The figure below illustrates the type system at a glance:
There exist two major classes of types:
- Basic: types with static structure with a-priori known representation
- Recursive: types that can contain nested types
- Container: vectors, sets, and tables
- Compound: product types in the form of records with fields
Every type has zero or more attributes, which are free-form key-value pairs
to further specify type semantics. For example, the
(key only) marks a type as representative for the event timestamp.
To illustrate how the type system interacts with table slices, consider the following example with an event layout (left) along with the corresponding table slice (right):
A table slice layout is always a record type whose fields map to column names.
In this example, the record type has the name
R and the record has three
C. The type of
time, which represents a point
in time. It has the
#timestamp attribute to indidcate that this column should
represent the event timestamp. The last event added to this table slice was
<2020-01-03, "baz", 4.2>.
|Denotes an absent or invalid value|
|A boolean value|
|A 64-bit signed integer|
|A 64-bit unsigned integer|
|A 64-bit double (IEEE 754)|
|A time span (nanosecond granularity)|
|A time point (nanosecond granularity)|
|A sequence of characters|
|A regular expression|
|An IPv4 or IPv6 address|
|An IPv4 or IPv6 subnet|
|A transport-layer port and protocol|
Container types can have zero or more values of a given type, but they count still as single value.
|An (ordered) sequence of values where each element has type |
|A set of (unique) values where each element has type |
|An associate array which maps a keys of type |
Currently, there exists only one compound type: the
record types. It is
product type, similar to a
C struct or JSON record. By
design, every table slice has a
record as layout. Records consist of one
or more fields, each of which have a name and a type.
A type can have additional key-value pair attributes to enrich its semantics.
VAST uses some attributes keys internally, e.g.,
#timestamp to indicate that
this field denotes the event timestamp. Attributes have an optional value. For
#foo="bar" is a valid attribute.