Vector by Datadog is a lightweight, ultra-fast tool for building observability pipelines. Deploy this integration to send logs from your Vector tools to your account.

Configure Vector

Install Vector

If you haven’t already, install Vector:

curl -sSf | sh

For alternate installation instructions, see Installation from Vector.

Configure Vector with sink

Add this code block to your Vector configuration file. We recommend the configuaration shown in the code block.

Find the complete configuration docs at http sink from Vector.

  # REQUIRED - General
  type = "http" # Don't change this setting
  inputs = ["YOUR_SOURCE_ID"]
  encoding.codec = "json" # enum: "json" or "text"

  # More information on uri below this code block
  uri = "https://<<LISTENER-HOST>>:8071/?token=<<LOG-SHIPPING-TOKEN>>&type=vector"

  # OPTIONAL - General
  compression = "gzip" # no default, must be: "gzip" (if supplied)

  # OPTIONAL - Batching
  batch.max_bytes = 9000000 # bytes - max batch is 10MB
  batch.timeout_secs = 3

  # OPTIONAL - Buffer
    type = "disk" # default, enum: "memory" or "disk"
    when_full = "block" # default, enum: "block" or "drop_newest"
    max_size = 268435488 # no default, bytes(104.9mb), relevant when type = "disk"

If you get a 400 error when using json encoding, try use port 8081 instead of 8071.

If your logs are sent in batches, change the encoding.codec setting from json to text.

Parameter Description
uri (Required) Your region’s listener URL account token, and log type.
Replace <<LISTENER-HOST>> with the host for your region. For example, if your account is hosted on AWS US East, or if hosted on Azure West Europe. The required port depends whether HTTP or HTTPS is used: HTTP = 8070, HTTPS = 8071.
Replace <<LOG-SHIPPING-TOKEN>> with the token of the account you want to ship to.
Run Vector
vector --config path/to/your/vector.toml
Check for your logs

Give your logs some time to get from your system to ours, and then open Open Search Dashboards.

If you still don’t see your logs, see log shipping troubleshooting.