evaluator

evaluator

Shape-specific evaluators that turn a compiled trigger into a detector DataFrame in the same format the shape-driven adapter already consumes.

Point and summary rules pass matching rows through; interval rules coalesce contiguous True runs (per group_by) into single rows with start/end/duration; static rules emit a single summary row.

Whatever the shape, the returned frame is fed verbatim to :func:~ts_shape.eventlog.to_event_log, which then exercises the same adapter, EID generation, severity bucketing, object auto-extraction and schema validation as built-in detectors. No parallel pipeline.

evaluate

evaluate(
    spec: RuleSpec, dataframe: DataFrame
) -> pd.DataFrame

Run spec against dataframe and return a detector frame.

The output column conventions match what the shape adapter expects:

• shape="point" | "summary": original rows with a systime-like timestamp column preserved (no renaming).
• shape="interval": rows with start, end, source_uuid (if present), the group_by columns, the value column (mean over the run), the severity column (max) and sample_count. A run is half-open: it ends at the next sample after its last True row (at the last True row when no sample follows), like :func:ts_shape.signals.primitives.intervals.
• shape="static": a single row carrying summary fields.

Parameters:

Name	Type	Description	Default
spec	RuleSpec	The rule.	required
dataframe	DataFrame	Input frame the trigger is evaluated on.	required

Returns:

Type	Description
DataFrame	The detector frame; an empty (typed, for interval rules) frame when
DataFrame	nothing triggers.

Raises:

Type	Description
ColumnNotFoundError	When the trigger names a column dataframe lacks.
ValueError	When the trigger is not boolean, or an interval rule finds no time column.