Functions

Functions package reusable event transformations. Open Functions to create, test, and maintain function definitions independently of a pipeline.

Find a function

The list holds the functions of the organization and the built-in presets. Three views at the head of the list narrow it, each with its count:

View	Content
All	Every function that a pipeline can call.
Yours	The functions that the organization wrote.
Presets	The read-only functions that ship with MoleSignal.

The search matches the name of a function and the description of a preset. Click a function of the organization to open it in the workbench.

Languages

Language	Availability	Best for
VRL	Built in	Parsing, normalization, filtering, redaction, and enrichment.
JavaScript	Built in	Logic that is easier to express with JavaScript.
LLM	API-configurable; requires `llm_eval_enabled` and a model provider	Low-throughput classification or enrichment with model output.

Both VRL and JavaScript run inside the MoleSignal binary. Neither needs a setting or an extra install. MoleSignal validates and compiles a function during save. Invalid source does not become the active function. The Functions workbench exposes VRL and JavaScript. LLM functions are an advanced API workflow: the function source is the system instruction, the event is the model input, and params_schema.output_field selects the output field (default _llm_eval). Every matching event triggers a model call, so the setting [functions].llm_eval_enabled stays false by default. See Configuration.

Built-in presets

Every organization sees these read-only VRL functions:

Function	What it does
`add-intake-time`	Adds an intake timestamp to help diagnose end-to-end latency.
`normalize-logs`	Parses the JSON message, adds environment and cluster fields, and normalizes `level` to lowercase.
`parse-key-value`	Parses a logfmt or `key=value` message into fields and merges them back into the event.
`redact-email`	Replaces email addresses in `message` with a placeholder.
`route-by-service`	Normalizes the service name and derives a per-service target stream (`logs_<service>`) as a routing hint.

A preset row carries the Built-in tag and its description, in the interface language of the signed-in user. Click the row to read the source. A preset cannot be edited. To change one, select Start from this on the row or in the preset panel. The workbench opens a new function with the language and source of the preset, named <preset>-copy. Saving creates a function of the organization and leaves the preset as it is.

Write and test a function

The workbench has three parts:

the name and the language of the function;
Source, the editor, with the validation state of the source beside its title;
Test run, with the Sample input as JSON and the Sample output.

Select Run sample to run the source in the editor against the sample event. The source does not need to be saved first. The transformed event appears under Sample output. When the run fails, the reason appears in its place. Save function and Cancel stand in the title row of the page, with Delete function for a function that is already saved. While the name or the source is empty, Save function is unavailable and its tooltip names what is missing. In an editor, ⌘ Enter or Ctrl+Enter runs the sample, and ⌘S or Ctrl+S saves. The runner calls POST /api/v1/functions/run with a language, a source, and a sample event, and returns the transformed event:

curl -X POST http://localhost:5080/api/v1/functions/run \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  -d '{"language":"vrl","source":".service = downcase!(string!(.service))","input":{"service":"Checkout"}}'

{ "output": { "service": "checkout" } }

Example VRL:

.service = downcase!(string!(.service))
.severity = upcase(string(.level) ?? "INFO")
if exists(.customer_id) {
  .customer = lookup("customers", .customer_id)
}

JavaScript functions

The source runs once for every event. The global molesignal object carries the event and helpers:

Member	Purpose
`molesignal.fields`	The event as an object. Read it, change it, or assign a new object.
`molesignal.set(name, value)`	Sets a field.
`molesignal.del(name)`	Removes a field.
`molesignal.now()`	The current time in microseconds since the Unix epoch.
`molesignal.parse_json(text)` and `molesignal.encode_json(value)`	Convert between JSON text and values.
`molesignal.sha256(text)`	The SHA-256 digest of the UTF-8 bytes of the text, as 64 lowercase hexadecimal characters.

molesignal.set("severity", String(molesignal.fields.level || "info").toUpperCase());
molesignal.set("seen_at", molesignal.now());
molesignal.del("level");

A JavaScript function runs in an isolated engine with these limits:

A run that takes longer than 50 ms stops with js timeout 50ms.
The heap of one function is limited to 32 MiB.
Network access, timers, and TextEncoder are not available.

Use a function

Add the function as a transform node in a pipeline. The pipeline stores the ordered steps and passes the event through each function. Deleting or changing a function can affect every referencing pipeline. Review usage before a breaking edit.

Permissions

functions.read lists and opens functions.
functions.create and functions.edit manage definitions.
functions.run executes the sample runner.
functions.delete removes a definition.

Pipelines

Build source → transform → sink workflows.

Extend tables

Maintain lookup data for enrichment.

Get started

Data

Observe

Query and correlate

Reliability

AI ops

Collaboration

Admin

Deploy & operate

Best practices

Resources

Find a function

Languages

Built-in presets

Write and test a function

JavaScript functions

Use a function

Permissions

Pipelines

Extend tables

​Find a function

​Languages

​Built-in presets

​Write and test a function

​JavaScript functions

​Use a function

​Permissions

Pipelines

Extend tables

Find a function

Languages

Built-in presets

Write and test a function

JavaScript functions

Use a function

Permissions