File Sink

The Vector file sink streams log events to a file.

Configuration

vector.toml
[sinks.my_sink_id]
# General
type = "file" # required
inputs = ["my-source-id"] # required
healthcheck = true # optional, default
path = "vector-%Y-%m-%d.log" # required
# Encoding
encoding.codec = "ndjson" # required
  • tablecommonrequired

    encoding

    Configures the encoding specific sink behavior.

    • stringenumcommonrequired

      codec

      The encoding codec used to serialize the events before outputting.

      • No default
      • Enum, must be one of: "ndjson" "text"
      • View examples
    • [string]optional

      except_fields

      Prevent the sink from encoding the specified labels.

      • No default
      • View examples
    • [string]optional

      only_fields

      Limit the sink to only encoding the specified labels.

      • No default
      • View examples
    • stringenumoptional

      timestamp_format

      How to format event timestamps.

      • Default: "rfc3339"
      • Enum, must be one of: "rfc3339" "unix"
      • View examples
  • boolcommonoptional

    healthcheck

    Enables/disables the sink healthcheck upon start.

    • Default: true
    • View examples
  • intoptional

    idle_timeout_secs

    The amount of time a file can be idle and stay open. After not receiving any events for this timeout, the file will be flushed and closed.

    • Default: "30"
    • View examples
  • templateablestringcommonrequired

    path

    File name to write events to.

    See Template Syntax for more info.

    • No default
    • View examples

How It Works

Dynamic File And Directory Creation

Vector will attempt to create the entire directory structure and the file when emitting events to the file sink. This requires that the Vector agent have the correct permissions to create and write to files in the specified directories.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Streaming

The file sink streams data on a real-time event-by-event basis. It does not batch data.

Template Syntax

The path options support Vector's template syntax, enabling dynamic values derived from the event's data. This syntax accepts strptime specifiers as well as the {{ field_name }} syntax for accessing event fields. For example:

vector.toml
[sinks.my_file_sink_id]
# ...
path = "vector-%Y-%m-%d.log"
path = "application-{{ application_id }}-%Y-%m-%d.log"
# ...

You can learn more about the complete syntax in the templating reference.