Socket Source

The Vector socket source ingests data through a socket, such as a TCP, UDP, or UDS socket and outputs log events.

Requirements

• This component exposes a configured port. You must ensure your network allows access to this port.

Configuration

• tcp
• tcp (adv)
• udp
• udp (adv)
• unix
• unix (adv)

vector.toml

[sources.my_source_id]
  type = "socket" # required
  address = "0.0.0.0:9000" # required, required when mode = "tcp" or mode = "udp"
  max_length = 102400 # optional, default, bytes, relevant when mode = "tcp" or mode = "unix"
  mode = "tcp" # required

7 items

tcp udp unixcommonrequired

• stringcommonrequired*

  address

  The address to listen for connections on, or systemd#N to use the Nth socket passed by systemd socket activation. If an address is used it must include a port.

  • Only required when: mode = ["tcp","udp"]
  • No default
  • View examples
• stringoptional

  host_key

  The key name added to each event representing the current host. This can also be globally set via the global [host_key](#host_key) option. See Context for more info.

  • Default: "host"
• uint (bytes)commonoptional

  max_length

  The maximum bytes size of incoming messages before they are discarded.

  • Only relevant when: mode = ["tcp","unix"]
  • Default: 102400 (bytes)
• stringenumcommonrequired

  mode

  The type of socket to use.

  • No default
  • Enum, must be one of: "tcp" "udp" "unix"
  • View examples
• stringcommonrequired*

  path

  The unix socket path. This should be absolute path.

  • Only required when: mode = "unix"
  • No default
  • View examples
• uint (seconds)optional

  shutdown_timeout_secs

  The timeout before a connection is forcefully closed during shutdown.

  • Only relevant when: mode = "tcp"
  • Default: 30 (seconds)
• tableoptional

  tls

  Configures the TLS options for connections from this source.

  • stringoptional

    ca_file

    Absolute path to an additional CA certificate file, in DER or PEM format (X.509), or an inline CA certificate in PEM format.

    • Only relevant when: mode = "tcp"
    • No default
    • View examples
  • stringcommonoptional

    crt_file

    Absolute path to a certificate file used to identify this server, in DER or PEM format (X.509) or PKCS#12, or an inline certificate in PEM format. If this is set and is not a PKCS#12 archive, key_file must also be set. This is required if enabled is set to true.

    • Only relevant when: mode = "tcp"
    • No default
    • View examples
  • boolcommonoptional

    enabled

    Require TLS for incoming connections. If this is set, an identity certificate is also required.

    • Only relevant when: mode = "tcp"
    • Default: false
    • View examples
  • stringcommonoptional

    key_file

    Absolute path to a private key file used to identify this server, in DER or PEM format (PKCS#8), or an inline private key in PEM format.

    • Only relevant when: mode = "tcp"
    • No default
    • View examples
  • stringcommonoptional

    key_pass

    Pass phrase used to unlock the encrypted key file. This has no effect unless key_file is set.

    • Only relevant when: mode = "tcp"
    • No default
    • View examples
  • booloptional

    verify_certificate

    If true, Vector will require a TLS certificate from the connecting host and terminate the connection if it is not valid. If false (the default), Vector will not request a certificate from the client.

    • WARNING: Setting this to `false` will cause OpenSSL to not request a certificate from the client
    • Only relevant when: mode = "tcp"
    • Default: false
    • View examples

Fields

example log event

{
  // ...
  "host": "my.host.com",
  "message": "Started GET / for 127.0.0.1 at 2012-03-10 14:28:14 +0100",
  "timestamp": "2019-11-01T21:15:47+00:00"
  // ...
}

3 items

commonrequired

• stringcommonrequired

  host

  The upstream hostname.

  • No default
  • View examples
• stringcommonrequired

  message

  The raw message, unaltered.

  • No default
  • View examples
• timestampcommonrequired

  timestamp

  The exact time the event was ingested.

  • No default
  • View examples

Examples

Given the following input line:

Example input

2019-02-13T19:48:34+00:00 [info] Started GET "/" for 127.0.0.1

A log event will be output with the following structure:

Example log event

{
  "timestamp": <current_timestamp>,
  "message": "2019-02-13T19:48:34+00:00 [info] Started GET "/" for 127.0.0.1",
  "host": "<upstream_hostname>"
}

How It Works

Context

By default, the socket source will add context keys to your events via the host_key options.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

TLS

Vector uses Openssl for TLS protocols for it's battle-tested and reliable security. You can enable and adjust TLS behavior via the tls.* options.