VRL Example Reference

Here you'll find a comprehensive list of all VRL program examples. These examples demonstrate the bredth of the language and the observability-focused facilities.

Real-world examples

Parse Syslog logs

Vector event (before)
{
"message": "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
}
VRL program
structured = parse_syslog!(.message)
. = merge(., structured)
Vector event (after)
{
"appname": "su",
"facility": "ntp",
"hostname": "vector-user.biz",
"message": "Something went wrong",
"msgid": "ID389",
"procid": 2666,
"severity": "info",
"timestamp": "2020-12-22T15:22:31.111Z"
}

Parse key/value (logfmt) logs

Vector event (before)
{
"message": "@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
}
VRL program
structured = parse_key_value!(.message)
. = merge(., structured)
Vector event (after)
{
"@timestamp": "Sun Jan 10 16:47:39 EST 2021",
"level": "info",
"msg": "Stopping all fetchers",
"tag#production": "stopping_fetchers",
"id": "ConsumerFetcherManager-1382721708341",
"module": "kafka.consumer.ConsumerFetcherManager"
}

Parse custom logs

Vector event (before)
{
"message": "2021/01/20 06:39:15 [error] 17755#17755: *3569904 open() \"/usr/share/nginx/html/test.php\" failed (2: No such file or directory), client: xxx.xxx.xxx.xxx, server: localhost, request: \"GET /test.php HTTP/1.1\", host: \"yyy.yyy.yyy.yyy\""
}
VRL program
structured = parse_regex!(.message, /^(?P<timestamp>\d+/\d+/\d+ \d+:\d+:\d+) \[(?P<severity>\w+)\] (?P<pid>\d+)#(?P<tid>\d+):(?: \*(?P<connid>\d+))? (?P<message>.*)$/)
. = merge(., structured)
# Coerce parsed fields
.timestamp = parse_timestamp(.timestamp, "%Y/%m/%d %H:%M:%S") ?? now()
.pid = to_int(.pid)
.tid = to_int(.tid)
# Extract structured data
message_parts = split(.message, ", ", limit: 2)
structured = parse_key_value(message_parts[1], key_value_delimiter: ":", field_delimiter: ",") ?? {}
.message = message_parts[0]
. = merge(., structured)
Vector event (after)
{
"timestamp": "2021/01/20 06:39:15",
"severity": "error",
"pid": "17755",
"tid": "17755",
"connid": "3569904",
"message": "open() \"/usr/share/nginx/html/test.php\" failed (2: No such file or directory)",
"client": "xxx.xxx.xxx.xxx",
"server": "localhost",
"request": "GET /test.php HTTP/1.1",
"host": "yyy.yyy.yyy.yyy"
}

Multiple parsing strategies

Vector event (before)
{
"message": "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
}
VRL program
structured =
parse_syslog(.message) ??
parse_common_log(.message) ??
parse_regex!(.message, /^(?P<timestamp>\d+/\d+/\d+ \d+:\d+:\d+) \[(?P<severity>\w+)\] (?P<pid>\d+)#(?P<tid>\d+):(?: \*(?P<connid>\d+))? (?P<message>.*)$/)
. = merge(., structured)
Vector event (after)
{
"appname": "su",
"facility": "ntp",
"hostname": "vector-user.biz",
"message": "Something went wrong",
"msgid": "ID389",
"procid": 2666,
"severity": "info",
"timestamp": "2020-12-22 15:22:31.111 UTC"
}

Modify metric tags

Vector event (before)
{
"kind": "incremental",
"name": "user_login_total",
"counter": {
"value": 102.0
},
"tags": {
"host": "my.host.com",
"instance_id": "abcd1234",
"email": "vic@vector.dev"
}
}
VRL program
.environment = get_env_var!("ENV") # add
.hostname = del(.host) # rename
del(.email)
Vector event (after)
{
"kind": "incremental",
"name": "user_login_total",
"counter": {
"value": 102.0
},
"tags": {
"environment": "production",
"hostname": "my.host.com",
"instance_id": "abcd1234"
}
}

Array examples

Append to an array

append([1, 2], [3, 4])
[
1,
2,
3,
4
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the append function.

