File Sink

The Vector file sink streams log events to a file.


# General
type = "file" # required
inputs = ["my-source-or-transform-id"] # required
healthcheck = true # optional, default
path = "vector-%Y-%m-%d.log" # required
# Encoding
encoding.codec = "ndjson" # required
  • tablecommonrequired


    Configures the encoding specific sink behavior.

    • stringenumcommonrequired


      The encoding codec used to serialize the events before outputting.

      • No default
      • Enum, must be one of: "ndjson" "text"
      • View examples
    • [string]optional


      Prevent the sink from encoding the specified labels.

      • No default
      • View examples
    • [string]optional


      Limit the sink to only encoding the specified labels.

      • No default
      • View examples
    • stringenumoptional


      How to format event timestamps.

      • Default: "rfc3339"
      • Enum, must be one of: "rfc3339" "unix"
      • View examples
  • boolcommonoptional


    Enables/disables the sink healthcheck upon start.

    • Default: true
    • View examples
  • uintoptional


    The amount of time a file can be idle and stay open. After not receiving any events for this timeout, the file will be flushed and closed.

    • Default: "30"
  • templateablestringcommonrequired


    File name to write events to. See Template Syntax for more info.

    • No default
    • View examples

How It Works

Dynamic File And Directory Creation

Vector will attempt to create the entire directory structure and the file when emitting events to the file sink. This requires that the Vector agent have the correct permissions to create and write to files in the specified directories.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.


The file sink streams data on a real-time event-by-event basis. It does not batch data.

Template Syntax

The path options support Vector's template syntax, enabling dynamic values derived from the event's data. This syntax accepts strptime specifiers as well as the {{ field_name }} syntax for accessing event fields. For example:

# ...
path = "vector-%Y-%m-%d.log"
path = "application-{{ application_id }}-%Y-%m-%d.log"
# ...

You can learn more about the complete syntax in the templates reference.