Highlights - July 2026

It has been a while since our February 2025 highlights. In this post we cover the most impactful features shipped across 0.46 through 0.56, and a set of CI improvements that make life easier for external contributors.

Features

New components

Source improvements

• The opentelemetry source gained metrics ingestion and now performs full OTLP decoding for logs, metrics, and traces, removing the need for complex remap steps in OTEL -> Vector -> OTEL pipelines.
• The docker_logs source retries Docker daemon communication failures with exponential backoff instead of giving up on transient hiccups.
• A performance regression that inflated CPU usage in the file and kubernetes_logs sources (introduced in 0.50.0) was found and fixed.

Transform improvements

• The tag_cardinality_limit transform gained several new controls: per-tag cardinality overrides (per_tag_limits), per-metric tracking isolation (tracking_scope: per_metric), a global key cap (max_tracked_keys), and the ability to opt entire metrics out of cardinality tracking.
• The syslog encoding transform gained improved RFC compliance, support for scalars, nested objects, and arrays in structured data, and better UTF-8 safety.

Sink improvements

• A configurable retry_strategy for HTTP-based sinks gives users control over which response codes are retried (default / none / all / custom).
• The aws_s3 sink gained Apache Parquet batch encoding.
• The datadog_metrics sink switched to the Series v2 endpoint with zstd compression by default, and datadog_logs switched its default to zstd as well.

Operations and observability

• --watch-config now also watches enrichment table files.
• vector top gained scrollable, sortable, and filterable views (press ? for keybinds).
• Unit tests support an expected_event_count field on outputs to assert on emitted event counts.
• Task-transform utilization no longer counts downstream wait time, giving a more accurate saturation view.
• New internal metrics for capacity planning and backpressure detection:
  • source_buffer_max_size_bytes, source_buffer_max_size_events
  • transform_buffer_max_size_bytes, transform_buffer_max_size_events
  • source_buffer_utilization_mean, transform_buffer_utilization_mean (EWMA-smoothed)
  • component_latency_seconds (histogram), component_latency_mean_seconds (gauge)
  • source_send_latency_seconds, source_send_batch_latency_seconds

For the complete list of changes, breaking changes, and upgrade steps, see the releases page.

VRL

Features

New functions

Syntax

• else and else if can now appear on a new line after the closing } of an if block. Previously the newline terminated the expression, forcing } else if { on a single line.
• String literals now support \u{HEX} Unicode escape sequences ("hello\u{1F30E}world"). Invalid sequences (empty braces, non-hex digits, surrogate codepoints, or values above U+10FFFF) fail at compile time with a specific error.

Type system and function surface

• find now returns null when no match is found, instead of -1. Audit existing programs that branch on find(...) < 0.
• Vector-specific VRL functions are now available in the standalone VRL CLI (vector vrl) and in codec VRL transforms, closing a long-standing surface gap.
• Enrichment functions gained bounded date range filtering (from / to) and wildcard match support.
• encode_proto gained looser scalar coercion: integers and strings are accepted for bool fields, integers for float and double fields, and integer or boolean map keys are stringified per the protobuf JSON mapping. A new allow_lossy_string_coercion flag lets strict callers opt back into spec-only encoding.

Performance

• encode_gzip / decode_gzip / encode_zlib / decode_zlib switched to the zlib-rs backend for significantly faster compression and decompression.
• encode_base64 / decode_base64 / decode_mime_q moved to a SIMD backend.
• parse_regex_all reuses the compiled regex across invocations.

VRL in more places

• HTTP client sources accept VRL expressions in query parameters and in the request body, enabling dynamic request construction (e.g. embedding now() or environment variables in outgoing requests).
• Custom auth strategies expose the client address and URL path to VRL scripts, and can now write scalar values back into the auth context via %field = value writes.
• Templating landed on the http sink’s uri and request.headers fields.

Live reload

• --watch-config also watches external VRL files referenced by remap transforms.
• Vector reloads external VRL files on SIGHUP.

VRL Playground

The VRL Playground gained a timezone selector, performance timing display, output-panel line wrap, and a series of dropdown and rendering fixes.

Fixes

• The compiler now reports every unhandled-error in a single compilation pass instead of stopping at the first. Fix all your fallible calls in one go rather than a compile-fix-compile loop.
• Fallible-call error location is now correct. Previously, a missing ! or , err = on an earlier call could cause the diagnostic to point at a later, unrelated assignment. Now the error is reported on the actual fallible expression, including inside for_each and map_values closures.
• False positive in the unused-variable diagnostic (E900) fixed. A variable used before being reassigned (shadowed) is no longer flagged as unused at its original assignment.
• Lexer errors surface specific error codes (e.g. E209 invalid escape character) instead of the generic E202 syntax error, and their spans now point at the exact character rather than the whole call.
• vector test output honors --color {auto|always|never} and VECTOR_COLOR; VRL diagnostics stop emitting stray ANSI escape sequences when color is disabled or when running non-interactively.

CI and developer ergonomics

A recurring source of friction for contributors was hitting CI failures that were hard to reproduce locally or caused by false positives. Several checks were replaced or improved to reduce that gap. We also fixed long-standing flaky tests.

All of the following checks can be run locally before pushing, so there are no surprises on the PR.

• Simpler PR title check. The semantic PR title action was replaced with a small inline script. Contributors are no longer blocked by a 180-entry hardcoded scope allowlist that drifted every time a component was added or renamed.
• typos replaces check-spelling. The old check-spelling workflow produced enough false positives to be a constant source of friction on PRs. It has been replaced with typos, a Rust-native spell checker that understands identifiers and hex literals natively. Run it locally with cargo binstall typos-cli && typos.
• YAML/JSON/TS formatting. Prettier formatting checks now run in CI for YAML, JSON, and TypeScript files. Run make check-prettier locally and make fix-prettier to auto-fix.
• Improved Markdown checks. The markdownlint configuration was tightened to catch more common style issues. Run make check-markdown locally and make fix-markdown to auto-fix.

Thank you

Vector genuinely would not be where it is without its community.

We are very happy to notice growing interest in Vector:

Thank you to every PR contributor behind those numbers, and to everyone who opened an issue, reviewed code, improved docs, or started a discussion.

We look forward to the future.

Appendix

Vector releases in this window

• 0.46.0 — 2025-04-04
• 0.47.0 — 2025-05-20
• 0.48.0 — 2025-06-30
• 0.49.0 — 2025-08-12
• 0.50.0 — 2025-09-23
• 0.51.0 — 2025-11-04
• 0.52.0 — 2025-12-16
• 0.53.0 — 2026-01-27
• 0.54.0 — 2026-03-10
• 0.55.0 — 2026-04-22
• 0.56.0 — 2026-06-03

VRL

• VRL CHANGELOG
• VRL function reference
• VRL Playground