Data Model

A deeper look at Vector's data model


As shown above, Vector generalizes all data flowing through Vector as "events":

message EventWrapper {
oneof event {
Log log = 1; // view the log specific page for more info
Metric metric = 2; // view the metrics specific page for more info

You can view a complete definition in the event proto definition. You'll notice that each event must be one of 2 types:


Why not just "event"?

  1. We like the "everything is an event" philosophy a lot.

  2. We recognize that there's a large gap between that idea and a lot of existing tooling.

  3. By starting "simple" (from an integration perspective, i.e. meeting people where they are) and evolving our data model as we encounter the specific needs of new sources/sinks/transforms, we avoid overdesigning yet another grand unified data format.

  4. Starting with support for a little more "old school" model makes us a better tool for supporting incremental progress in existing infrastructures towards more event-based architectures.