VRL Example Reference

Here you'll find a comprehensive list of all VRL program examples. These examples demonstrate the bredth of the language and the observability-focused facilities.

Real-world examples

Parse Syslog logs

Vector event (before)
{
"message": "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
}
VRL program
. |= parse_syslog!(.message)
Vector event (after)
{
"appname": "su",
"facility": "ntp",
"hostname": "vector-user.biz",
"message": "Something went wrong",
"msgid": "ID389",
"procid": 2666,
"severity": "info",
"timestamp": "2020-12-22T15:22:31.111Z",
"version": 1
}

Parse key/value (logfmt) logs

Vector event (before)
{
"message": "@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
}
VRL program
. = parse_key_value!(.message)
Vector event (after)
{
"@timestamp": "Sun Jan 10 16:47:39 EST 2021",
"level": "info",
"msg": "Stopping all fetchers",
"tag#production": "stopping_fetchers",
"id": "ConsumerFetcherManager-1382721708341",
"module": "kafka.consumer.ConsumerFetcherManager"
}

Parse custom logs

Vector event (before)
{
"message": "2021/01/20 06:39:15 +0000 [error] 17755#17755: *3569904 open() \"/usr/share/nginx/html/test.php\" failed (2: No such file or directory), client: xxx.xxx.xxx.xxx, server: localhost, request: \"GET /test.php HTTP/1.1\", host: \"yyy.yyy.yyy.yyy\""
}
VRL program
. |= parse_regex!(.message, r'^(?P<timestamp>\d+/\d+/\d+ \d+:\d+:\d+ \+\d+) \[(?P<severity>\w+)\] (?P<pid>\d+)#(?P<tid>\d+):(?: \*(?P<connid>\d+))? (?P<message>.*)$')
# Coerce parsed fields
.timestamp = parse_timestamp(.timestamp, "%Y/%m/%d %H:%M:%S %z") ?? now()
.pid = to_int!(.pid)
.tid = to_int!(.tid)
# Extract structured data
message_parts = split(.message, ", ", limit: 2) ?? []
structured = parse_key_value(message_parts[1], key_value_delimiter: ":", field_delimiter: ",") ?? {}
.message = message_parts[0]
. = merge(., structured)
Vector event (after)
{
"0": "2021/01/20 06:39:15 +0000 [error] 17755#17755: *3569904 open() \"/usr/share/nginx/html/test.php\" failed (2: No such file or directory), client: xxx.xxx.xxx.xxx, server: localhost, request: \"GET /test.php HTTP/1.1\", host: \"yyy.yyy.yyy.yyy\"",
"1": "2021/01/20 06:39:15 +0000",
"2": "error",
"3": "17755",
"4": "17755",
"5": "3569904",
"6": "open() \"/usr/share/nginx/html/test.php\" failed (2: No such file or directory), client: xxx.xxx.xxx.xxx, server: localhost, request: \"GET /test.php HTTP/1.1\", host: \"yyy.yyy.yyy.yyy\"",
"timestamp": "2021-01-20T06:39:15Z",
"severity": "error",
"pid": 17755,
"tid": 17755,
"connid": "3569904",
"message": "open() \"/usr/share/nginx/html/test.php\" failed (2: No such file or directory)",
"client": "xxx.xxx.xxx.xxx",
"server": "localhost",
"request": "GET /test.php HTTP/1.1",
"host": "yyy.yyy.yyy.yyy"
}

Multiple parsing strategies

Vector event (before)
{
"message": "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
}
VRL program
structured =
parse_syslog(.message) ??
parse_common_log(.message) ??
parse_regex!(.message, r'^(?P<timestamp>\d+/\d+/\d+ \d+:\d+:\d+) \[(?P<severity>\w+)\] (?P<pid>\d+)#(?P<tid>\d+):(?: \*(?P<connid>\d+))? (?P<message>.*)$')
. = merge(., structured)
Vector event (after)
{
"appname": "su",
"facility": "ntp",
"hostname": "vector-user.biz",
"message": "Something went wrong",
"msgid": "ID389",
"procid": 2666,
"severity": "info",
"timestamp": "2020-12-22T15:22:31.111Z",
"version": 1
}

