Exec Source

The Vector exec source receives logs from Exec.

Configuration

[sources.my_source_id]
# General
type = "exec" # required
command = ["echo", "Hello World!"] # required
mode = "scheduled" # required
# Scheduled
scheduled.exec_interval_secs = 60 # optional, default, seconds, relevant when mode = [`scheduled`](#scheduled)
# Streaming
streaming.respawn_on_exit = true # optional, default, relevant when mode = [`streaming`](#streaming)
  • commonrequired[string]

    command

    The command to be run, plus any arguments required.

  • optionalbool

    event_per_line

    Determine if events should be generated per line or buffered and output as a single event when script execution finishes.

    • Default: true
  • optionalbool

    include_stderr

    Include the output of stderr when generating events.

    • Default: true
  • optionaluint

    maximum_buffer_size_bytes

    The maximum buffer size allowed before a log event will be generated.

    • Default: 1000000 (bytes)
  • enumcommonrequiredstring

    mode

    The type of exec mechanism.

    • Syntax: literal
    • Enum, must be one of: "scheduled" "streaming"
  • commonoptionaltable

    scheduled

    The scheduled options.

    • commonoptionaluint

      exec_interval_secs

      The interval in seconds between scheduled command runs. The command will be killed if it takes longer than exec_interval_secs to run.

      • Only relevant when: mode = [`scheduled`](#scheduled)
      • Default: 60 (seconds)
  • commonoptionaltable

    streaming

    The streaming options.

    • optionaluint

      respawn_interval_secs

      The interval in seconds between restarting streaming commands if needed.

      • Only relevant when: mode = [`streaming`](#streaming)
      • Default: 5 (seconds)
    • commonoptionalbool

      respawn_on_exit

      Determine if a streaming command should be restarted if it exits.

      • Only relevant when: mode = [`streaming`](#streaming)
      • Default: true
  • optionalstring

    working_directory

    The directory in which to run the command.

    • Syntax: literal

Output

This component outputs log events with the following fields:

{
"command" : [
"echo",
"Hello World!",
"ls",
"-la"
],
"data_stream" : "stdout",
"host" : "my-host.local",
"message" : "2019-02-13T19:48:34+00:00 [info] Started GET \"/\" for 127.0.0.1",
"pid" : 60085,
"timestamp" : "2020-10-10T17:07:36+00:00"
}
  • commonrequired[string]

    command

    The command that was run to generate this event.

  • commonoptionalstring

    data_stream

    The data stream from which the event originated.

    • Syntax: literal
  • commonrequiredstring

    host

    The local hostname, equivalent to the gethostname command.

    • Syntax: literal
  • commonrequiredstring

    message

    The raw line, unparsed.

    • Syntax: literal
  • commonrequireduint

    pid

    The process ID of the command.

  • commonrequiredtimestamp

    timestamp

    The exact time the event was ingested into Vector.

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

  • counter

    events_in_total

    The number of events accepted by this component either from tagged origin like file and uri, or cumulatively from other origins. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • container_name - The name of the container from which the event originates.

    • file - The file from which the event originates.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

    • mode - The connection mode used by the component.

    • peer_addr - The IP from which the event originates.

    • peer_path - The pathname from which the event originates.

    • pod_name - The name of the pod from which the event originates.

    • uri - The sanitized uri from which the event originates.

  • counter

    processed_bytes_total

    The number of bytes processed by the component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • container_name - The name of the container from which the bytes originate.

    • file - The file from which the bytes originate.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

    • mode - The connection mode used by the component.

    • peer_addr - The IP from which the bytes originate.

    • peer_path - The pathname from which the bytes originate.

    • pod_name - The name of the pod from which the bytes originate.

    • uri - The sanitized uri from which the bytes originate.

  • counter

    processed_events_total

    The total number of events processed by this component. This metric is deprecated in place of using events_in_total and events_out_total metrics. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    processing_errors_total

    The total number of processing errors encountered by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • error_type - The type of the error

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    command_executed_total

    The total number of times a command has been executed. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    events_out_total

    The total number of events emitted by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • histogram

    command_execution_duration_seconds

    The command execution duration in seconds. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

Examples

Given the following input:

(_message)

And the following configuration:

vector.toml
[sources.exec]
type = "exec"

The following Vector log event will be output:

{
"data_stream": "stdout",
"pid": 5678,
"timestamp": "2020-03-13T20:45:38.119Z",
"host": "my-host.local",
"message": "64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.060 ms"
}

How It Works

Context

By default, the exec source will augment events with helpful context keys as shown in the "Output" section.

Line Delimiters

Each line is read until a new line delimiter, the 0xA byte, is found or the end of the maximum_buffer_size is reached.

State

This component is stateless, meaning its behavior is consistent across each input.