stdin

Collect logs sent via stdin

status: stable role: sidecar delivery: at-least-once egress: stream state: stateless output: log
Page source Edit this page

Configuration

Example configurations 

{
  "sources": {
    "my_source_id": {
      "type": "stdin"
    }
  }
}
[sources.my_source_id]
type = "stdin"

---
sources:
  my_source_id:
    type: stdin

{
  "sources": {
    "my_source_id": {
      "type": "stdin",
      "host_key": "host",
      "max_length": 102400
    }
  }
}
[sources.my_source_id]
type = "stdin"
host_key = "host"
max_length = 102_400

---
sources:
  my_source_id:
    type: stdin
    host_key: host
    framing: null
    max_length: 102400
    decoding: null

decoding

optional object
Configures in which way frames are decoded into events.

decoding.codec

optional string literal enum
The decoding method.
Enum options
OptionDescription
bytesEvents containing the byte frame as-is.
jsonEvents being parsed from a JSON string.
syslogEvents being parsed from a Syslog message.
Examples 
"bytes"
"json"
"syslog"

framing

optional object
Configures in which way incoming byte sequences are split up into byte frames.

framing.character_delimited

optional object
Options for character_delimited framing.
Relevant when: method = `character_delimited`
framing.character_delimited.delimiter
optional string literal
The character used to separate frames.
Examples 
"\n"
"\t"
framing.character_delimited.max_length
optional uint
The maximum frame length limit. Any frames longer than max_length bytes will be discarded entirely.
Examples 
65535
102400
default: 102400 (bytes)

framing.method

optional string literal enum
The framing method.
Enum options
OptionDescription
bytesByte frames are passed through as-is according to the underlying I/O boundaries (e.g. split between packets for UDP or between segments for TCP).
character_delimitedByte frames which are delimited by a chosen character.
length_delimitedByte frames whose length is encoded in a header.
newline_delimitedByte frames which are delimited by a newline character.
octet_countingByte frames according to the octet counting format.
Examples 
"bytes"
"character_delimited"
"length_delimited"
"newline_delimited"
"octet_counting"

framing.newline_delimited

optional object
Options for newline_delimited framing.
Relevant when: method = `newline_delimited`
framing.newline_delimited.max_length
optional uint
The maximum frame length limit. Any frames longer than max_length bytes will be discarded entirely.
Examples 
65535
102400
default: 102400 (bytes)

framing.octet_counting

optional object
Options for octet_counting framing.
Relevant when: method = `octet_counting`
framing.octet_counting.max_length
optional uint
The maximum frame length limit. Any frames longer than max_length bytes will be discarded entirely.
Examples 
65535
102400
default: 102400 (bytes)

host_key

optional string literal
The key name added to each event representing the current host. This can also be globally set via the global host_key option.
default: host

max_length

optional uint
The maximum bytes size of a message before rest of it will be discarded.
default: 102400 (bytes)

Output

Logs

Line

An individual event from STDIN.
Fields
host required string literal
The local hostname, equivalent to the gethostname command.
Examples
my-host.local
message required string literal
The raw line, unparsed.
Examples
2019-02-13T19:48:34+00:00 [info] Started GET "/" for 127.0.0.1
timestamp required timestamp
The exact time the event was ingested into Vector.
Examples
2020-10-10T17:07:36.452332Z

Telemetry

Metrics

link

component_received_events_total

counter
The number of events accepted by this component either from tagged origins like file and uri, or cumulatively from other origins.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
container_name optional
The name of the container from which the event originates.
file optional
The file from which the event originates.
host required
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the event originates.
peer_path optional
The pathname from which the event originates.
pid required
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the event originates.
uri optional
The sanitized URI from which the event originates.

component_sent_event_bytes_total

counter
The total number of event bytes emitted by this component.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
host required
The hostname of the system Vector is running on.
pid required
The process ID of the Vector instance.

component_sent_events_total

counter
The total number of events emitted by this component.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
host required
The hostname of the system Vector is running on.
pid required
The process ID of the Vector instance.

events_in_total

counter
The number of events accepted by this component either from tagged origins like file and uri, or cumulatively from other origins. This metric is deprecated and will be removed in a future version. Use component_received_events_total instead.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
container_name optional
The name of the container from which the event originates.
file optional
The file from which the event originates.
host required
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the event originates.
peer_path optional
The pathname from which the event originates.
pid required
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the event originates.
uri optional
The sanitized URI from which the event originates.

events_out_total

counter
The total number of events emitted by this component. This metric is deprecated and will be removed in a future version. Use component_sent_events_total instead.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
host required
The hostname of the system Vector is running on.
pid required
The process ID of the Vector instance.

processed_bytes_total

counter
The number of bytes processed by the component.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
container_name optional
The name of the container from which the bytes originate.
file optional
The file from which the bytes originate.
host required
The hostname of the system Vector is running on.
mode optional
The connection mode used by the component.
peer_addr optional
The IP from which the bytes originate.
peer_path optional
The pathname from which the bytes originate.
pid required
The process ID of the Vector instance.
pod_name optional
The name of the pod from which the bytes originate.
uri optional
The sanitized URI from which the bytes originate.

processed_events_total

counter
The total number of events processed by this component. This metric is deprecated in place of using component_received_events_total and component_sent_events_total metrics.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
host required
The hostname of the system Vector is running on.
pid required
The process ID of the Vector instance.

stdin_reads_failed_total

counter
The total number of errors reading from stdin.
component_id required
The Vector component ID.
component_kind required
The Vector component kind.
component_name required
Deprecated, use component_id instead. The value is the same as component_id.
component_type required
The Vector component type.
host required
The hostname of the system Vector is running on.
pid required
The process ID of the Vector instance.

Examples

STDIN line

Given this event...
2019-02-13T19:48:34+00:00 [info] Started GET "/" for 127.0.0.1
...and this configuration...
[sources.my_source_id]
type = "stdin"

---
sources:
  my_source_id:
    type: stdin

{
  "sources": {
    "my_source_id": {
      "type": "stdin"
    }
  }
}
...this Vector event is produced:
{
  "host": "my-host.local",
  "message": "2019-02-13T19:48:34+00:00 [info] Started GET \"/\" for 127.0.0.1",
  "timestamp": "2020-10-10T17:07:36.452332Z"
}

How it works

Context

By default, the stdin source augments events with helpful context keys.

Line Delimiters

Each line is read until a new line delimiter, the 0xA byte, is found.

State

This component is stateless, meaning its behavior is consistent across each input.
Sidebar