Modify metric tags

Vector event (before)
{
"kind": "incremental",
"name": "user_login_total",
"counter": {
"value": 102.0
},
"tags": {
"host": "my.host.com",
"instance_id": "abcd1234",
"email": "vic@vector.dev"
}
}
VRL program
.environment = get_env_var!("ENV") # add
.hostname = del(.host) # rename
del(.email)
Vector event (after)
{
"kind": "incremental",
"name": "user_login_total",
"counter": {
"value": 102.0
},
"tags": {
"environment": "production",
"hostname": "my.host.com",
"instance_id": "abcd1234"
}
}

Array examples

Append to an array

append([1, 2], [3, 4])
[
1,
2,
3,
4
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the append function.

Push an item onto an array

push([1, 2], 3)
[
1,
2,
3
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the push function.

Codec examples

Decode Base64 data (URL safe)

decode_base64!("eW91IGNhbid0IG1ha2UgeW91ciBoZWFydCBmZWVsIHNvbWV0aGluZyBpdCB3b24ndA==", charset: "url_safe")
"you can't make your heart feel something it won't"
Try it yourself with the `vector vrl` subcommand.

Learn more about the decode_base64 function.

Decode Base64 data (default)

decode_base64!("eW91IGhhdmUgc3VjY2Vzc2Z1bGx5IGRlY29kZWQgbWU=")
"you have successfully decoded me"
Try it yourself with the `vector vrl` subcommand.

Learn more about the decode_base64 function.

Encode to Base64 (URL safe)

encode_base64("please encode me, but safe for URLs", charset: "url_safe")
"cGxlYXNlIGVuY29kZSBtZSwgYnV0IHNhZmUgZm9yIFVSTHM="
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_base64 function.

Encode to Base64 (default)

encode_base64("please encode me")
"cGxlYXNlIGVuY29kZSBtZQ=="
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_base64 function.

Encode to Base64 (without padding)

encode_base64("please encode me, no padding though", padding: false)
"cGxlYXNlIGVuY29kZSBtZSwgbm8gcGFkZGluZyB0aG91Z2g"
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_base64 function.

Encode to JSON

.payload = encode_json({"hello": "world"})
"{\"hello\":\"world\"}"
Try it yourself with the `vector vrl` subcommand.

Learn more about the encode_json function.

Coerce examples

Coerce to a Boolean (Boolean)

to_bool(true)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a Boolean (float)

to_bool(0.0)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a Boolean (int)

to_bool(0)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a Boolean (null)

to_bool(null)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a Boolean (string)

to_bool!("yes")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_bool function.

Coerce to a float

to_float!("3.145")
3.145
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_float function.

Coerce to a string (Boolean)

to_string(true)
"true"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_string function.

Coerce to a string (float)

to_string(52.2)
"52.2"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_string function.

Coerce to a string (int)

to_string(52)
"52"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_string function.

Coerce to a timestamp

to_timestamp!("2020-10-21T16:00:00Z")
"2020-10-21T16:00:00Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_timestamp function.

Coerce to an int (string)

to_int!("2")
2
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_int function.

Coerce to an int (timestamp)

to_int(t'2020-12-30T22:20:53.824727Z')
1609366853
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_int function.

Convert examples

Coerce to Syslog severity

to_syslog_severity!("alert")
1
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_syslog_severity function.

Coerce to a Syslog facility

to_syslog_facility!(4)
"auth"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_syslog_facility function.

Coerce to a Syslog level

to_syslog_level!(5)
"notice"
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_syslog_level function.

Convert to a Unix timestamp (milliseconds)

to_unix_timestamp(t'2021-01-01T00:00:00Z', unit: "milliseconds")
1609459200000
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_unix_timestamp function.

Convert to a Unix timestamp (nanoseconds)

to_unix_timestamp(t'2021-01-01T00:00:00Z', unit: "nanoseconds")
1609459200000000000
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_unix_timestamp function.

Convert to a Unix timestamp (seconds)

to_unix_timestamp(t'2021-01-01T00:00:00+00:00')
1609459200
Try it yourself with the `vector vrl` subcommand.

