align
align ¤
Align the events tables of multiple :class:EventLog instances to a
shared column set.
Different detectors emit the same 9-column canonical core but different
extra columns (standard-attr extensions, <pack>:<col> passthroughs).
:func:concat already unions columns on merge, but when callers want to
append / stack the per-detector frames themselves they need every frame to
expose an identical column set first. :func:align_columns provides that.
align_columns ¤
align_columns(*logs: EventLog) -> list[EventLog]
Reindex every log's events table to the union of their columns.
Each returned :class:EventLog exposes an identical, identically-ordered
set of event columns — the canonical core first (in emit order), then the
remaining attribute columns sorted for determinism. Columns absent from a
given log are added and filled with NA, so the frames can be appended or
stacked directly without a column mismatch. objects and relations
already have fixed schemas and are returned unchanged.
Returns a list parallel to the inputs. An empty call returns [].