This project uses towncrier for changelog generation.
-
Removed deprecated
ellipsisargument from thetruncatefunction. Usesuffixinstead. (vectordotdev#1188) -
Fix
slicetype_def. This is a breaking change because it might change the fallibility of theslicefunction and this VRL scripts will need to be updated accordingly.authors: pront (vectordotdev#1246)
-
Added new
to_syslog_facility_codefunction to convert syslog facility keyword to syslog facility code. (vectordotdev#1221) -
Downgrade "can't abort infallible function" error to a warning. (vectordotdev#1247)
-
ip_cidr_containsmethod now also accepts an array of CIDRs.authors: JakubOnderka (vectordotdev#1248)
-
Faster converting bytes to Unicode string by using SIMD instructions provided by simdutf8 crate. simdutf8 is up to 23 times faster than the std library on valid non-ASCII, up to four times on pure ASCII is the same method provided by Rust's standard library. This will speed up almost all VRL methods like
parse_jsonorparse_regex.authors: JakubOnderka (vectordotdev#1249)
-
Added
shannon_entropyfunction to generate entropy from a string.authors: esensar (vectordotdev#1267)
-
Fix decimals parsing in parse_duration function
authors: sainad2222 (vectordotdev#1223)
-
Fix
parse_nginx_logfunction when a format is set to error and an error message contains comma.authors: JakubOnderka (vectordotdev#1280)
to_unix_timestamp,to_float, anduuid_v7can now return an error if the supplied timestamp is unrepresentable as a nanosecond timestamp. Previously the function calls would panic. (vectordotdev#979)
- Added new
crcfunction to calculate CRC (Cyclic Redundancy Check) checksum - Add
parse_cborfunction (vectordotdev#1152) - Added new
zipfunction to iterate over an array of arrays and produce a new arrays containing an item from each one. (vectordotdev#1158) - Add new
decode_charset,encode_charsetfunctions to decode and encode strings between different charsets. (vectordotdev#1162) - Added new
object_from_arrayfunction to create an object from an array of value pairs such as whatzipcan produce. (vectordotdev#1164) - Added support for multi-unit duration strings (e.g.,
1h2s,2m3s) in theparse_durationfunction. (vectordotdev#1197) - Added new
parse_bytesfunction to parse given bytes string such as1MiBor1TBeither in binary or decimal base. (vectordotdev#1198) - Add
mainlog format forparse_nginx_log. (vectordotdev#1202) - Added support for optional
timezoneargument in theparse_timestampfunction. (vectordotdev#1207)
- Fix a panic in float subtraction that produces NaN values. (vectordotdev#1186)
- Reverted
to_floatchange because the new logic is too restrictive e.g. attempting to convert "0" returns an error. (vectordotdev#1179)
- Fixes the
to_floatfunction to return an error instead off64::INFINITYwhen parsing non-normal numbers. (vectordotdev#1107)
- The
decryptandencryptVRL functions now support aes-siv (RFC 5297) encryption and decryption. (vectordotdev#1100)
decode_punycodeandencode_punycodewithvalidateflag set to false should be faster now, in cases when input data needs no encoding or decoding. (vectordotdev#1104)vrl::value::Valuenow implementsPartialCmpthat first checks whether the enum discriminants (that both are floats for example), and if they are callspartial_cmpon the inner values. Otherwise, it will returnNone. (vectordotdev#1117)- The
encode_protofunction was enhanced to automatically convert valid string fields to numeric proto fields. (vectordotdev#1114)
- The
parse_groksVRL function and Datadog grok parsing now catch the panic coming fromrust-onigon too many regex match retries, and handles it as a custom error. (vectordotdev#1079) encode_punycodewithvalidateflag set to false should be more consistent withvalidateset to true, turning all uppercase character to lowercase besides doing punycode encoding (vectordotdev#1115)- Removed false warning when using
set_semantic_meaning. (vectordotdev#1148)
- The multi-line mode of the
parse_groksVRL function is now enabled by default. Use the(?-m)modifier to disable this behaviour. (vectordotdev#1022)
- The
keyvaluegrok filter is extended to match Datadog implementation. (vectordotdev#1015)
- The
parse_xmlfunction now doesn't add an unnecessarytextkey when processing single nodes. (vectordotdev#849) parse_grokandparse_groksno longer require field names containing a hyphen (e.g.@a-b) to be quoted.- The function
match_datadog_querydoesn't panic if an invalid path is passed, instead it returns an error. (vectordotdev#1031) - The
parse_ruby_hashparser is extended to match Datadog implementation. Previously it would parse the key in{:key => "value"}as:key, now it will parse it askey. (vectordotdev#1050)
-
Added
unflattenfunction to inverse the result of theflattenfunction. This function is useful when you want to convert a flattened object back to its original form. -
The
parse_jsonfunction now accepts an optionallossyparameter (which defaults totrue).This new parameter allows to control whether the UTF-8 decoding should be lossy or not, replacing invalid UTF-8 sequences with the Unicode replacement character (U+FFFD) if set to
trueor raising an error if set tofalseand an invalid utf-8 sequence is found. (vectordotdev#269) -
Added casing functions
camelcase,kebabcase,screamingsnakecase,snakecase,pascalcase(vectordotdev#973) -
Added
parse_influxdbfunction to parse events encoded using the InfluxDB line protocol.
