File Sink

The Vector file sink sends logs

Configuration

[sinks.my_sink_id]
# General
type = "file" # required
inputs = ["my-source-or-transform-id", "prefix-*"] # required
compression = "none" # optional, default
path = "/tmp/vector-%Y-%m-%d.log" # required
# Encoding
encoding.codec = "ndjson" # required
# Healthcheck
healthcheck.enabled = true # optional, default
  • enumcommonoptionalstring

    compression

    The compression strategy used to compress the encoded event data before transmission.

    Some cloud storage API clients and browsers will handle decompression transparently, so files may not always appear to be compressed depending how they are accessed.

    • Syntax: literal
    • Default: "none"
    • Enum, must be one of: "none" "gzip" "syntax"
  • commonrequiredtable

    encoding

    Configures the encoding specific sink behavior.

    • commonrequiredstring

      codec

      The encoding codec used to serialize the events before outputting.

      • Syntax: literal
    • optional[string]

      except_fields

      Prevent the sink from encoding the specified labels.

    • optional[string]

      only_fields

      Prevent the sink from encoding the specified labels.

    • enumoptionalstring

      timestamp_format

      How to format event timestamps.

      • Syntax: literal
      • Default: "rfc3339"
      • Enum, must be one of: "rfc3339" "unix"
  • commonoptionaltable

    healthcheck

    Health check options for the sink. See Health checks for more info.

    • commonoptionalbool

      enabled

      Enables/disables the healthcheck upon Vector boot.

      • Default: true
  • optionaluint

    idle_timeout_secs

    The amount of time a file can be idle and stay open. After not receiving any events for this timeout, the file will be flushed and closed.

    • Default: 30
  • commonrequiredstring

    path

    File name to write events to.

    This field supports Vector's template syntax, which enables the use of dynamic per-event values.

    • Syntax: template

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

  • counter

    events_discarded_total

    The total number of events discarded by this component. This metric includes the following tags:

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    events_in_total

    The total number of events accepted by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    processing_errors_total

    The total number of processing errors encountered by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • error_type - The type of the error

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    events_out_total

    The total number of events emitted by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

How It Works

File & Directory Creation

Vector will attempt to create the entire directory structure and the file when emitting events to the file sink. This requires that the Vector agent have the correct permissions to create and write to files in the specified directories.

Health checks

Health checks ensure that the downstream service is accessible and ready to accept data. This check is performed upon sink initialization. If the health check fails an error will be logged and Vector will proceed to start.

Require health checks

If you'd like to exit immediately upon a health check failure, you can pass the --require-healthy flag:

vector --config /etc/vector/vector.toml --require-healthy

Disable health checks

If you'd like to disable health checks for this sink you can set the healthcheck option to false.

State

This component is stateless, meaning its behavior is consistent across each input.