Push an item onto an array

push([1, 2], 3)
[
1,
2,
3
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the push function.

Codec examples

Decode Base64 data (URL safe)

decode_base64("eW91IGNhbid0IG1ha2UgeW91ciBoZWFydCBmZWVsIHNvbWV0aGluZyBpdCB3b24ndA==", charset: "url_safe")
"you can't make your heart feel something it won't"
Try it yourself with the `vector vrl` subcommand.

Learn more about the decode_base64 function.

Decode Base64 data (default)

decode_base64("eW91IGhhdmUgc3VjY2Vzc2Z1bGx5IGRlY29kZWQgbWU=")
"you have successfully decoded me"
Try it yourself with the `vector vrl` subcommand.

Learn more about the decode_base64 function.

Encode to Base64 (URL safe)

encode_base64("please encode me, but safe for URLs", charset: "url_safe")
"cGxlYXNlIGVuY29kZSBtZSwgYnV0IHNhZmUgZm9yIFVSTHM="
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_base64 function.

Encode to Base64 (default)

encode_base64("please encode me")
"cGxlYXNlIGVuY29kZSBtZQ=="
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_base64 function.

Encode to Base64 (without padding)

encode_base64("please encode me, no padding though", padding: false)
"cGxlYXNlIGVuY29kZSBtZSwgbm8gcGFkZGluZyB0aG91Z2g"
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_base64 function.

Encode to JSON

.payload = encode_json({"hello": "world"})
"{\"hello\": \"world\"}"
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_json function.

Coerce examples

Coerce to Syslog serverity

to_syslog_severity("alert")
1
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_syslog_severity function.

Coerce to a Syslog facility

to_syslog_facility("4")
"auth"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_syslog_facility function.

Coerce to a Syslog level

to_syslog_level("5")
"notice"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_syslog_level function.

Coerce to a boolean (boolean)

to_bool(true)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a boolean (float)

to_bool(0.0)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a boolean (int)

to_bool(0)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a boolean (null)

to_bool(null)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a boolean (string)

to_bool("yes")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a float

to_float("3.145")
3.145
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_float function.

Coerce to a string (boolean)

to_string(true)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_string function.

Coerce to a string (float)

to_string(52.2)
"52.2"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_string function.

Coerce to a string (int)

to_string(52)
"52"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_string function.

Coerce to a timestamp

to_timestamp("2020-10-21T16:00:00Z")
"2020-10-21T16:00:00Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_timestamp function.

Coerce to an int (string)

to_int("2")
2
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_int function.

Coerce to an int (timestamp)

to_int(to_timestamp("2020-12-30 22:20:53.824727 UTC"))
1609366853
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_int function.

Convert to a Unix timestamp (milliseconds)

to_unix_timestamp(to_timestamp("2021-01-01T00:00:00+00:00"), unit: "milliseconds")
1609459200000
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_unix_timestamp function.

Convert to a Unix timestamp (nanoseconds)

to_unix_timestamp(to_timestamp("2021-01-01T00:00:00+00:00"), unit: "nanoseconds")
1609459200000000000
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_unix_timestamp function.

Convert to a Unix timestamp (seconds)

to_unix_timestamp(to_timestamp("2021-01-01T00:00:00+00:00"))
1609459200
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_unix_timestamp function.

Debug examples

Assertion (false)

assert("foo" == "bar", message: "Foo must be foo!")
Foo must be foo!

Learn more about the assert function.

Assertion (true)

assert("foo" == "foo", message: "Foo must be foo!")
null
Try it yourself with the `vector vrl` subcommand.

Learn more about the assert function.

Log a message

log("Hello, World!", level: "info")
null
Try it yourself with the `vector vrl` subcommand.

Learn more about the log function.

Log an error

ts, err = format_timestamp(to_timestamp("10-Oct-2020 1"))
if err != null {
log(err, level: "error")
}
null
Try it yourself with the `vector vrl` subcommand.

Learn more about the log function.

Enumerate examples

Array includes

includes(["apple", "orange", "banana"], "banana")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the includes function.

