Whose value needs to be a valid IP address.A MAC (Media Access Control) address is a unique identifier assigned to most network adapters. We recommend using date ranges as the only criteria when the enrichmentįor geoip enrichment tables this condition needs to be a VRL object with a single key-value pair This can be an expensive operation if there are many rows returned by any exact Sequentially scanning through the rows that have been located via any exact matchĬriteria. The given field must be greater than or equal to the from dateĪnd less than or equal to the to date. Index directly into the dataset, which should make this search fairly “cheap” from aĭate range search. Case sensitivityĬan be specified using the case_sensitive argument. The given field must match the value exactly. There are currently two forms of search criteria:Įxact match search. Match for rows to be returned if any fields don’t match, no rows are returned. This function returns the rows that match the provided condition(s). The key-value pairs indicate a field to search mapped to a value to search in that field. Searches an enrichment table for rows that match theįor file enrichment tables this condition needs to be a VRL object in which Vector vrl -help to see more information. The vector vrl command has many other capabilities, run the command using The REPL behaves nearly identical to the programs you write for your VectorĬonfiguration, and can be used to test individual snippets of complex programsīefore you commit them to your production configuration. VRL REPLĪdditionally, if vector vrl is run without any arguments, it will spawn a REPLĪssuming you have Vector installed, you can run vector vrl to start the REPL.įrom there, you can type help and press return to get further help. Matches how VRL will receive the input in a running Vector instance. The belowĮxamples show pretty-printed JSON for the input events, so collapse these to single lines whenįor example: vector vrl -input input.json -program program.vrl -print-object. and -program (VRL program) to pass in theĮxample input and program as well as -print-object to show the modified object. You can run these examples using the vector vrl subcommand with -input (input is newlineĭelemited JSON file representing a list of events). TheseĮxamples demonstrate the breadth of the language and its observability-focused Here you’ll find a comprehensive list of all VRL program examples.

Convert mac address to hec