file sink

Streams `log` events to a file.

The file sink streams log events to a file.

Config File

vector.toml (example)
vector.toml (schema)
vector.toml (specification)
[sinks.my_sink_id]
type = "file" # must be: "file"
inputs = ["my-source-id"]
path = "vector-%Y-%m-%d.log"
encoding = "ndjson" # no default, enum: "ndjson" or "text"
healthcheck = true # default
idle_timeout_secs = "30" # default

Options

Key

Type

Description

REQUIRED

type

string

The component type required must be: "file"

inputs

[string]

A list of upstream source or transform IDs. See Config Composition for more info. required example: ["my-source-id"]

path

string

File name to write events to.This option supports dynamic values via Vector's template syntax. See Template Syntax for more info. required example: "vector-%Y-%m-%d.log"

OPTIONAL

encoding

string

The encoding format used to serialize the events before appending. The default is dynamic based on if the event is structured or not. See Encodings for more info. no default enum: "ndjson" or "text"

healthcheck

bool

Enables/disables the sink healthcheck upon start. default: true

idle_timeout_secs

int

The amount of time a file can be idle and stay open. After not receiving any events for this timeout, the file will be flushed and closed. default: "30"

How It Works

Delivery Guarantee

Due to the nature of this component, it offers a best effort delivery guarantee.

Encodings

The file sink encodes events before writing them downstream. This is controlled via the encoding option which accepts the following options:

Encoding

Description

ndjson

The payload will be encoded in new line delimited JSON payload, each line representing a JSON encoded event.

text

The payload will be encoded as new line delimited text, each line representing the value of the "message" key.

Dynamic encoding

By default, the encoding chosen is dynamic based on the explicit/implcit nature of the event's structure. For example, if this event is parsed (explicit structuring), Vector will use json to encode the structured data. If the event was not explicitly structured, the text encoding will be used.

To further explain why Vector adopts this default, take the simple example of accepting data over the tcp source and then connecting it directly to the file sink. It is less surprising that the outgoing data reflects the incoming data exactly since it was not explicitly structured.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Streaming

The file sink streams data on a real-time event-by-event basis. It does not batch data.

Template Syntax

The path options support Vector's template syntax, enabling dynamic values derived from the event's data. This syntax accepts strftime specifiers as well as the {{ field_name }} syntax for accessing event fields. For example:

vector.toml
[sinks.my_file_sink_id]
# ...
path = "vector-%Y-%m-%d.log"
path = "application-{{ application_id }}-%Y-%m-%d.log"
# ...

You can read more about the complete syntax in the template syntax section.

Troubleshooting

The best place to start with troubleshooting is to check the Vector logs. This is typically located at /var/log/vector.log, then proceed to follow the Troubleshooting Guide.

If the Troubleshooting Guide does not resolve your issue, please:

  1. Check for any open file_sink issues.

  2. If encountered a bug, please file a bug report.

  3. If encountered a missing feature, please file a feature request.

  4. If you need help, join our chat/forum community. You can post a question and search previous questions.

Resources