Send logs with Vector

Vector tails log files, wraps each line in an OTLP envelope with a remap transform, and ships it to Rootprint over OTLP. Records land in the index your ingest API key is scoped to: otel-logs-v0_9 in this guide.

Prerequisites

A running Rootprint instance. Substitute its host for <your-rootprint>.
An ingest API key scoped to otel-logs-v0_9. Create one in Settings → API keys with Create ingest key, then substitute it for <your-ingest-api-key>. See API keys.
A Linux host, with Docker Compose if you run Vector in a container.

Write the config

Replace <your-rootprint>, <your-ingest-api-key>, the include glob, and myapp with your service name.

Show vector.yaml

sources:
  app_logs:
    type: file
    include:
      - /var/log/myapp/*.log
    read_from: end

transforms:
  to_otlp:
    type: remap
    inputs: [app_logs]
    source: |
      .resourceLogs = [{
        "resource": {
          "attributes": [
            { "key": "service.name", "value": { "stringValue": "myapp" } },
            { "key": "host.name", "value": { "stringValue": get_hostname!() } }
          ]
        },
        "scopeLogs": [{
          "scope": { "name": "vector", "version": "" },
          "logRecords": [{
            "timeUnixNano": to_unix_timestamp!(now(), unit: "nanoseconds"),
            "observedTimeUnixNano": to_unix_timestamp!(now(), unit: "nanoseconds"),
            "severityNumber": 9,
            "severityText": "INFO",
            "body": { "stringValue": .message },
            "attributes": [
              { "key": "log.file.path", "value": { "stringValue": .file } }
            ],
            "traceId": "",
            "spanId": "",
            "flags": 0,
            "droppedAttributesCount": 0
          }]
        }]
      }]

      # Drop the original top-level fields so the sink sees only the OTLP envelope.
      del(.message)
      del(.file)
      del(.host)
      del(.source_type)
      del(.timestamp)

sinks:
  rootprint:
    type: opentelemetry
    inputs: [to_otlp]
    protocol:
      type: http
      uri: https://<your-rootprint>/v1/logs
      method: post
      encoding:
        codec: otlp
      compression: gzip
      request:
        headers:
          Authorization: "Bearer <your-ingest-api-key>"
      batch:
        timeout_secs: 1
        max_bytes: 8388608

read_from: end skips existing lines on first start. Set it to beginning for a one-time backfill. After the first read, Vector resumes from its saved offset.

Run Vector

Bare Metal
Docker

Install Vector from the installation page.

Save the config as /etc/vector/vector.yaml.
The service runs as the vector user. Let it read the log files. On Debian/Ubuntu, /var/log files usually belong to the adm group:
sudo usermod -aG adm vector
Alternatively, sudo chmod a+r the log files. That opens them to every user on the host.
Restart Vector. status should show active (running) with no config or sink errors:
sudo systemctl restart vector sudo systemctl status vector

Save the config as vector.yaml next to your docker-compose.yml, and add this service. The bind mount keeps the /var/log/myapp path the same inside the container.

services:
  rootprint-vector:
    image: timberio/vector:0.58.0-alpine
    container_name: rootprint-vector
    restart: unless-stopped
    volumes:
      - ./vector.yaml:/etc/vector/vector.yaml:ro
      - /var/log/myapp:/var/log/myapp:ro

docker compose up -d rootprint-vector

Send a test log line

sudo mkdir -p /var/log/myapp
echo "$(date -Iseconds) hello from vector" | sudo tee -a /var/log/myapp/test.log

Verify in Rootprint

Open Logs, pick otel-logs-v0_9 from the index selector, and search for hello from vector. Records typically appear within 5–10 seconds.

What the remap does

The opentelemetry sink accepts only events shaped like an OTLP request. The remap builds that envelope and deletes the file source’s own top-level fields.

service.name: fills Rootprint’s service_name column. Replace myapp.
host.name: set from get_hostname!().
body: the raw log line. To parse fields out of it, add a remap before to_otlp and put the parsed fields in attributes.
Log level: every record is INFO. Set severityText and severityNumber from the line if you need real levels.
Timestamps: both use the time Vector read the line. Parse the line’s own timestamp into timeUnixNano if you need it.

Troubleshooting

403 when the token comes from ${VAR}: Vector 0.57 and later don’t interpolate environment variables in config files by default, so the literal ${VAR} is sent as the key. Set VECTOR_DANGEROUSLY_ALLOW_ENV_VAR_INTERPOLATION=true in Vector’s environment.
415 from Rootprint: encoding.codec must be otlp.
401/403/413/415: see Response codes.

Send logs from Docker: collect every container’s stdout instead of specific files.
OTLP reference: endpoint, response codes, limits.
Indexes: the otel-logs-v0_9 schema.

Get Started

Send Logs

Traces

Search Logs

Manage Rootprint

Send logs with Vector

Prerequisites

What the remap does

Troubleshooting

​Prerequisites

​What the remap does

​Troubleshooting

​Related

Prerequisites

What the remap does

Troubleshooting

Related