Compact an array

compact(["foo", "bar", "", null, [], "buzz"], string: true, array: true, null: true)
[
"foo",
"bar",
"buzz"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the compact function.

Compact an object

compact({"field1": 1, "field2": "", "field3": [], "field4": null}, string: true, array: true, null: true)
{
"field1": 1
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the compact function.

Flatten array

flatten([1, [2, 3, 4], [5, [6, 7], 8], 9])
[
1,
2,
3,
4,
5,
6,
7,
8,
9
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the flatten function.

Flatten object

flatten({
"parent1": {
"child1": 1,
"child2": 2
},
"parent2": {
"child3": 3
}
})
{
"grandparent.parent1.child1": 1,
"grandparent.parent1.child2": 2,
"grandparent.parent2.child1": 2
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the flatten function.

Length (array)

length(["Trail Blazers", "Supersonics", "Grizzlies"])
3
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Length (nested object)

length({
"home": {
"city": "Portland"
"state": "Oregon"
}
"name": "Trail Blazers"
"mascot": {
"name": "Blaze the Trail Cat"
}
})
3
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Length (object)

length({
"portland": "Trail Blazers"
"seattle": "Supersonics"
})
2
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Length (string)

length("The Planet of the Apes Musical")
30
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Event examples

Delete a field

Vector event (before)
{
"field1": 1,
"field2": 2
}
VRL program
del(.field1)
Vector event (after)
{
"field2": 2
}

Learn more about the del function.

Exists (field)

Vector event
{
"field": 1
}
VRL program
exists(.field)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the exists function.

Exits (array element)

Vector event
{
"array": [
1,
2,
3
]
}
VRL program
exists(.array[2])
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the exists function.

Rename a field

Vector event (before)
{
"old_field": "please rename me"
}
VRL program
.new_field = del(.old_field)
Vector event (after)
{
"new_field": "please rename me"
}

Learn more about the del function.

Hash examples

Calaculate sha3 hash

sha3("foo", variant: "SHA3-224")
"f4f6779e153c391bbd29c95e72b0708e39d9166c7cea51d1f10ef58a"
Try it yourself with the `vector vrl` subcommand.

Learn more about the sha3 function.

Calculate sha1 hash

sha1("foo")
"0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33"
Try it yourself with the `vector vrl` subcommand.

Learn more about the sha1 function.

Calculate sha2 hash

sha2("foo", variant = "SHA-512/224")
"d68f258d37d670cfc1ec1001a0394784233f88f056994f9a7e5e99be"
Try it yourself with the `vector vrl` subcommand.

Learn more about the sha2 function.

Create md5 hash

md5("foo")
"acbd18db4cc2f85cedef654fccc4a4d8"
Try it yourself with the `vector vrl` subcommand.

Learn more about the md5 function.

IP examples

IPv4 contains CIDR

ip_cidr_contains("192.168.0.0/16", "192.168.10.32")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_cidr_contains function.

IPv4 subnet

ip_subnet("192.168.10.32", "255.255.255.0")
"192.168.10.0"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_subnet function.

IPv4 to IPv6

ip_to_ipv6("192.168.10.32")
"::ffff:192.168.10.32"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_to_ipv6 function.

IPv6 contains CIDR

ip_cidr_contains("2001:4f8:4:ba::/64", "2001:4f8:4:ba:2e0:81ff:fe22:d1f1")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_cidr_contains function.

IPv6 subnet

ip_subnet("2404:6800:4003:c02::64", "/32")
"2404:6800::"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_subnet function.

IPv6 to IPv4

ipv6_to_ipv4("::ffff:192.168.0.1")
"192.168.0.1"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ipv6_to_ipv4 function.

Number examples

Format a number (3 decimals)

format_number(1234567.89, 3, decimal_separator: ".", grouping_separator: ",")
"1,234,567.890"
Try it yourself with the `vector vrl` subcommand.

Learn more about the format_number function.

Round a number (with precision)

round(4.345, precision: 2)
4.35
Try it yourself with the `vector vrl` subcommand.

Learn more about the round function.

Round a number (without precision)

round(4.345)
4
Try it yourself with the `vector vrl` subcommand.

