search

n4r1b / ferrisetw

Basically a KrabsETW rip-off written in Rust
Other
65 stars 24 forks source link

Schema::properties() isn't public #128

Open vvuk opened 7 months ago

vvuk commented 7 months ago

Schema::properties() is currently pub(crate), but is there any reason it shouldn't be just pub? It's very useful for being able to inspect the properties in a schema; I couldn't find any other way of getting this list.

n4r1b commented 7 months ago

The properties were meant to be tied to the Parser so ideally you would use the Parser instance to access them. I'm not opposed to making this Schema::properties() if there're a good use case for this, or we could extend the Schema to cover this cases without directly exposing the properties. Let me know what you prefer @vvuk! Could you also give me some examples on use cases where you want to inspect the properties :)

gadol21 commented 1 month ago

@n4r1b Adding a use case that I have for this - I have an application that uses TraceLogging for its logs. I want to create a real-time log viewer. To do that I need a generic way to parse EventRecord, not knowing what properties exist in advance, because each log might contain different properties, and I don't want to need to need adjust the log viewer to know all the logs' properties. For that I need the property names exposed, as I simply want to fetch all properties, and I don't know the property names for a particular event. It doesn't matter to me if the properties are exposed from the parser or the schema object as long as there is some way to access them.

If deemed acceptable, I'll be happy to contribute this change.