OpenObserve Functions API
Functions retrieval & management operations
OpenAPI Specification
openapi: 3.1.0
info:
title: openobserve Actions Functions API
description: OpenObserve API documents [https://openobserve.ai/docs/](https://openobserve.ai/docs/)
contact:
name: OpenObserve
url: https://openobserve.ai/
email: hello@zinclabs.io
license:
name: AGPL-3.0
identifier: AGPL-3.0
version: 0.90.0
tags:
- name: Functions
description: Functions retrieval & management operations
paths:
/api/{org_id}/enrichment_tables/{table_name}:
post:
tags:
- Functions
summary: Create or update enrichment table
description: Creates a new enrichment table or updates existing table data for log enrichment
operationId: CreateUpdateEnrichmentTable
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
- name: table_name
in: path
description: Table name
required: true
schema:
type: string
responses:
'201':
description: Saved enrichment table
content:
application/json:
schema:
default: null
'400':
description: Bad Request
content:
application/json:
schema:
default: null
security:
- Authorization: []
x-o2-mcp:
description: Create/update enrichment table
category: enrichment
x-o2-ratelimit:
module: Enrichment Table
operation: create
/api/{org_id}/enrichment_tables/{table_name}/url:
post:
tags:
- Functions
summary: Create enrichment table from URL
description: Creates a new enrichment table by fetching CSV data from a public URL. The process runs asynchronously in the background.
operationId: CreateEnrichmentTableFromUrl
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
- name: table_name
in: path
description: Table name
required: true
schema:
type: string
- name: append
in: query
description: 'Whether to append data to existing table (default: false)'
required: false
schema:
type: boolean
requestBody:
description: URL for the CSV file
content:
application/json:
schema:
$ref: '#/components/schemas/EnrichmentTableUrlRequest'
required: true
responses:
'202':
description: Job created successfully
content:
text/plain:
schema:
type: string
'400':
description: Bad Request
content:
text/plain:
schema:
type: string
'500':
description: Internal Server Error
content:
text/plain:
schema:
type: string
security:
- Authorization: []
x-o2-ratelimit:
module: Enrichment Table
operation: create
x-o2-mcp:
description: Create table from URL
category: enrichment
/api/{org_id}/functions:
get:
tags:
- Functions
summary: List organization functions
description: Retrieves all custom transformation functions available in the organization, including their VRL code, configuration parameters, and current usage status. Shows function metadata such as creation date, last modified time, and pipeline dependencies to help administrators manage data transformation logic across the organization.
operationId: listFunctions
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
required:
- list
properties:
list:
type: array
items:
$ref: '#/components/schemas/Transform'
security:
- Authorization: []
x-o2-ratelimit:
module: Functions
operation: list
x-o2-mcp:
description: List all functions
category: functions
summary_fields:
- name
- transType
- streams
post:
tags:
- Functions
summary: Create new function
description: Creates a new custom transformation function using VRL (Vector Remap Language) code. Functions can be used in data ingestion pipelines to transform, enrich, or filter incoming log, metric, and trace data. Support complex data transformations, field extraction, format conversion, and conditional processing to standardize data before storage and indexing.
operationId: createFunction
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
requestBody:
description: Function data
content:
application/json:
schema:
type: object
required:
- function
properties:
function:
type: string
name:
type: string
numArgs:
type: integer
format: int32
minimum: 0
params:
type: string
streams:
type:
- array
- 'null'
items:
$ref: '#/components/schemas/StreamOrder'
transType:
type:
- integer
- 'null'
format: int32
minimum: 0
required: true
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
'400':
description: Failure
content:
application/json:
schema:
default: null
security:
- Authorization: []
x-o2-mcp:
description: Create a VRL (Vector Remap Language) function
category: functions
x-o2-ratelimit:
module: Functions
operation: create
/api/{org_id}/functions/test:
post:
tags:
- Functions
summary: Validate VRL function syntax
description: Validates VRL (Vector Remap Language) transformation function syntax by testing it against sample events. Returns validation results with any syntax errors or successful transformation output. Use this to verify VRL code is correct before creating or updating a function. Accepts function code, sample events to test against, and optional trans_type (0 for VRL, 1 for JS).