Learn more about the round function.

Round a number down (with precision)

floor(4.345, precision: 2)
4.34
Try it yourself with the `vector vrl` subcommand.

Learn more about the floor function.

Round a number down (without precision)

floor(4.345)
4
Try it yourself with the `vector vrl` subcommand.

Learn more about the floor function.

Round a number up (with precision)

ceil(4.345, precision: 2)
4.35
Try it yourself with the `vector vrl` subcommand.

Learn more about the ceil function.

Round a number up (without precision)

ceil(4.345)
4
Try it yourself with the `vector vrl` subcommand.

Learn more about the ceil function.

Object examples

Object merge (deep)

merge(
{
"parent1": {
"child1": 1,
"child2": 2
},
"parent2": {
"child3": 3
}
},
{
"parent1": {
"child2": 4,
"child5": 4
}
},
deep: true
)
{
"parent1": {
"child1": 1,
"child2": 4,
"child5": 5
},
"parent2": {
"child3": 3
}
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the merge function.

Object merge (shallow)

merge(
{
"parent1": {
"child1": 1,
"child2": 2
},
"parent2": {
"child3": 3
}
},
{
"parent1": {
"child2": 4,
"child5": 4
}
}
)
{
"parent1": {
"child2": 4,
"child5": 5
},
"parent2": {
"child3": 3
}
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the merge function.

Parse examples

Parse AWS ALB log

parse_aws_alb_log(
"http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 - 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" \"-\" \"-\" 0 2018-11-30T22:22:48.364000Z \"forward\" \"-\" \"-\" \"-\" \"-\" \"-\" \"-\""
)
{
"type": "http",
"timestamp": "2018-11-30T22:23:00.186641Z",
"elb": "app/my-loadbalancer/50dc6c495c0c9188",
"client_host": "192.168.131.39:2817",
"target_host": null,
"request_processing_time": 0.0,
"target_processing_time": 0.001,
"response_processing_time": 0.0,
"elb_status_code": "200",
"target_status_code": "200",
"received_bytes": 34,
"sent_bytes": 366,
"request_method": "GET",
"request_url": "http://www.example.com:80/",
"request_protocol": "HTTP/1.1",
"user_agent": "curl/7.46.0",
"ssl_cipher": null,
"ssl_protocol": null,
"target_group_arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067",
"trace_id": "Root=1-58337364-23a8c76965a2ef7629b185e3",
"domain_name": null,
"chosen_cert_arn": null,
"matched_rule_priority": "0",
"request_creation_time": "2018-11-30T22:22:48.364000Z",
"actions_executed": "forward",
"redirect_url": null,
"error_reason": null,
"target_port_list": [
],
"target_status_code_list": [
],
"classification": null,
"classification_reason": null
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_aws_alb_log function.

Parse AWS Cloudwatch Log subscription message

Vector event (before)
{
"message": "{\n \"messageType\": \"DATA_MESSAGE\",\n \"owner\": \"111111111111\",\n \"logGroup\": \"test\",\n \"logStream\": \"test\",\n \"subscriptionFilters\": [\n\t\"Destination\"\n ],\n \"logEvents\": [\n\t{\n\t \"id\": \"35683658089614582423604394983260738922885519999578275840\",\n\t \"timestamp\": 1600110569039,\n\t \"message\": \"{\"bytes\":26780,\"datetime\":\"14/Sep/2020:11:45:41 -0400\",\"host\":\"157.130.216.193\",\"method\":\"PUT\",\"protocol\":\"HTTP/1.0\",\"referer\":\"https://www.principalcross-platform.io/markets/ubiquitous\",\"request\":\"/expedite/convergence\",\"source_type\":\"stdin\",\"status\":301,\"user-identifier\":\"-\"}\"\n\t}\n ]\n}"
}
VRL program
parse_aws_cloudwatch_log_subscription_message(.message)
Vector event (after)
{
"owner": "111111111111",
"message_type": "DATA_MESSAGE",
"log_group": "test",
"log_stream": "test",
"subscription_filters": [
"Destination"
],
"log_events": [
{
"id": "35683658089614582423604394983260738922885519999578275840",
"message": "{\"bytes\":26780,\"datetime\":\"14/Sep/2020:11:45:41 -0400\",\"host\":\"157.130.216.193\",\"method\":\"PUT\",\"protocol\":\"HTTP/1.0\",\"referer\":\"https://www.principalcross-latform.io/markets/ubiquitous\",\"request\":\"/expedite/convergence\",\"source_type\":\"stdin\",\"status\":301,\"user-identifier\":\"-\"}",
"timestamp": "2020-09-14T19:09:29.039Z"
}
]
}

Learn more about the parse_aws_cloudwatch_log_subscription_message function.

Parse AWS VPC Flow log (custom format)

parse_aws_vpc_flow_log(
"- eni-1235b8ca123456789 10.0.1.5 10.0.0.220 10.0.1.5 203.0.113.5",
"instance_id interface_id srcaddr dstaddr pkt_srcaddr pkt_dstaddr"
)
{
"instance_id": null,
"interface_id": "eni-1235b8ca123456789",
"srcaddr": "10.0.1.5",
"dstaddr": "10.0.0.220",
"pkt_srcaddr": "10.0.1.5",
"pkt_dstaddr": "203.0.113.5"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_aws_vpc_flow_log function.

Parse AWS VPC Flow log (default format)

parse_aws_vpc_flow_log("2 123456789010 eni-1235b8ca123456789 - - - - - - - 1431280876 1431280934 - NODATA")
{
"version": 2,
"account_id": 123456789010,
"interface_id": "eni-1235b8ca123456789",
"srcaddr": null,
"dstaddr": null,
"srcport": null,
"dstport": null,
"protocol": null,
"packets": null,
"bytes": null,
"start": 1431280876,
"end": 1431280934,
"action": null,
"log_status": "NODATA"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_aws_vpc_flow_log function.

Parse JSON

parse_json("{\"key\": \"val\"}")
{
"key": "val"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_json function.

Parse Syslog log (5424)

parse_syslog(
"<13>1 2020-03-13T20:45:38.119Z dynamicwireless.name non 2426 ID931 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"] Try to override the THX port, maybe it will reboot the neural interface!"
)
{
"severity": "notice",
"facility": "user",
"timestamp": "2020-03-13T20:45:38.119Z",
"hostname": "dynamicwireless.name",
"appname": "non",
"procid": "2426",
"msgid": "ID931",
"iut": "3",
"eventSource": "Application",
"eventID": "1011",
"message": "Try to override the THX port, maybe it will reboot the neural interface!"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_syslog function.

Parse URL

parse_url("ftp://foo:bar@vector.dev:4343/foobar?hello=world#123")
{
"scheme": "ftp",
"username": "foo",
"password": "bar",
"host": "vector.dev",
"port": 4343,
"path": "/foobar",
"query": {
"hello": "world"
},
"fragment": "123"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_url function.

Parse comma delimited log

parse_key_value(
"path:\"/cart_link\", host:store.app.com, fwd: \"102.30.171.16\", dyno: web.1 connect:0ms, service:87ms, status:304, bytes:632, protocol:https",
field_delimiter: ",",
key_value_delimiter: ":"
)
{
"path": "/cart_link",
"host": "store.app.com",
"fwd": "102.30.171.16",
"dyno": "web.1",
"connect": "0ms",
"service": "87ms",
"status": "304",
"bytes": "632",
"protocol": "https"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_key_value function.

Parse duration (milliseconds)

parse_duration("1005ms", unit: "s")
1.005
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_duration function.

Parse logfmt log

parse_key_value(
"@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
)
{
"@timestamp": "Sun Jan 10 16:47:39 EST 2021",
"level": "info",
"msg": "Stopping all fetchers",
"tag#production": "stopping_fetchers",
"id": "ConsumerFetcherManager-1382721708341",
"module": "kafka.consumer.ConsumerFetcherManager"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_key_value function.

Parse timestamp

parse_timestamp("10-Oct-2020 16:00", format: "%v %R")
"2020-10-10T16:00:00Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_timestamp function.