Learn more about the to_unix_timestamp function.

Debug examples

Assertion (false)

ok, err = assert("foo" == "bar", message: "Foo must be foo!")
"function call error for \"assert\" at (10:61): Foo must be foo!"
Try it yourself with the `vector vrl` subcommand.

Learn more about the assert function.

Assertion (true)

ok, err = assert("foo" == "foo", message: "Foo must be foo!")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the assert function.

Log a message

log("Hello, World!", level: "info", rate_limit_secs: 60)
null
Try it yourself with the `vector vrl` subcommand.

Learn more about the log function.

Log an error

Vector event
{
"field": "not an integer"
}
VRL program
ts, err = to_int(.field)
if err != null {
log(err, level: "error")
}
null
Try it yourself with the `vector vrl` subcommand.

Learn more about the log function.

Enumerate examples

Array includes

includes(["apple", "orange", "banana"], "banana")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the includes function.

Compact an array

compact(["foo", "bar", "", null, [], "buzz"], string: true, array: true, null: true)
[
"foo",
"bar",
"buzz"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the compact function.

Compact an object

compact({"field1": 1, "field2": "", "field3": [], "field4": null}, string: true, array: true, null: true)
{
"field1": 1
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the compact function.

Flatten array

flatten([1, [2, 3, 4], [5, [6, 7], 8], 9])
[
1,
2,
3,
4,
5,
6,
7,
8,
9
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the flatten function.

Flatten object

flatten({
"parent1": {
"child1": 1,
"child2": 2
},
"parent2": {
"child3": 3
}
})
{
"parent1.child1": 1,
"parent1.child2": 2,
"parent2.child3": 3
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the flatten function.

Length (array)

length(["Trail Blazers", "Supersonics", "Grizzlies"])
3
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Length (nested object)

length({
"home": {
"city": "Portland",
"state": "Oregon"
},
"name": "Trail Blazers",
"mascot": {
"name": "Blaze the Trail Cat"
}
})
3
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Length (object)

length({
"portland": "Trail Blazers",
"seattle": "Supersonics"
})
2
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Length (string)

length("The Planet of the Apes Musical")
30
Try it yourself with the `vector vrl` subcommand.

Learn more about the length function.

Event examples

Delete a field

Vector event (before)
{
"field1": 1,
"field2": 2
}
VRL program
del(.field1)
Vector event (after)
{
"field2": 2
}

Learn more about the del function.

Exists (array element)

Vector event
{
"array": [
1,
2,
3
]
}
VRL program
exists(.array[2])
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the exists function.

Exists (field)

Vector event
{
"field": 1
}
VRL program
exists(.field)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the exists function.

Rename a field

Vector event (before)
{
"old_field": "please rename me"
}
VRL program
.new_field = del(.old_field)
Vector event (after)
{
"new_field": "please rename me"
}

Learn more about the del function.

Hash examples

Calaculate sha3 hash

sha3("foo", variant: "SHA3-224")
"f4f6779e153c391bbd29c95e72b0708e39d9166c7cea51d1f10ef58a"
Try it yourself with the `vector vrl` subcommand.

Learn more about the sha3 function.

Calculate sha1 hash

sha1("foo")
"0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33"
Try it yourself with the `vector vrl` subcommand.

Learn more about the sha1 function.

Calculate sha2 hash

sha2("foo", variant: "SHA-512/224")
"d68f258d37d670cfc1ec1001a0394784233f88f056994f9a7e5e99be"
Try it yourself with the `vector vrl` subcommand.

Learn more about the sha2 function.

Create md5 hash

md5("foo")
"acbd18db4cc2f85cedef654fccc4a4d8"
Try it yourself with the `vector vrl` subcommand.

Learn more about the md5 function.

IP examples

IPv4 contains CIDR

ip_cidr_contains!("192.168.0.0/16", "192.168.10.32")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_cidr_contains function.

IPv4 subnet

ip_subnet!("192.168.10.32", "255.255.255.0")
"192.168.10.0"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_subnet function.

