This project uses towncrier for changelog generation.
- The multi-line mode of the
parse_groks
VRL function is now enabled by default. Use the(?-m)
modifier to disable this behaviour. (vectordotdev#1022)
- The
keyvalue
grok filter is extended to match Datadog implementation. (vectordotdev#1015)
- The
parse_xml
function now doesn't add an unnecessarytext
key when processing single nodes. (vectordotdev#849) parse_grok
andparse_groks
no longer require field names containing a hyphen (e.g.@a-b
) to be quoted.- The function
match_datadog_query
doesn't panic if an invalid path is passed, instead it returns an error. (vectordotdev#1031) - The
parse_ruby_hash
parser is extended to match Datadog implementation. Previously it would parse the key in{:key => "value"}
as:key
, now it will parse it askey
. (vectordotdev#1050)
-
Added
unflatten
function to inverse the result of theflatten
function. This function is useful when you want to convert a flattened object back to its original form. -
The
parse_json
function now accepts an optionallossy
parameter (which defaults totrue
).This new parameter allows to control whether the UTF-8 decoding should be lossy or not, replacing invalid UTF-8 sequences with the Unicode replacement character (U+FFFD) if set to
true
or raising an error if set tofalse
and an invalid utf-8 sequence is found. (vectordotdev#269) -
Added casing functions
camelcase
,kebabcase
,screamingsnakecase
,snakecase
,pascalcase
(vectordotdev#973) -
Added
parse_influxdb
function to parse events encoded using the InfluxDB line protocol.
- The
match_datadog_query
function now accepts||
in place ofOR
and&&
in place ofAND
in the query string, which is common Datadog syntax. (vectordotdev#1001)
decode_base64
no longer requires canonical padding. (vectordotdev#960)- The assumption of a Datadog Logs-based intake event structure has been removed
from the
match_datadog_query
function. (vectordotdev#1003) - For the
parse_influxdb
function thetimestamp
andtags
fields of returned objects are now correctly marked as nullable.
parse_logfmt
now processes 3 escape sequences when parsing:\n
,\"
and\\
. This means that for example,\n
in the input will be replaced with an actual newline character in parsed keys or values. (vectordotdev#777)
server
option fordns_lookup
now properly replaces default server settings (https://github.com/vectordotdev/vrl/pull/910/files)
- The deprecated coalesce paths (i.e.
(field1|field2)
) feature is now removed. (vectordotdev#836)
-
Added experimental
dns_lookup
function. It should be used with caution, since it involves network calls and is therefore very slow. -
Added
psl
argument to theparse_etld
function. It enables customizing used public suffix list. If none is provided the default (https://publicsuffix.org/list/public_suffix_list.dat) is used, which is that was used before this change.
- Add traceability_id field support to parse_aws_alb_log (vectordotdev#862)
- Coalesce paths (i.e.
(field1|field2)
) are deprecated and will be removed in a future version. This feature is rarely used and not very useful. (vectordotdev#815)
- Add
uuid_from_friendly_id
for converting base62-encoded 128-bit identifiers to the hyphenated UUID format (vectordotdev#803)
parse_json
now supports round-tripable float parsing by activating thefloat_roundtrip
feature in serde_json (vectordotdev#755)
- fixed
parse_logfmt
handling of escapes in values that could cause spurious keys to be created. As a result of this fix, the breaking change has been made to no longer allow empty keys in key-value pair formats (vectordotdev#725)
-
Added the
return
expression as per RFC 7496. This expression can be used to terminate the VRL program early while still emitting a value. (vectordotdev#712) -
Added
sieve
string function, which can remove unwanted characters from a string using a regex of allowed patterns. (vectordotdev#724) -
Add VRL function
uuid_v7
that generates UUIDv7 timestamp-based unique identifiers. (vectordotdev#738) -
Added
encode_proto
andparse_proto
functions, which can be used to encode and decode protobufs.parse_proto
accepts a bytes value, a proto descriptor file path and a message type and returns the VRL value as parsed from the proto.encode_proto
does the reverse and converts a VRL value into a protobuf bytes value. (vectordotdev#739)
parse_nginx
now accepts empty values for http referer (vectordotdev#643)
- Added
validate
option toencode_punycode
anddecode_punycode
, which defaults to true, but can be used to skip validation when set to false. (vectordotdev#709)
- Added
parse_etld
function for extracting eTLD and eTLD+1 (vectordotdev#669) - Added
encode_punycode
anddecode_punycode
functions (vectordotdev#672)
- Introduced a
redactor
option inredact
function to enable the substitution of redacted content with either a custom string or a hash representation. (vectordotdev#633) - Add VRL function
get_timezone_name
to return the configured/resolved IANA timezone name.
