Create a function

curl -X POST http://localhost:5080/api/v1/functions \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{
    "name": "lowercase-level",
    "language": "vrl",
    "source": ".level = downcase!(string!(.level))"
  }'

curl -X POST http://localhost:5080/api/v1/functions \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{
    "name": "lowercase-level",
    "language": "vrl",
    "source": ".level = downcase!(string!(.level))"
  }'

POST /api/v1/functions

Creates a reusable transform for pipelines. VRL and JavaScript are compiled when the function is created, and a function with invalid source is rejected. Both runtimes are built into the binary. The call requires functions.create. Body

Field	Type	Required	Notes
`name`	string	Yes	Function name.
`language`	string	Yes	`vrl`, `js`, or `llm`. An `llm` function needs `[functions].llm_eval_enabled` and a model provider.
`source`	string	Yes	The VRL or JavaScript source, or the instruction of an `llm` function.
`params_schema`	object	No	Parameters. For `llm`, `output_field` selects the output field, default `_llm_eval`.

curl -X POST http://localhost:5080/api/v1/functions \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{
    "name": "lowercase-level",
    "language": "vrl",
    "source": ".level = downcase!(string!(.level))"
  }'

A syntax error answers 400, for example js syntax error: Uncaught SyntaxError: Unexpected token '}'. Test source before saving with POST /api/v1/functions/run, which takes language, source, and a sample input, and returns output. See Functions. Other function routes: GET /api/v1/functions, GET, PUT, and DELETE /api/v1/functions/{id}. The built-in presets are read-only.

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration