Route Transform

The Vector route transform splits a stream of events into multiple sub-streams based on a set of conditions.

Configuration

[transforms.my_transform_id]
# General
type = "route" # required
inputs = ["my-source-or-transform-id", "prefix-*"] # required
# Route
route."*" = '.status_code != 200 && !includes(["info", "debug"], .severity)' # example
  • commonrequiredtable

    route

    A table of route identifiers to logical conditions representing the filter of the route. Each route can then be referenced as an input by other components with the name <transform_name>.<route_id>.

Telemetry

This component provides the following metrics that can be retrieved through the internal_metrics source. See the metrics section in the monitoring page for more info.

  • counter

    events_discarded_total

    The total number of events discarded by this component. This metric includes the following tags:

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    events_in_total

    The number of events accepted by this component either from tagged origin like file and uri, or cumulatively from other origins. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • container_name - The name of the container from which the event originates.

    • file - The file from which the event originates.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

    • mode - The connection mode used by the component.

    • peer_addr - The IP from which the event originates.

    • peer_path - The pathname from which the event originates.

    • pod_name - The name of the pod from which the event originates.

    • uri - The sanitized uri from which the event originates.

  • counter

    processed_events_total

    The total number of events processed by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • file - The file that produced the error

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    events_out_total

    The total number of events emitted by this component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

  • counter

    processed_bytes_total

    The number of bytes processed by the component. This metric includes the following tags:

    • component_kind - The Vector component kind.

    • component_name - The Vector component ID.

    • component_type - The Vector component type.

    • container_name - The name of the container from which the bytes originate.

    • file - The file from which the bytes originate.

    • instance - The Vector instance identified by host and port.

    • job - The name of the job producing Vector metrics.

    • mode - The connection mode used by the component.

    • peer_addr - The IP from which the bytes originate.

    • peer_path - The pathname from which the bytes originate.

    • pod_name - The name of the pod from which the bytes originate.

    • uri - The sanitized uri from which the bytes originate.

Examples

Given the following Vector log event:

{
"level": "info"
}

And the following configuration:

vector.toml
[transforms.route]
type = "route"
route.debug = '.level == "debug"'
route.info = '.level == "info"'
route.warn = '.level == "warn"'
route.error = '.level == "error"'

The following Vector log event will be output:

{
"level": "info"
}

How It Works

State

This component is stateless, meaning its behavior is consistent across each input.