Parse tokens

parse_tokens(
"A sentence \"with \\"a\\" sentence inside\" and [some brackets]"
)
[
"A",
"sentence",
"with \\\"a\\\" sentence inside",
"and",
"some brackets"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_tokens function.

Parse via Common Log Format (with custom timestamp format)

parse_common_log(
"127.0.0.1 bob frank [2000-10-10T20:55:36Z] \"GET /apache_pb.gif HTTP/1.0\" 200 2326",
"%+"
)
{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_common_log function.

Parse via Common Log Format (with default timestamp format)

parse_common_log("127.0.0.1 bob frank [10/Oct/2000:13:55:36 -0700] \"GET /apache_pb.gif HTTP/1.0\" 200 2326")
{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_common_log function.

Parse via Grok

parse_grok(
"2020-10-02T23:22:12.223222Z info Hello world",
"%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"
)
{
"timestamp": "2020-10-02T23:22:12.223222Z",
"level": "info",
"message": "Hello world"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_grok function.

Parse via Regex (all matches)

parse_regex_all("first group and second group.", r'(?P<number>.*?) group')
[
{
"number": "first",
"0": "first group",
"1": "first"
},
{
"number": "second",
"0": "second group",
"1": "second"
}
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_regex_all function.

Parse via Regex (with capture groups)

parse_regex("first group and second group.", r'(?P<number>.*?) group')
{
"number": "first",
"0": "first group",
"1": "first"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_regex function.

Parse via Regex (without capture groups)

parse_regex("first group and second group.", r'(?.*?) group')
{
"1": "first"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_regex function.

Parse via glog

parse_glog("I20210131 14:48:54.411655 15520 main.c++:9] Hello world!")
{
"level": "info",
"timestamp": "2021-01-31T14:48:54.411655Z",
"id": 15520,
"file": "main.c++",
"line": 9,
"message": "Hello world!"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_glog function.

Random examples

Create a UUIDv4

uuid_v4()
"1d262f4f-199b-458d-879f-05fd0a5f0683"
Try it yourself with the `vector vrl` subcommand.

Learn more about the uuid_v4 function.

String examples

Downcase a string

downcase("Hello, World!")
"hello, world!"
Try it yourself with the `vector vrl` subcommand.

Learn more about the downcase function.

Join array (comma separator)

join(["sources", "transforms", "sinks"], separator: ", ")
"sources, transforms, sinks"
Try it yourself with the `vector vrl` subcommand.

Learn more about the join function.

Join array (no separator)

join(["bring", "us", "together"])
"bringustogether"
Try it yourself with the `vector vrl` subcommand.

Learn more about the join function.

Redact (credit card number)

redact("9876123454320123", filters: ["pattern"], redactor: "full", patterns: [r'[0-9]{16}'])
"****"
Try it yourself with the `vector vrl` subcommand.

Learn more about the redact function.

Redact (email address)

redact("vic@vector.dev", filters: ["pattern"], redactor: "full", patterns: [r'^\S+@\S+$'])
"****"
Try it yourself with the `vector vrl` subcommand.

Learn more about the redact function.

Regex match on a string

match("I'm a little teapot", r'teapot')
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the match function.

Replace first instance

replace("Bananas and Bananas", "Bananas", "Pineapples", count: 1)
"Pineapples and Bananas"
Try it yourself with the `vector vrl` subcommand.

Learn more about the replace function.

Replace literal text

replace("Apples and Bananas", "and", "not")
"Apples not Bananas"
Try it yourself with the `vector vrl` subcommand.

Learn more about the replace function.

Replace via regular expression

replace("Apples and Bananas", r'bananas'i, "Pineapples")
"apples and Pineapples"
Try it yourself with the `vector vrl` subcommand.

Learn more about the replace function.

Slice a string (negative index)

slice("Supercalifragilisticexpialidocious", start: 5, end: -14)
"califragilistic"
Try it yourself with the `vector vrl` subcommand.

Learn more about the slice function.

Slice a string (positve index)

slice("Supercalifragilisticexpialidocious", start: 5, end: 13)
"califrag"
Try it yourself with the `vector vrl` subcommand.