IPv4 to IPv6

ip_to_ipv6!("192.168.10.32")
"::ffff:192.168.10.32"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_to_ipv6 function.

IPv6 contains CIDR

ip_cidr_contains!("2001:4f8:4:ba::/64", "2001:4f8:4:ba:2e0:81ff:fe22:d1f1")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_cidr_contains function.

IPv6 subnet

ip_subnet!("2404:6800:4003:c02::64", "/32")
"2404:6800::"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ip_subnet function.

IPv6 to IPv4

ipv6_to_ipv4!("::ffff:192.168.0.1")
"192.168.0.1"
Try it yourself with the `vector vrl` subcommand.

Learn more about the ipv6_to_ipv4 function.

Number examples

Format a number (3 decimals)

format_number(1234567.89, 3, decimal_separator: ".", grouping_separator: ",")
"1,234,567.890"
Try it yourself with the `vector vrl` subcommand.

Learn more about the format_number function.

Round a number (with precision)

round(4.345, precision: 2)
4.35
Try it yourself with the `vector vrl` subcommand.

Learn more about the round function.

Round a number (without precision)

round(4.345)
4.0
Try it yourself with the `vector vrl` subcommand.

Learn more about the round function.

Round a number down (with precision)

floor(4.345, precision: 2)
4.34
Try it yourself with the `vector vrl` subcommand.

Learn more about the floor function.

Round a number down (without precision)

floor(4.345)
4.0
Try it yourself with the `vector vrl` subcommand.

Learn more about the floor function.

Round a number up (with precision)

ceil(4.345, precision: 2)
4.35
Try it yourself with the `vector vrl` subcommand.

Learn more about the ceil function.

Round a number up (without precision)

ceil(4.345)
5.0
Try it yourself with the `vector vrl` subcommand.

Learn more about the ceil function.

Object examples

Object merge (deep)

merge(
{
"parent1": {
"child1": 1,
"child2": 2
},
"parent2": {
"child3": 3
}
},
{
"parent1": {
"child2": 4,
"child5": 5
}
},
deep: true
)
{
"parent1": {
"child1": 1,
"child2": 4,
"child5": 5
},
"parent2": {
"child3": 3
}
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the merge function.

Object merge (shallow)

merge(
{
"parent1": {
"child1": 1,
"child2": 2
},
"parent2": {
"child3": 3
}
},
{
"parent1": {
"child2": 4,
"child5": 5
}
}
)
{
"parent1": {
"child2": 4,
"child5": 5
},
"parent2": {
"child3": 3
}
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the merge function.

Parse examples

Parse AWS ALB log

parse_aws_alb_log!(
"http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 - 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" \"-\" \"-\" 0 2018-11-30T22:22:48.364000Z \"forward\" \"-\" \"-\" \"-\" \"-\" \"-\" \"-\""
)
{
"type": "http",
"timestamp": "2018-11-30T22:23:00.186641Z",
"elb": "app/my-loadbalancer/50dc6c495c0c9188",
"client_host": "192.168.131.39:2817",
"target_host": null,
"request_processing_time": 0.0,
"target_processing_time": 0.001,
"response_processing_time": 0.0,
"elb_status_code": "200",
"target_status_code": "200",
"received_bytes": 34,
"sent_bytes": 366,
"request_method": "GET",
"request_url": "http://www.example.com:80/",
"request_protocol": "HTTP/1.1",
"user_agent": "curl/7.46.0",
"ssl_cipher": null,
"ssl_protocol": null,
"target_group_arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067",
"trace_id": "Root=1-58337364-23a8c76965a2ef7629b185e3",
"domain_name": null,
"chosen_cert_arn": null,
"matched_rule_priority": "0",
"request_creation_time": "2018-11-30T22:22:48.364000Z",
"actions_executed": "forward",
"redirect_url": null,
"error_reason": null,
"target_port_list": [
],
"target_status_code_list": [
],
"classification": null,
"classification_reason": null
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_aws_alb_log function.

Parse AWS Cloudwatch Log subscription message

Vector event
{
"message": "{\n \"messageType\": \"DATA_MESSAGE\",\n \"owner\": \"111111111111\",\n \"logGroup\": \"test\",\n \"logStream\": \"test\",\n \"subscriptionFilters\": [\n\t\"Destination\"\n ],\n \"logEvents\": [\n\t{\n\t \"id\": \"35683658089614582423604394983260738922885519999578275840\",\n\t \"timestamp\": 1600110569039,\n\t \"message\": \"{\\\"bytes\\\":26780,\\\"datetime\\\":\\\"14/Sep/2020:11:45:41 -0400\\\",\\\"host\\\":\\\"157.130.216.193\\\",\\\"method\\\":\\\"PUT\\\",\\\"protocol\\\":\\\"HTTP/1.0\\\",\\\"referer\\\":\\\"https://www.principalcross-platform.io/markets/ubiquitous\\\",\\\"request\\\":\\\"/expedite/convergence\\\",\\\"source_type\\\":\\\"stdin\\\",\\\"status\\\":301,\\\"user-identifier\\\":\\\"-\\\"}\"\n\t}\n ]\n}"
}
VRL program
parse_aws_cloudwatch_log_subscription_message!(.message)
{
"owner": "111111111111",
"message_type": "DATA_MESSAGE",
"log_group": "test",
"log_stream": "test",
"subscription_filters": [
"Destination"
],
"log_events": [
{
"id": "35683658089614582423604394983260738922885519999578275840",
"message": "{\"bytes\":26780,\"datetime\":\"14/Sep/2020:11:45:41 -0400\",\"host\":\"157.130.216.193\",\"method\":\"PUT\",\"protocol\":\"HTTP/1.0\",\"referer\":\"https://www.principalcross-platform.io/markets/ubiquitous\",\"request\":\"/expedite/convergence\",\"source_type\":\"stdin\",\"status\":301,\"user-identifier\":\"-\"}",
"timestamp": "2020-09-14T19:09:29.039Z"
}
]
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_aws_cloudwatch_log_subscription_message function.

Parse AWS VPC Flow log (custom format)

parse_aws_vpc_flow_log!(
"- eni-1235b8ca123456789 10.0.1.5 10.0.0.220 10.0.1.5 203.0.113.5",
"instance_id interface_id srcaddr dstaddr pkt_srcaddr pkt_dstaddr"
)
{
"instance_id": null,
"interface_id": "eni-1235b8ca123456789",
"srcaddr": "10.0.1.5",
"dstaddr": "10.0.0.220",
"pkt_srcaddr": "10.0.1.5",
"pkt_dstaddr": "203.0.113.5"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_aws_vpc_flow_log function.

Parse AWS VPC Flow log (default format)

parse_aws_vpc_flow_log!("2 123456789010 eni-1235b8ca123456789 - - - - - - - 1431280876 1431280934 - NODATA")
{
"version": 2,
"account_id": 123456789010,
"interface_id": "eni-1235b8ca123456789",
"srcaddr": null,
"dstaddr": null,
"srcport": null,
"dstport": null,
"protocol": null,
"packets": null,
"bytes": null,
"start": 1431280876,
"end": 1431280934,
"action": null,
"log_status": "NODATA"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_aws_vpc_flow_log function.

Parse JSON

parse_json!("{\"key\": \"val\"}")
{
"key": "val"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_json function.

Parse Syslog log (5424)

parse_syslog!(
s'<13>1 2020-03-13T20:45:38.119Z dynamicwireless.name non 2426 ID931 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"] Try to override the THX port, maybe it will reboot the neural interface!'
)
{
"severity": "notice",
"facility": "user",
"timestamp": "2020-03-13T20:45:38.119Z",
"hostname": "dynamicwireless.name",
"appname": "non",
"procid": 2426,
"msgid": "ID931",
"message": "Try to override the THX port, maybe it will reboot the neural interface!",
"exampleSDID@32473.eventID": "1011",
"exampleSDID@32473.eventSource": "Application",
"exampleSDID@32473.iut": "3",
"version": 1
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_syslog function.

