The figure below illustrates the type system at a glance:
There exist two major classes of types:
- Basic: types with static structure with a-priori known representation
- Recursive: types that can contain nested types
listfor value sequences and
mapfor key-value pairs
- Compound: a
recordconsisting of named fields
- Alias: named types
Every type has zero or more attributes, which are free-form key-value pairs
to further specify type semantics. For example, the
replaces the default index with a more space-efficient implementation.
To illustrate how the type system interacts with table slices, consider the following example with an event layout (left) along with the corresponding table slice (right):
A table slice layout is always a record type whose fields map to column names.
In this example, the record type has the name
R and the record has three
C. The type of
timestamp, which is defined in
base library and represents the event timestamp. The type of
string with the
#index=hash attribute so this column will use a space
efficient hash index. The last event added to this table slice was
<2020-01-03, "baz", 4.2>.
|Denotes an absent or invalid value|
|A boolean value|
|A 64-bit signed integer|
|A 64-bit unsigned integer|
|A 64-bit double (IEEE 754)|
|A time span (nanosecond granularity)|
|A time point (nanosecond granularity)|
|A sequence of characters|
|A regular expression|
|An IPv4 or IPv6 address|
|An IPv4 or IPv6 subnet|
Container types can have zero or more values of a given type, but they count still as single value.
|An (ordered) sequence of values where each element has type |
|An associate array which maps a keys of type |
There exists one compound type: the
record type. It is a
product type like a
C struct or JSON object. By
design, every table slice uses a
record type to describe its layout. Records
consist of one or more fields, each of which have a name and a type.
For example, this is a record with the two fields named
In the schema language, alias types make it possible to assign a name to a type.
This is commonly used for defining named records, but all types can be aliased
including other aliases. Aliases on basic types can be used to allow for more
fine grained type extractor lookups.
Aliases on records enable reuse of definitions and tie into the
vast import command.
A type can have additional key-value pair attributes to enrich its semantics.
VAST uses some attributes keys internally, e.g.,
#index=hash to indicate that
the values of a field will be indexed by a hash based index. Attributes have an
optional value. For example, both
#foo="bar" is a valid attribute.