omerbenamram / evtx

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
Apache License 2.0
625 stars 61 forks source link

RecordId should be public #234

Open jtmoon79 opened 1 year ago

jtmoon79 commented 1 year ago

tl;dr make type RecordId public so it can be used

I'd like to store the RecordId instance for later processing. While I know the RecordId is a u64, it would nice if I could simply refer to RecordId.

As in this contrived example.

use ::evtx::EvtxParser;
use ::evtx::RecordId;

fn main() {
    let fp = PathBuf::new();
    let mut parser = EvtxParser::from_path(fp).unwrap();
    let mut ids: Vec<RecordId> = vec![];
    for record in parser.records() {
        match record {
            Ok(r) => {
                ids.push(r.event_record_id);
            },
            _ => {},
        }
    }
}

Currently, that code does not compile

error[E0432]: unresolved import `evtx::RecordId`
 --> src\main.rs:2:5
  |
2 | use ::evtx::RecordId;
  |     ^^^^^^^^^^^^^^^^ no `RecordId` in the root

Using evtx version 0.8.1.