Functions

Functions package reusable event transformations. Open Functions to create, test, and maintain function definitions independently of a pipeline.

Languages

Language	Availability	Best for
VRL	Always available	Parsing, normalization, filtering, redaction, and enrichment.
JavaScript	Requires a build with `js-runtime`	Logic that is easier to express with JavaScript.
LLM	API-configurable; requires `llm_eval_enabled` and a model provider	Low-throughput classification or enrichment with model output.

MoleSignal validates and compiles a function during save. Invalid source does not become the active function. The current Functions workbench exposes VRL and JavaScript. LLM functions are an advanced API workflow: the function source is the system instruction, the event is the model input, and params_schema.output_field selects the output field (default _llm_eval).

Test before saving

The function workbench contains the source editor and a JSON sample runner. The current POST /api/v1/functions/run execution path runs VRL samples. JavaScript receives save-time syntax validation when the runtime is compiled in, but unsaved JavaScript sample execution is not available through this endpoint. LLM functions run only as pipeline steps. Example VRL:

.service = downcase!(string!(.service))
.severity = upcase(string(.level) ?? "INFO")
if exists(.customer_id) {
  .customer = lookup("customers", .customer_id)
}

Use a function

Add the function as a transform node in a pipeline. The pipeline stores the ordered steps and passes the event through each function. Deleting or changing a function can affect every referencing pipeline. Review usage before a breaking edit.

Permissions

functions.read lists and opens functions.
functions.create and functions.edit manage definitions.
functions.run executes the VRL sample runner.
functions.delete removes a definition.

Pipelines

Build source → transform → sink workflows.

Extend tables

Maintain lookup data for enrichment.

Getting Started

Observe

Reliability

AI Ops

Data

Collaboration

Admin

Deploy & Operate

Languages

Test before saving

Use a function

Permissions

Pipelines

Extend tables

​Languages

​Test before saving

​Use a function

​Permissions

Pipelines

Extend tables

Languages

Test before saving

Use a function

Permissions