- Fixed a bug in exporting paths containing more than one "coalesce" segment. (vectordotdev#679)
- Introduced an unused expression checker. It's designed to detect and report unused expressions, helping users to clean up and optimize their VRL scripts. Note that this checker will not catch everything, but it does aim to eliminate false positives. For example, shadowed variables are not reported as unused. (vectordotdev#622)
- Add a
replace_with
function that is similar toreplace
but takes a closure instead of a replacement string. (vectordotdev#628)
- Added the
alias_sources
parameter forparse_groks
to read sources from files. (vectordotdev#194)
- Support for WASM features using
chrono
was readded. This was accidentally dropped in 0.9.0.
parse_regex_all
pattern
param can now be resolved from a variable- fixed
parse_json
data corruption issue for numbers greater or equal toi64::MAX
- support timestamp comparison using operators <, <=, >, >=
- added
contains_all
function (vectordotdev#468) from_unix_timestamp
now accepts a new unit: Microseconds. (vectordotdev#492)parse_nginx_log
no longer fails ifupstream_response_length
,upstream_response_time
,upstream_status
are missing (vectordotdev#498)- added
parse_float
function (vectordotdev#484) - improved fallibility diagnostics (vectordotdev#523)
- added
encode_snappy
anddecode_snappy
functions (vectordotdev#543)
parse_nginx_log
doesn't fail if the values of key-value pairs in error logs is missing (vectordotdev#442)encode_gzip
andencode_zlib
now correctly check the compression level (preventing a panic) (vectordotdev#393)- fix the type definition of array/object literal expressions where one of the values is undefined (vectordotdev#401)
parse_aws_vpc_flow_log
now handles account-id value as a string, avoiding loss of leading zeros and case where value isunknown
(vectordotdev#263)
parse_key_value
can now parse values enclosed in single quote characters (vectordotdev#382)- added
pretty
parameter forencode_json
vrl function to produce pretty-printed JSON string (vectordotdev#370) - added
community_id
function for generation of V1 Community IDs (vectordotdev#360) - updated aws vpc flow log parsing to include version 5 fields (vectordotdev#227)
- removed deprecated
to_timestamp
function (vectordotdev#452) - changed
truncate
arguments, it now accepts a suffix string instead of a boolean (vectordotdev#454)
- enquote values containing
=
inencode_logfmt
vrl function (vectordotdev/vector#17855) - breaking change to
parse_nginx_log()
to make it compatible to more unstandardized events (vectordotdev#249)
- deprecated
to_timestamp
vrl function (vectordotdev#285) - add support for chacha20poly1305, xchacha20poly1305, xsalsa20poly1305 algorithms for encryption/decryption (vectordotdev#293)
- add support for resolving variables to
Expr::resolve_constant
(vectordotdev#304) - introduce new encryption/decryption algorithm options (
"AES-*-CTR-BE"
,"AES-*-CTR-LE"
) vectordotdev#299
- added \0 (null) character literal to lex parser (vectordotdev#259)
- added the
timezone
argument to theformat_timestamp
vrl function. (vectordotdev#247) - removed feature flags for each individual VRL function. (vectordotdev#251)
- fixed a panic when arithmetic overflows. It now always wraps (only in debug builds). (vectordotdev#252)
ingress_upstreaminfo
log format has been added toparse_nginx_log
function (vectordotdev#193)- fixed type definitions for side-effects inside of queries (vectordotdev#258)
- replaced
Program::final_type_state
withProgram::final_type_info
to give access to the type definitions of both the target and program result (vectordotdev#262) - added
from_unix_timestamp
vrl function (vectordotdev#277)
- consolidated all crates into the root
vrl
crate. The external API stayed the same, with the exception of macros, which are now all exported at the root of thevrl
crate. - published VRL to crates.io. Standard crate versioning will now be used instead of git tags.
- fixed a type definition bug for assignments where the right-hand side of the assignment expression resolved to the
never
type - removed the deprecated
FieldBuf
fromField
- removed the lookup v1 code
- renamed the
lookup
crate topath
- re-exported all sub-crates in the root
vrl
crate - fix the
value
macro so it works when re-exported
- added guard for the
limit
param of thesplit
function to ensure it's not negative - renamed
Expression::as_value
toExpression::resolve_constant
match
function now precompiles static regular expressions- enabled the
encrypt
anddecrypt
VRL functions on the WASM playground - update default branch to
main
- the following VRL functions now compile on WASM (but abort at runtime)
get_hostname
- `log'
- `reverse_dns'
parse_grok
parse_groks
- VRL was split from the Vector repo