Here are some patches to investigate event output. One is implementing a getter on the event (e.g. event.get("skb.tcp.flags") which works nicely. The other is trying to implement std::fmt::Display automatically on event sections, which turns out to be a mess IMHO. Some other variations are possible, but it does not change much of the current implementation.
Opening this PR for getting comments and ideas, and so you can try out if needed. I'm more and more leaning toward requiring std::fmt::Display on the event section and implementing it by hand for each of them. If so, there are two options:
Only supporting one format by default and using the getter for all custom formats.
Supporting multiple hardcoded formats, which is possible by using a similar construction as Path::display().
Another possibility is to only implement the field getter, implement an helper to format an event[1] and let sections return their default format. But performances might not be perfect in this case.
WDYT?
[1] Something like event.format("id: {skb-tracking.orig_head}{skb-tracking.timestamp} (tcp_flags: {skb.tcp.flags:#})? ...") which should support Option and formatting. Which is also a bit tricky, we have to handle our own format for option and for the formatting as well as we can't pass anything non static to format! and friends.
Here are some patches to investigate event output. One is implementing a getter on the event (e.g.
event.get("skb.tcp.flags")which works nicely. The other is trying to implementstd::fmt::Displayautomatically on event sections, which turns out to be a mess IMHO. Some other variations are possible, but it does not change much of the current implementation.Opening this PR for getting comments and ideas, and so you can try out if needed. I'm more and more leaning toward requiring
std::fmt::Displayon the event section and implementing it by hand for each of them. If so, there are two options:Path::display().Another possibility is to only implement the field getter, implement an helper to format an event[1] and let sections return their default format. But performances might not be perfect in this case.
WDYT?
[1] Something like
event.format("id: {skb-tracking.orig_head}{skb-tracking.timestamp} (tcp_flags: {skb.tcp.flags:#})? ...")which should supportOptionand formatting. Which is also a bit tricky, we have to handle our own format for option and for the formatting as well as we can't pass anything non static toformat!and friends.