Vector Remap Language (VRL)

VRL is an expression-oriented language for parsing, transforming, and enriching observability data (logs, metrics, and traces). Originally created for Vector, it can also be embedded in other contexts.

VRL is maintained by Datadog's Community Open Source Engineering team.

Quickstart

Try VRL in your browser: write a program, run it against your events, and inspect the results without installing anything.

Language guide · Function reference · Examples · Error reference

Design

VRL is designed around these core principles:

• Safety: the compiler checks types and requires you to handle fallible expressions before a program can run.
• Statelessness: programs process each event independently, without retaining state between events.
• Performance: programs are compiled once and executed without garbage collection.
• Reusability: VRL is designed to be embedded in applications beyond Vector.

Use VRL

• Command line:

  cargo run

• In Vector: use the remap transform to modify events, or VRL conditions to filter and route them.

• In Rust: start with the embedding example and the Rust API documentation.

WebAssembly

VRL can be compiled with the wasm32-unknown-unknown target:

cargo check --target wasm32-unknown-unknown --no-default-features --features stdlib

Most stdlib functions are supported. The following functions compile but abort at runtime due to platform limitations (I/O, system calls, or native dependencies):

• dns_lookup
• get_hostname
• http_request
• log
• parse_grok
• parse_groks
• reverse_dns
• validate_json_schema

Note: the grok parser within the datadog feature is excluded entirely when targeting wasm32.

Contributing

See CONTRIBUTING.md for development and testing instructions, and DESIGN.md for the language's design principles. Please read the AI policy when contributing with AI tools.