Parse URL

parse_url!("ftp://foo:bar@vector.dev:4343/foobar?hello=world#123")
{
"scheme": "ftp",
"username": "foo",
"password": "bar",
"host": "vector.dev",
"port": 4343,
"path": "/foobar",
"query": {
"hello": "world"
},
"fragment": "123"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_url function.

Parse comma delimited log

parse_key_value!(
"path:\"/cart_link\", host:store.app.com, fwd: \"102.30.171.16\", dyno: web.1, connect:0ms, service:87ms, status:304, bytes:632, protocol:https",
field_delimiter: ",",
key_value_delimiter: ":"
)
{
"path": "/cart_link",
"host": "store.app.com",
"fwd": "102.30.171.16",
"dyno": "web.1",
"connect": "0ms",
"service": "87ms",
"status": "304",
"bytes": "632",
"protocol": "https"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_key_value function.

Parse duration (milliseconds)

parse_duration!("1005ms", unit: "s")
1.005
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_duration function.

Parse logfmt log

parse_key_value!(
"@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
)
{
"@timestamp": "Sun Jan 10 16:47:39 EST 2021",
"level": "info",
"msg": "Stopping all fetchers",
"tag#production": "stopping_fetchers",
"id": "ConsumerFetcherManager-1382721708341",
"module": "kafka.consumer.ConsumerFetcherManager"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_key_value function.

Parse logfmt log

parse_logfmt!(
"@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
)
{
"@timestamp": "Sun Jan 10 16:47:39 EST 2021",
"level": "info",
"msg": "Stopping all fetchers",
"tag#production": "stopping_fetchers",
"id": "ConsumerFetcherManager-1382721708341",
"module": "kafka.consumer.ConsumerFetcherManager"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_logfmt function.

Parse timestamp

parse_timestamp!("10-Oct-2020 16:00+00:00", format: "%v %R %:z")
"2020-10-10T16:00:00Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_timestamp function.

Parse tokens

parse_tokens(
"A sentence \"with \\\"a\\\" sentence inside\" and [some brackets]"
)
[
"A",
"sentence",
"with \\\"a\\\" sentence inside",
"and",
"some brackets"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_tokens function.

Parse using Grok

parse_grok!(
"2020-10-02T23:22:12.223222Z info Hello world",
"%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"
)
{
"timestamp": "2020-10-02T23:22:12.223222Z",
"level": "info",
"message": "Hello world"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_grok function.

Parse using Regex (all matches)

parse_regex_all!("first group and second group.", r'(?P<number>\w+) group')
[
{
"number": "first",
"0": "first group",
"1": "first"
},
{
"number": "second",
"0": "second group",
"1": "second"
}
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_regex_all function.

Parse using Regex (with capture groups)

parse_regex!("first group and second group.", r'(?P<number>.*?) group')
{
"number": "first",
"0": "first group",
"1": "first"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_regex function.

Parse using Regex (without capture groups)

parse_regex!("first group and second group.", r'(\w+) group')
{
"0": "first group",
"1": "first"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_regex function.

Parse via Apache log format (combined)

parse_apache_log!(
s'127.0.0.1 bob frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326 "http://www.seniorinfomediaries.com/vertical/channels/front-end/bandwidth" "Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/1945-10-12 Firefox/37.0"',
"combined",
)
{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326,
"referrer": "http://www.seniorinfomediaries.com/vertical/channels/front-end/bandwidth",
"agent": "Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/1945-10-12 Firefox/37.0"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_apache_log function.

Parse via Apache log format (common)

parse_apache_log!("127.0.0.1 bob frank [10/Oct/2000:13:55:36 -0700] \"GET /apache_pb.gif HTTP/1.0\" 200 2326", format: "common")
{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_apache_log function.

Parse via Apache log format (error)

parse_apache_log!(
s'[01/Mar/2021:12:00:19 +0000] [ab:alert] [pid 4803:tid 3814] [client 147.159.108.175:24259] I will bypass the haptic COM bandwidth, that should matrix the CSS driver!',
"error"
)
{
"client": "147.159.108.175",
"message": "I will bypass the haptic COM bandwidth, that should matrix the CSS driver!",
"module": "ab",
"pid": 4803,
"port": 24259,
"severity": "alert",
"thread": "3814",
"timestamp": "2021-03-01T12:00:19Z"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_apache_log function.

