File Sink

The Vector file sink streams log events to a file.

Configuration

• Common
• Advanced

vector.toml

[sinks.my_sink_id]
  # General
  type = "file" # required
  inputs = ["my-source-or-transform-id"] # required
  healthcheck = true # optional, default
  path = "vector-%Y-%m-%d.log" # required

  # Encoding
  encoding.codec = "ndjson" # required

4 items

commonrequired

• tablecommonrequired

  encoding

  Configures the encoding specific sink behavior.

  • stringenumcommonrequired

    codec

    The encoding codec used to serialize the events before outputting.

    • No default
    • Enum, must be one of: "ndjson" "text"
    • View examples
  • [string]optional

    except_fields

    Prevent the sink from encoding the specified labels.

    • No default
    • View examples
  • [string]optional

    only_fields

    Limit the sink to only encoding the specified labels.

    • No default
    • View examples
  • stringenumoptional

    timestamp_format

    How to format event timestamps.

    • Default: "rfc3339"
    • Enum, must be one of: "rfc3339" "unix"
    • View examples
• boolcommonoptional

  healthcheck

  Enables/disables the sink healthcheck upon start.

  • Default: true
  • View examples
• uintoptional

  idle_timeout_secs

  The amount of time a file can be idle and stay open. After not receiving any events for this timeout, the file will be flushed and closed.

  • Default: "30"
• templateablestringcommonrequired

  path

  File name to write events to. See Template Syntax for more info.

  • No default
  • View examples

How It Works

Dynamic File And Directory Creation

Vector will attempt to create the entire directory structure and the file when emitting events to the file sink. This requires that the Vector agent have the correct permissions to create and write to files in the specified directories.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Streaming

The file sink streams data on a real-time event-by-event basis. It does not batch data.

Template Syntax

The path options support Vector's template syntax, enabling dynamic values derived from the event's data. This syntax accepts strptime specifiers as well as the {{ field_name }} syntax for accessing event fields. For example:

vector.toml

[sinks.my_file_sink_id]
  # ...
  path = "vector-%Y-%m-%d.log"
  path = "application-{{ application_id }}-%Y-%m-%d.log"
  # ...

You can learn more about the complete syntax in the templating reference.