LOG

Socket Source

The Vector socket source ingests data through a socket, such as a TCP, UDP, or Unix socket and outputs log events.

Configuration

  • Common
  • Advanced
vector.toml
[sources.my_source_id]
  # REQUIRED - General
  type = "socket" # must be: "socket"
  address = "0.0.0.0:9000" # example, relevant when mode = "tcp" or mode = "udp"
  mode = "tcp" # example, enum
  path = "/path/to/socket" # example, relevant when mode = "unix"


  # OPTIONAL - General
  shutdown_timeout_secs = 30 # default, seconds, relevant when mode = "tcp"


  # OPTIONAL - Context
  host_key = "host" # default

Options

6 items
stringcommonrequired

address

The address to listen for connections on, or systemd#N to use the Nth socket passed by systemd socket activation. If an address is used it must include a port.

No default
Only relevant when: mode = ["tcp","udp"]
View examples
stringcommonrequired

host_key

The key name added to each event representing the current host. This can also be globally set via the global [host_key](#host_key) option. See Context for more info.

Default: "host"
View examples
int (bytes)optional

max_length

The maximum bytes size of incoming messages before they are discarded.

Default: 102400 (bytes)
View examples
stringenumcommonrequired

mode

The type of socket to use.

No default
Enum, must be one of: "tcp" "udp" "unix"
View examples
stringcommonrequired

path

The unix socket path. This should be absolute path.

No default
Only relevant when: mode = "unix"
View examples
int (seconds)commonrequired

shutdown_timeout_secs

The timeout before a connection is forcefully closed during shutdown.

Default: 30 (seconds)
Only relevant when: mode = "tcp"
View examples

Output

The socket source ingests data through a socket, such as a TCP, UDP, or Unix socket and outputs log events. For example:

Given the following input line:

2019-02-13T19:48:34+00:00 [info] Started GET "/" for 127.0.0.1

A log event will be output with the following structure:

{
  "timestamp": <current_timestamp>,
  "message": "2019-02-13T19:48:34+00:00 [info] Started GET "/" for 127.0.0.1",
  "host": "<upstream_hostname>"
}

More detail on the output schema is below.

3 items
stringcommonrequired

host

The upstream hostname.

No default
View examples
stringcommonrequired

message

The raw message, unaltered.

No default
View examples
timestampcommonrequired

timestamp

The exact time the event was ingested.

No default
View examples

How It Works

Context

By default, the socket source will add context keys to your events via the host_key options.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Support
Contents
Resources