VRL language preview

1. Normalize a log event

a fallible parse, the coalesce operator, and a conditional

horizon-dark

# normalize an incoming log event
. = parse_json!(.message)
.status_code = to_int(.status_code) ?? 0
if exists(.error) {
    .level = "error"
} else {
    .level = "info"
}
del(.raw)

atom-one-dark

# normalize an incoming log event
. = parse_json!(.message)
.status_code = to_int(.status_code) ?? 0
if exists(.error) {
    .level = "error"
} else {
    .level = "info"
}
del(.raw)

github-dark

# normalize an incoming log event
. = parse_json!(.message)
.status_code = to_int(.status_code) ?? 0
if exists(.error) {
    .level = "error"
} else {
    .level = "info"
}
del(.raw)

dracula

# normalize an incoming log event
. = parse_json!(.message)
.status_code = to_int(.status_code) ?? 0
if exists(.error) {
    .level = "error"
} else {
    .level = "info"
}
del(.raw)

nord

# normalize an incoming log event
. = parse_json!(.message)
.status_code = to_int(.status_code) ?? 0
if exists(.error) {
    .level = "error"
} else {
    .level = "info"
}
del(.raw)

github

# normalize an incoming log event
. = parse_json!(.message)
.status_code = to_int(.status_code) ?? 0
if exists(.error) {
    .level = "error"
} else {
    .level = "info"
}
del(.raw)

2. String transforms

upcase, downcase, and split

horizon-dark

.host = downcase(.host)
.tags = split(.tag_string, ",")
.name = upcase!(.service_name)

atom-one-dark

.host = downcase(.host)
.tags = split(.tag_string, ",")
.name = upcase!(.service_name)

github-dark

.host = downcase(.host)
.tags = split(.tag_string, ",")
.name = upcase!(.service_name)

dracula

.host = downcase(.host)
.tags = split(.tag_string, ",")
.name = upcase!(.service_name)

nord

.host = downcase(.host)
.tags = split(.tag_string, ",")
.name = upcase!(.service_name)

github

.host = downcase(.host)
.tags = split(.tag_string, ",")
.name = upcase!(.service_name)

3. Timestamps and hashing

to_timestamp, now, and sha256

horizon-dark

.received_at = now()
.parsed_at = to_timestamp!(.raw_timestamp)
.fingerprint = sha256(.message)

atom-one-dark

.received_at = now()
.parsed_at = to_timestamp!(.raw_timestamp)
.fingerprint = sha256(.message)

github-dark

.received_at = now()
.parsed_at = to_timestamp!(.raw_timestamp)
.fingerprint = sha256(.message)

dracula

.received_at = now()
.parsed_at = to_timestamp!(.raw_timestamp)
.fingerprint = sha256(.message)

nord

.received_at = now()
.parsed_at = to_timestamp!(.raw_timestamp)
.fingerprint = sha256(.message)

github

.received_at = now()
.parsed_at = to_timestamp!(.raw_timestamp)
.fingerprint = sha256(.message)