Parse via Common Log Format (with custom timestamp format)

parse_common_log!(
"127.0.0.1 bob frank [2000-10-10T20:55:36Z] \"GET /apache_pb.gif HTTP/1.0\" 200 2326",
"%+"
)
{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_common_log function.

Parse via Common Log Format (with default timestamp format)

parse_common_log!("127.0.0.1 bob frank [10/Oct/2000:13:55:36 -0700] \"GET /apache_pb.gif HTTP/1.0\" 200 2326")
{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_common_log function.

Parse via glog

parse_glog!("I20210131 14:48:54.411655 15520 main.c++:9] Hello world!")
{
"level": "info",
"timestamp": "2021-01-31T14:48:54.411655Z",
"id": 15520,
"file": "main.c++",
"line": 9,
"message": "Hello world!"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the parse_glog function.

Random examples

Create a UUIDv4

uuid_v4()
"1d262f4f-199b-458d-879f-05fd0a5f0683"
Try it yourself with the `vector vrl` subcommand.

Learn more about the uuid_v4 function.

String examples

Downcase a string

downcase("Hello, World!")
"hello, world!"
Try it yourself with the `vector vrl` subcommand.

Learn more about the downcase function.

Join array (comma separator)

join!(["sources", "transforms", "sinks"], separator: ", ")
"sources, transforms, sinks"
Try it yourself with the `vector vrl` subcommand.

Learn more about the join function.

Join array (no separator)

join!(["bring", "us", "together"])
"bringustogether"
Try it yourself with the `vector vrl` subcommand.

Learn more about the join function.

Regex match on a string

match("I'm a little teapot", r'teapot')
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the match function.

Replace first instance

replace("Bananas and Bananas", "Bananas", "Pineapples", count: 1)
"Pineapples and Bananas"
Try it yourself with the `vector vrl` subcommand.

Learn more about the replace function.

Replace literal text

replace("Apples and Bananas", "and", "not")
"Apples not Bananas"
Try it yourself with the `vector vrl` subcommand.

Learn more about the replace function.

Replace via regular expression

replace("Apples and Bananas", r'(?i)bananas', "Pineapples")
"Apples and Pineapples"
Try it yourself with the `vector vrl` subcommand.

Learn more about the replace function.

Slice a string (negative index)

slice!("Supercalifragilisticexpialidocious", start: 5, end: -14)
"califragilistic"
Try it yourself with the `vector vrl` subcommand.

Learn more about the slice function.

Slice a string (positve index)

slice!("Supercalifragilisticexpialidocious", start: 5, end: 13)
"califrag"
Try it yourself with the `vector vrl` subcommand.

Learn more about the slice function.

Split a string (no limit)

split("apples and pears and bananas", " and ")
[
"apples",
"pears",
"bananas"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the split function.

Split a string (with a limit)

split("apples and pears and bananas", " and ", limit: 2)
[
"apples",
"pears and bananas"
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the split function.

String contains (case insensitive)

contains("The Needle In The Haystack", "needle", case_sensitive: false)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the contains function.

String contains (case sensitive)

contains("The Needle In The Haystack", "Needle")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the contains function.

String ends with (case insensitive)

ends_with("The Needle In The Haystack", "the haystack", case_sensitive: false)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ends_with function.

String ends with (case sensitive)

ends_with("The Needle In The Haystack", "The Haystack")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the ends_with function.

String starts with (case insensitive)

starts_with("The Needle In The Haystack", "the needle", case_sensitive: false)
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the starts_with function.

String starts with (case sensitive)

starts_with("The Needle In The Haystack", "The Needle")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the starts_with function.

Strip ANSI escape codes

strip_ansi_escape_codes("\e[46mfoo\e[0m bar")
"foo bar"
Try it yourself with the `vector vrl` subcommand.

Learn more about the strip_ansi_escape_codes function.

Strip whitespace

strip_whitespace(" A sentence. ")
"A sentence."
Try it yourself with the `vector vrl` subcommand.

