Struct ProcessQueryBuilder 

pub struct ProcessQueryBuilder { /* private fields */ }

Builder for creating process queries with various filters.

This builder allows you to construct queries to find processes based on various criteria like process ID, username, executable name, time ranges, and whether they contain CPU blocks or specific thread names.

Implementations

impl ProcessQueryBuilder

pub fn new() -> Self

Creates a new ProcessQueryBuilder with no filters.

pub fn with_process_id(self, process_id: &str) -> Self

Filters processes by exact process ID.

pub fn with_username(self, username: &str) -> Self

Filters processes by exact username.

pub fn with_exe(self, exe: &str) -> Self

Filters processes by exact executable name.

pub fn since(self, begin: DateTime<Utc>) -> Self

Filters processes that ended at or after the given time.

pub fn until(self, end: DateTime<Utc>) -> Self

Filters processes that began at or before the given time.

pub fn with_cpu_blocks(self) -> Self

Filters processes that have CPU blocks (contain telemetry streams tagged with ‘cpu’).

pub fn with_thread_named(self, thread_name: &str) -> Self

Filters processes that have a thread with the specified name.

pub fn into_where(&self) -> String

Converts the filters into a SQL WHERE clause.

pub async fn query(self, client: &mut Client) -> Result<Vec<RecordBatch>>

Executes the query and returns the matching processes.

Returns a vector of RecordBatch containing process information including:

• process_id
• begin/end times
• exe (executable name)
• properties
• computer
• username
• cpu_brand
• distro

Trait Implementations

impl Default for ProcessQueryBuilder

fn default() -> Self

Returns the “default value” for a type.