operationId: testFunction
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
requestBody:
description: Test run function
content:
application/json:
schema:
type: object
required:
- function
- events
properties:
events:
type: array
items: {}
function:
type: string
trans_type:
type:
- integer
- 'null'
format: int32
minimum: 0
required: true
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
'400':
description: Failure
content:
application/json:
schema:
default: null
security:
- Authorization: []
x-o2-mcp:
category: functions
/api/{org_id}/functions/{name}:
get:
tags:
- Functions
summary: Get function pipeline dependencies
description: Lists all data processing pipelines that currently use the specified transformation function. Returns pipeline names, types, and usage details to help administrators understand the impact scope before making changes to the function. Essential for change management and ensuring data processing continuity during function updates.
operationId: functionPipelineDependency
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
- name: name
in: path
description: Function name
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
required:
- list
properties:
list:
type: array
items:
$ref: '#/components/schemas/Transform'
'404':
description: Function not found
content:
application/json:
schema:
default: null
'500':
description: Internal server error
content:
application/json:
schema:
default: null
security:
- Authorization: []
x-o2-mcp:
description: Check function dependencies
category: functions
x-o2-ratelimit:
module: Functions
operation: get
put:
tags:
- Functions
summary: Update function
description: Updates an existing transformation function with new VRL code, parameters, or configuration settings. Changes take effect immediately and apply to all data processing pipelines currently using this function. Test function changes thoroughly before deployment to avoid data transformation errors in production pipelines.
operationId: updateFunction
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
- name: name
in: path
description: Function name
required: true
schema:
type: string
requestBody:
description: Function data
content:
application/json:
schema:
type: object
required:
- function
properties:
function:
type: string
name:
type: string
numArgs:
type: integer
format: int32
minimum: 0
params:
type: string
streams:
type:
- array
- 'null'
items:
$ref: '#/components/schemas/StreamOrder'
transType:
type:
- integer
- 'null'
format: int32
minimum: 0
required: true
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
'400':
description: Failure
content:
application/json:
schema:
default: null
security:
- Authorization: []
x-o2-mcp:
description: Update a VRL function
category: functions
x-o2-ratelimit:
module: Functions
operation: update
delete:
tags:
- Functions
summary: Delete function
description: Permanently deletes a custom transformation function from the organization. The function must not be in use by active pipelines unless the force parameter is specified. Once deleted, any pipelines previously using this function will need to be updated with alternative transformation logic to continue functioning properly.
operationId: deleteFunction
parameters:
- name: org_id
in: path
description: Organization name
required: true
schema:
type: string
- name: name
in: path
description: Function name
required: true
schema:
type: string
- name: force
in: query
description: Force delete function regardless pipeline dependencies
required: true
schema:
type: boolean
responses:
'200':
description: Success
content:
application/json:
schema:
type: object
'404':
description: NotFound
content:
application/json:
schema:
default: null
security:
- Authorization: []
x-o2-ratelimit:
module: Functions
operation: delete
x-o2-mcp:
description: Delete a function
category: functions
requires_confirmation: true
components:
schemas:
StreamOrder:
type: object
properties:
applyBeforeFlattening:
type: boolean
isRemoved:
type: boolean
order:
type: integer
format: int32
minimum: 0
stream:
type: string
streamType:
$ref: '#/components/schemas/StreamType'
Transform:
type: object
required:
- function
properties:
function:
type: string
name:
type: string
numArgs:
type: integer
format: int32
minimum: 0
params:
type: string
streams:
type:
- array
- 'null'
items:
$ref: '#/components/schemas/StreamOrder'
transType:
type:
- integer
- 'null'
format: int32
minimum: 0
EnrichmentTableUrlRequest:
type: object
description: 'Request body for creating an enrichment table from a public URL.
The URL must point to a publicly accessible CSV file. Authentication-required
URLs (e.g., S3 presigned URLs with complex headers) are not currently supported.
The `append` behavior is controlled via query parameter, matching the file upload endpoint.'
required:
- url
properties:
replace_failed:
type: boolean
description: 'Replace only the failed job''s URL (optional, default: false)
When true, only updates the failed job with the new URL while keeping
all successful jobs unchanged. Useful for fixing typos or broken URLs
without re-downloading working data sources.'
url:
type: string
description: 'Public URL to the CSV file.
Requirements:
- Must start with http:// or https://
- Must be publicly accessible (no authentication)
- Should return CSV content-type (not enforced but recommended)
- File can be any size - streaming handles large files efficiently'
StreamType:
type: string
enum:
- logs
- metrics
- traces
- service_graph
- enrichment_tables
- file_list
- metadata
- index
securitySchemes:
Authorization:
type: apiKey
in: header
name: Authorization
BasicAuth:
type: http
scheme: basic