Learn more about the strip_whitespace function.

Truncate a string

truncate("A rather long sentence.", limit: 11, ellipsis: true)
"A rather lo..."
Try it yourself with the `vector vrl` subcommand.

Learn more about the truncate function.

Upcase a string

upcase("Hello, World!")
"HELLO, WORLD!"
Try it yourself with the `vector vrl` subcommand.

Learn more about the upcase function.

System examples

Get an environment variable

get_env_var!("HOME")
"/root"
Try it yourself with the `vector vrl` subcommand.

Learn more about the get_env_var function.

Get hostname

Vector event (before)
{
}
VRL program
.hostname = get_hostname!()
Vector event (after)
{
"hostname": "localhost.localdomain"
}

Learn more about the get_hostname function.

Timestamp examples

Format a timestamp (ISO8601/RFC 3339)

format_timestamp!(t'2020-10-21T16:00:00Z', format: "%+")
"2020-10-21T16:00:00+00:00"
Try it yourself with the `vector vrl` subcommand.

Learn more about the format_timestamp function.

Format a timestamp (custom)

format_timestamp!(t'2020-10-21T16:00:00Z', format: "%v %R")
"21-Oct-2020 16:00"
Try it yourself with the `vector vrl` subcommand.

Learn more about the format_timestamp function.

Generate a current timestamp

now()
"2021-03-04T10:51:15.928937Z"
Try it yourself with the `vector vrl` subcommand.

Learn more about the now function.

Type examples

Declare a Boolean type

Vector event
{
"value": false
}
VRL program
bool!(.value)
false
Try it yourself with the `vector vrl` subcommand.

Learn more about the bool function.

Declare a float type

Vector event
{
"value": 42.0
}
VRL program
float!(.value)
42.0
Try it yourself with the `vector vrl` subcommand.

Learn more about the float function.

Declare a string type

Vector event
{
"message": "{\"field\": \"value\"}"
}
VRL program
string!(.message)
"{\"field\": \"value\"}"
Try it yourself with the `vector vrl` subcommand.

Learn more about the string function.

Declare a timestamp type

Vector event
{
"timestamp": "2020-10-10T16:00:00Z"
}
VRL program
ok, err = timestamp(.timestamp)
"function call error for \"timestamp\" at (10:31): expected \"timestamp\", got \"string\""
Try it yourself with the `vector vrl` subcommand.

Learn more about the timestamp function.

Declare an array type

Vector event
{
"value": [
1,
2,
3
]
}
VRL program
array!(.value)
[
1,
2,
3
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the array function.

Declare an integer type

Vector event
{
"value": 42
}
VRL program
int!(.value)
42
Try it yourself with the `vector vrl` subcommand.

Learn more about the int function.

Declare an object type

Vector event
{
"value": {
"field1": "value1",
"field2": "value2"
}
}
VRL program
object!(.value)
{
"field1": "value1",
"field2": "value2"
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the object function.

Null detection (blank string)

is_nullish("")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the is_nullish function.

Null detection (dash string)

is_nullish("-")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the is_nullish function.

Null detection (whitespace)

is_nullish("
")
true
Try it yourself with the `vector vrl` subcommand.

Learn more about the is_nullish function.

Tag types externally (array)

tag_types_externally(["foo", "bar"])
[
{
"string": "foo"
},
{
"string": "bar"
}
]
Try it yourself with the `vector vrl` subcommand.

Learn more about the tag_types_externally function.

Tag types externally (null)

tag_types_externally(null)
null
Try it yourself with the `vector vrl` subcommand.

Learn more about the tag_types_externally function.

Tag types externally (object)

tag_types_externally({
"message": "Hello world",
"request": {
"duration_ms": 67.9
}
})
{
"message": {
"string": "Hello world"
},
"request": {
"duration_ms": {
"float": 67.9
}
}
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the tag_types_externally function.

Tag types externally (scalar)

tag_types_externally(123)
{
"integer": 123
}
Try it yourself with the `vector vrl` subcommand.

Learn more about the tag_types_externally function.

Contents