Learn more about the slice function.

Split a string (no limit)

split("apples and pears and bananas", " and ")
[
"apples",
"pears",
"bananas"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the split function.

Split a string (with a limit)

split("apples and pears and bananas", " and ", limit: 1)
[
"apples",
"pears and bananas"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the split function.

String contains (case insensitive)

contains("The Needle In The Haystack", "needle", case_sensitive: false)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the contains function.

String contains (case sensitive)

contains("The Needle In The Haystack", "Needle")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the contains function.

String ends with (case insensitive)

ends_with("The Needle In The Haystack", "the haystack", case_sensitive: false)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ends_with function.

String ends with (case sensitive)

ends_with("The Needle In The Haystack", "The Haystack")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ends_with function.

String starts with (case insensitive)

starts_with("The Needle In The Haystack", \"the needle\", case_sensitive: false)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the starts_with function.

String starts with (case sensitive)

starts_with("The Needle In The Haystack", \"The Needle\")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the starts_with function.

Strip ANSI escape codes

strip_ansi_escape_codes("\e[46mfoo\e[0m bar")
"foo bar"
Try it yourself with the `vector vrl` subcommand.

Learn more about the strip_ansi_escape_codes function.

Strip whitespace

strip_whitespace(" A sentence. ")
"A sentence."
Try it yourself with the `vector vrl` subcommand.

Learn more about the strip_whitespace function.

Truncate a string

truncate("A rather long sentence.", limit = 11, ellipsis = true)
"A rather lo..."
Try it yourself with the `vector vrl` subcommand.

Learn more about the truncate function.

Upcase a string

VRL program
upcase("Hello, World!")
Vector event (after)
{
"message": "HELLO, WORLD!"
}

Learn more about the upcase function.

System examples

Get environment variable

get_env_var("HOME")
"/root"
Try it yourself with the `vector vrl` subcommand.

Learn more about the get_env_var function.

Get hostname

Vector event (before)
{
}
VRL program
.hostname = get_hostname()
Vector event (after)
{
"hostname": "localhost.localdomain"
}

Learn more about the get_hostname function.

Timestamp examples

Format a timestamp (ISO8601/RFC 3339)

format_timestamp(now(), format: "%+")
"2020-10-21T16:00:00Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the format_timestamp function.

Format a timestamp (custom)

format_timestamp(now(), format: "%v %R")
"10-Oct-2020 16:00"
Try it yourself with the `vector vrl` subcommand.

Learn more about the format_timestamp function.

Generate a current timestamp

now()
"2020-10-21T20:53:12.212221Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the now function.

Type examples

Declare a boolean type

Vector event
{
"value": false
}
VRL program
bool(.value)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the bool function.

Declare a timestamp type

Vector event
{
"timestamp": "2020-10-10T16:00:00Z"
}
VRL program
timestamp(.timestamp)
"2020-10-10T16:00:00Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the timestamp function.

Declare an array type

Vector event
{
"value": [
1,
2,
3
]
}
VRL program
array(.value)
[
1,
2,
3
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the array function.

Declare an integer type

Vector event
{
"value": 42
}
VRL program
int(.value)
42
Try it yourself with the `vector vrl` subcommand.

Learn more about the int function.

Declare an object type

Vector event
{
"value": {
"field1": "value1",
"field2": "value2"
}
}
VRL program
object(.value)
{
"field1": "value1",
"field2": "value2"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the object function.

Delcare a float type

Vector event
{
"value": 42
}
VRL program
float(.radius)
42
Try it yourself with the `vector vrl` subcommand.

Learn more about the float function.

Delcare a string type

Vector event
{
"message": "eyJmaWVsZCI6ICJ2YWx1ZSJ9"
}
VRL program
string(.message)
"eyJmaWVsZCI6ICJ2YWx1ZSJ9"
Try it yourself with the `vector vrl` subcommand.

Learn more about the string function.

Null detection (blank string)

is_nullish("")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the is_nullish function.

Null detection (dash string)

is_nullish("-")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the is_nullish function.

Null detection (whitespace)

is_nullish("
")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the is_nullish function.

Contents