- The
match_datadog_queryfunction now accepts||in place ofORand&&in place ofANDin the query string, which is common Datadog syntax. (vectordotdev#1001)
decode_base64no longer requires canonical padding. (vectordotdev#960)- The assumption of a Datadog Logs-based intake event structure has been removed
from the
match_datadog_queryfunction. (vectordotdev#1003) - For the
parse_influxdbfunction thetimestampandtagsfields of returned objects are now correctly marked as nullable.
parse_logfmtnow processes 3 escape sequences when parsing:\n,\"and\\. This means that for example,\nin the input will be replaced with an actual newline character in parsed keys or values. (vectordotdev#777)
serveroption fordns_lookupnow properly replaces default server settings (https://github.com/vectordotdev/vrl/pull/910/files)
- The deprecated coalesce paths (i.e.
(field1|field2)) feature is now removed. (vectordotdev#836)
-
Added experimental
dns_lookupfunction. It should be used with caution, since it involves network calls and is therefore very slow. -
Added
pslargument to theparse_etldfunction. It enables customizing used public suffix list. If none is provided the default (https://publicsuffix.org/list/public_suffix_list.dat) is used, which is that was used before this change.
- Add traceability_id field support to parse_aws_alb_log (vectordotdev#862)
- Coalesce paths (i.e.
(field1|field2)) are deprecated and will be removed in a future version. This feature is rarely used and not very useful. (vectordotdev#815)
- Add
uuid_from_friendly_idfor converting base62-encoded 128-bit identifiers to the hyphenated UUID format (vectordotdev#803)
parse_jsonnow supports round-tripable float parsing by activating thefloat_roundtripfeature in serde_json (vectordotdev#755)
- fixed
parse_logfmthandling of escapes in values that could cause spurious keys to be created. As a result of this fix, the breaking change has been made to no longer allow empty keys in key-value pair formats (vectordotdev#725)
-
Added the
returnexpression as per RFC 7496. This expression can be used to terminate the VRL program early while still emitting a value. (vectordotdev#712) -
Added
sievestring function, which can remove unwanted characters from a string using a regex of allowed patterns. (vectordotdev#724) -
Add VRL function
uuid_v7that generates UUIDv7 timestamp-based unique identifiers. (vectordotdev#738) -
Added
encode_protoandparse_protofunctions, which can be used to encode and decode protobufs.parse_protoaccepts a bytes value, a proto descriptor file path and a message type and returns the VRL value as parsed from the proto.encode_protodoes the reverse and converts a VRL value into a protobuf bytes value. (vectordotdev#739)
parse_nginxnow accepts empty values for http referer (vectordotdev#643)
- Added
validateoption toencode_punycodeanddecode_punycode, which defaults to true, but can be used to skip validation when set to false. (vectordotdev#709)
- Added
parse_etldfunction for extracting eTLD and eTLD+1 (vectordotdev#669) - Added
encode_punycodeanddecode_punycodefunctions (vectordotdev#672)
- Introduced a
redactoroption inredactfunction to enable the substitution of redacted content with either a custom string or a hash representation. (vectordotdev#633) - Add VRL function
get_timezone_nameto return the configured/resolved IANA timezone name.
