File Sink

The Vector file sink streams log events to a file.

Configuration

• Common
• Advanced

vector.toml

[sinks.my_sink_id]
  type = "file" # must be: "file"
  inputs = ["my-source-id"] # example
  path = "vector-%Y-%m-%d.log" # example

Options

4 items

common onlyrequired only

stringenumoptional

encoding

The encoding format used to serialize the events before outputting.

No default

Enum, must be one of: "ndjson" "text"

View examples

booloptional

healthcheck

Enables/disables the sink healthcheck upon start.

Default: true

View examples

intoptional

idle_timeout_secs

The amount of time a file can be idle and stay open. After not receiving any events for this timeout, the file will be flushed and closed.

Default: "30"

View examples

commontemplateablestringrequired

path

File name to write events to. See Template Syntax for more info.

No default

View examples

How It Works

Dynamic file and directory creation

Vector will attempt to create the entire directory structure and the file when emitting events to the file sink. This requires that the Vector agent have the correct permissions to create and write to files in the specified directories.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Streaming

The file sink streams data on a real-time event-by-event basis. It does not batch data.

Template Syntax

The path options support Vector's template syntax, enabling dynamic values derived from the event's data. This syntax accepts strptime specifiers as well as the {{ field_name }} syntax for accessing event fields. For example:

vector.toml

[sinks.my_file_sink_id]
  # ...
  path = "vector-%Y-%m-%d.log"
  path = "application-{{ application_id }}-%Y-%m-%d.log"
  # ...

You can read more about the complete syntax in the template syntax section.