Functions Overview
In OpenObserve, functions are VRL (Vector Remap Language) scripts that transform your stream data. You create and manage functions via the OpenObserve UI or API. In the UI, go to Pipelines > Functions to open a built-in editor where you can write, test, and save VRL code. Once saved, a function can be associated with a stream so it runs on incoming data at ingest time.
Learn more:
Related link:
Last updated on
Example functions
Enrich log data in OpenObserve using VRL functions and CSV enrichment tables, with hands-on examples for protocol lookups and MaxMind GeoIP location data.
Functions in OpenObserve
Define and apply VRL functions in OpenObserve for enrichment, parsing, redaction, and more—at ingest or query time for efficient log transformation.