file sink

Streams `log` events to a file.

The file sink streams log events to a file.

Config File

vector.toml (simple)
vector.toml (advanced)
type = "file" # must be: "file"
inputs = ["my-source-id"]
path = "vector-%Y-%m-%d.log"
# For a complete list of options see the "advanced" tab above.
# The component type
# * required
# * no default
# * must be: "file"
type = "file"
# A list of upstream source or transform IDs. See Config Composition for more
# info.
# * required
# * no default
inputs = ["my-source-id"]
# File name to write events to.
# * required
# * no default
path = "vector-%Y-%m-%d.log"
path = "application-{{ application_id }}-%Y-%m-%d.log"
# The encoding format used to serialize the events before appending. The
# default is dynamic based on if the event is structured or not.
# * optional
# * no default
# * enum: "ndjson" or "text"
encoding = "ndjson"
encoding = "text"
# Enables/disables the sink healthcheck upon start.
# * optional
# * default: true
healthcheck = true
# The amount of time a file can be idle and stay open. After not receiving any
# events for this timeout, the file will be flushed and closed.
# * optional
# * default: "30"
idle_timeout_secs = "30"

How It Works

Delivery Guarantee

Due to the nature of this component, it offers a best effort delivery guarantee.


The file sink encodes events before writing them downstream. This is controlled via the encoding option which accepts the following options:




The payload will be encoded in new line delimited JSON payload, each line representing a JSON encoded event.


The payload will be encoded as new line delimited text, each line representing the value of the "message" key.

Dynamic encoding

By default, the encoding chosen is dynamic based on the explicit/implcit nature of the event's structure. For example, if this event is parsed (explicit structuring), Vector will use json to encode the structured data. If the event was not explicitly structured, the text encoding will be used.

To further explain why Vector adopts this default, take the simple example of accepting data over the tcp source and then connecting it directly to the file sink. It is less surprising that the outgoing data reflects the incoming data exactly since it was not explicitly structured.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.


The file sink streams data on a real-time event-by-event basis. It does not batch data.

Template Syntax

The path options support Vector's template syntax, enabling dynamic values derived from the event's data. This syntax accepts strftime specifiers as well as the {{ field_name }} syntax for accessing event fields. For example:

# ...
path = "vector-%Y-%m-%d.log"
path = "application-{{ application_id }}-%Y-%m-%d.log"
# ...

You can read more about the complete syntax in the template syntax section.


The best place to start with troubleshooting is to check the Vector logs. This is typically located at /var/log/vector.log, then proceed to follow the Troubleshooting Guide.

If the Troubleshooting Guide does not resolve your issue, please:

  1. Check for any open file_sink issues.

  2. If encountered a bug, please file a bug report.

  3. If encountered a missing feature, please file a feature request.

  4. If you need help, join our chat/forum community. You can post a question and search previous questions.