>
fn find_table_rows<'a>( &self, case: Case, condition: &'a [Condition<'a>], select: Option<&[String]>, index: Option<IndexHandle>, ) -> Result<Vec<BTreeMap<KeyString, Value>>, String>
Search the enrichment table data with the given condition. All conditions must match (AND). Can return multiple matched records
sourcefn add_index(
&mut self,
case: Case,
fields: &[&str],
) -> Result<IndexHandle, String>
fn add_index( &mut self, case: Case, fields: &[&str], ) -> Result<IndexHandle, String>
Hints to the enrichment table what data is going to be searched to allow it to index the data in advance.
§Errors
Errors if the fields are not in the table.
sourcefn index_fields(&self) -> Vec<(Case, Vec<String>)>
fn index_fields(&self) -> Vec<(Case, Vec<String>)>
Returns a list of the field names that are in each index
sourcefn needs_reload(&self) -> bool
fn needs_reload(&self) -> bool
Returns true if the underlying data has changed and the table needs reloading.