- Fixed a bug in exporting paths containing more than one "coalesce" segment. (vectordotdev#679)
- Introduced an unused expression checker. It's designed to detect and report unused expressions, helping users to clean up and optimize their VRL scripts. Note that this checker will not catch everything, but it does aim to eliminate false positives. For example, shadowed variables are not reported as unused. (vectordotdev#622)
- Add a
replace_withfunction that is similar toreplacebut takes a closure instead of a replacement string. (vectordotdev#628)
- Added the
alias_sourcesparameter forparse_groksto read sources from files. (vectordotdev#194)
- Support for WASM features using
chronowas readded. This was accidentally dropped in 0.9.0.
parse_regex_allpatternparam can now be resolved from a variable- fixed
parse_jsondata corruption issue for numbers greater or equal toi64::MAX - support timestamp comparison using operators <, <=, >, >=
- added
contains_allfunction (vectordotdev#468) from_unix_timestampnow accepts a new unit: Microseconds. (vectordotdev#492)parse_nginx_logno longer fails ifupstream_response_length,upstream_response_time,upstream_statusare missing (vectordotdev#498)- added
parse_floatfunction (vectordotdev#484) - improved fallibility diagnostics (vectordotdev#523)
- added
encode_snappyanddecode_snappyfunctions (vectordotdev#543)
parse_nginx_logdoesn't fail if the values of key-value pairs in error logs is missing (vectordotdev#442)encode_gzipandencode_zlibnow correctly check the compression level (preventing a panic) (vectordotdev#393)- fix the type definition of array/object literal expressions where one of the values is undefined (vectordotdev#401)
parse_aws_vpc_flow_lognow handles account-id value as a string, avoiding loss of leading zeros and case where value isunknown(vectordotdev#263)
parse_key_valuecan now parse values enclosed in single quote characters (vectordotdev#382)- added
prettyparameter forencode_jsonvrl function to produce pretty-printed JSON string (vectordotdev#370) - added
community_idfunction for generation of V1 Community IDs (vectordotdev#360) - updated aws vpc flow log parsing to include version 5 fields (vectordotdev#227)
- removed deprecated
to_timestampfunction (vectordotdev#452) - changed
truncatearguments, it now accepts a suffix string instead of a boolean (vectordotdev#454)
- enquote values containing
=inencode_logfmtvrl function (vectordotdev/vector#17855) - breaking change to
parse_nginx_log()to make it compatible to more unstandardized events (vectordotdev#249)
- deprecated
to_timestampvrl function (vectordotdev#285) - add support for chacha20poly1305, xchacha20poly1305, xsalsa20poly1305 algorithms for encryption/decryption (vectordotdev#293)
- add support for resolving variables to
Expr::resolve_constant(vectordotdev#304) - introduce new encryption/decryption algorithm options (
"AES-*-CTR-BE","AES-*-CTR-LE") vectordotdev#299
- added \0 (null) character literal to lex parser (vectordotdev#259)
- added the
timezoneargument to theformat_timestampvrl function. (vectordotdev#247) - removed feature flags for each individual VRL function. (vectordotdev#251)
- fixed a panic when arithmetic overflows. It now always wraps (only in debug builds). (vectordotdev#252)
ingress_upstreaminfolog format has been added toparse_nginx_logfunction (vectordotdev#193)- fixed type definitions for side-effects inside of queries (vectordotdev#258)
- replaced
Program::final_type_statewithProgram::final_type_infoto give access to the type definitions of both the target and program result (vectordotdev#262) - added
from_unix_timestampvrl function (vectordotdev#277)
- consolidated all crates into the root
vrlcrate. The external API stayed the same, with the exception of macros, which are now all exported at the root of thevrlcrate. - published VRL to crates.io. Standard crate versioning will now be used instead of git tags.
- fixed a type definition bug for assignments where the right-hand side of the assignment expression resolved to the
nevertype - removed the deprecated
FieldBuffromField - removed the lookup v1 code
- renamed the
lookupcrate topath - re-exported all sub-crates in the root
vrlcrate - fix the
valuemacro so it works when re-exported
- added guard for the
limitparam of thesplitfunction to ensure it's not negative - renamed
Expression::as_valuetoExpression::resolve_constant matchfunction now precompiles static regular expressions- enabled the
encryptanddecryptVRL functions on the WASM playground - update default branch to
main - the following VRL functions now compile on WASM (but abort at runtime)
get_hostname- `log'
- `reverse_dns'
parse_grokparse_groks
- VRL was split from the Vector repo