ConfigsApr 14, 2026·3 min read

Vector — High-Performance Observability Data Pipeline

Vector collects, transforms, and routes logs, metrics, and traces from any source to any destination. Written in Rust, it handles 100x more throughput than Logstash/Fluentd on the same hardware with a unified config language.

TL;DR
Vector is a Rust-based observability pipeline that collects, transforms, and routes logs, metrics, and traces with minimal resource usage.
§01

What it is

Vector is an observability data pipeline written in Rust. It collects logs, metrics, and traces from any source, transforms them with a built-in remap language (VRL), and routes them to any destination. Vector replaces tools like Logstash, Fluentd, and Telegraf with a single binary that handles all three data types.

Vector targets SRE teams, platform engineers, and anyone managing observability infrastructure. Its Rust foundation delivers high throughput with low memory usage, making it practical for high-volume production environments.

§02

How it saves time or tokens

Vector consolidates log collection, metric aggregation, and trace routing into one tool. The Vector Remap Language (VRL) provides a type-safe transformation layer that catches errors at parse time rather than runtime. A single TOML configuration file defines sources, transforms, and sinks, eliminating the multi-tool configuration sprawl common in observability stacks.

§03

How to use

  1. Install Vector using the official install script: curl --proto '=https' --tlsv1.2 -sSfL https://sh.vector.dev | bash.
  2. Create a TOML config file defining sources (where data comes from), transforms (how to parse and enrich), and sinks (where to send).
  3. Run Vector with vector --config /etc/vector/vector.toml and monitor throughput via the built-in API.
§04

Example

# /etc/vector/vector.toml

[sources.nginx_logs]
type = 'file'
include = ['/var/log/nginx/access.log']
read_from = 'beginning'

[transforms.parse]
type = 'remap'
inputs = ['nginx_logs']
source = '''
. = parse_nginx_log!(.message, 'combined')
'''

[sinks.elasticsearch]
type = 'elasticsearch'
inputs = ['parse']
endpoints = ['http://localhost:9200']
bulk.index = 'nginx-%Y-%m-%d'
§05

Related on TokRepo

§06

Common pitfalls

  • VRL (Vector Remap Language) is not a general-purpose language. It is purpose-built for data transformation. Learn its type system before writing complex transforms.
  • Vector buffers data in memory by default. Configure disk buffers for production to prevent data loss during backpressure or restarts.
  • Source and sink compatibility varies by version. Check the Vector docs for your specific version before assuming a source or sink is available.

Frequently Asked Questions

How does Vector compare to Logstash?+

Vector is written in Rust and uses significantly less CPU and memory than Logstash (JVM-based). Vector handles logs, metrics, and traces in one tool, while Logstash focuses on logs. Vector also provides a type-safe transformation language (VRL) that catches errors at config parse time.

What is VRL in Vector?+

VRL (Vector Remap Language) is a purpose-built expression language for transforming observability data. It is type-safe, meaning it catches type errors at parse time rather than failing silently at runtime. VRL supports parsing, enrichment, filtering, and restructuring.

Can Vector replace Fluentd and Telegraf?+

Yes. Vector handles logs (replacing Fluentd), metrics (replacing Telegraf), and traces in a single binary. It supports the same sources and sinks as both tools and adds a unified transformation layer.

What sinks does Vector support?+

Vector supports dozens of sinks including Elasticsearch, Datadog, Splunk, AWS CloudWatch, Kafka, Loki, Prometheus remote write, ClickHouse, and many more. The full list is in the Vector documentation.

Is Vector suitable for high-volume production use?+

Yes. Vector is designed for high-throughput environments. Its Rust foundation provides predictable latency and low memory usage. It supports disk-based buffering, end-to-end acknowledgments, and horizontal scaling for production reliability.

Citations (3)
  • Vector GitHub— Vector collects, transforms, and routes logs, metrics, and traces
  • Vector Documentation— Vector Remap Language provides type-safe observability data transformation
  • Vector Official Site— Observability pipeline architecture and data routing patterns

Discussion

Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.

Related Assets