Filter events based on a list of values

[gwosty]

Is it possible to filter events using a list of values?

For example, I have a list of VIP sources that I would like to send to a specific sink. I was hoping to do something like the enrichment flow where you load the list of ids from a file and during the filter step, filter only the VIP events.

[jszwedko]

Hey! You should be able to use https://vector.dev/docs/reference/vrl/functions/#includes to check if a value is in a given list.

[gwosty]

Hi @jszwedko! Thanks for the answer! Would you need to hardcode the values in the config then? I'm expecting at least a few hundred values, thaat's why I was hoping to have that separate in a file

[jszwedko]

You can load VRL programs from a file in a remap transform. Or yeah, you could leverage enrichment tables here to load them. If you did that, you might not even use includes but rather just https://vector.dev/docs/reference/vrl/functions/#get_enrichment_table_record and check if there is any result or not.