Logfmt Parser Transform

The Vector logfmt_parser transform accepts and outputs log events allowing you to extract data from a logfmt-formatted log field.

Configuration

vector.toml
[transforms.my_transform_id]
# General
type = "logfmt_parser" # required
inputs = ["my-source-id"] # required
drop_field = true # optional, default
field = "message" # optional, default
# Types
types.status = "int" # example
types.duration = "float" # example
types.success = "bool" # example
types.timestamp = "timestamp|%F" # example
types.timestamp = "timestamp|%a %b %e %T %Y" # example
types.parent.child = "int" # example
3 items
boolcommonoptional

drop_field

If the specified field should be dropped (removed) after parsing.

Default: true
View examples
stringcommonoptional

field

The log field to parse.

See Field Notation Syntax for more info.

Default: "message"
View examples
tablecommonoptional

types

Key/value pairs representing mapped log field names and types. This is used to coerce log fields into their proper types.

stringenumcommonoptional

[field-name]

A definition of log field type conversions. They key is the log field name and the value is the type. strptime specifiers are supported for the timestamp type.

No default
Enum, must be one of: "bool" "float" "int" "string" "timestamp"
View examples

How It Works

Complex Processing

If you encounter limitations with the logfmt_parser transform then we recommend using a runtime transform. These transforms are designed for complex processing and give you the power of full programming runtime.

Environment Variables

Environment variables are supported through all of Vector's configuration. Simply add ${MY_ENV_VAR} in your Vector configuration file and the variable will be replaced before being evaluated.

You can learn more in the Environment Variables section.

Field Notation Syntax

The field options support Vector's field notiation syntax, enabling access to root-level, nested, and array field values. For example:

vector.toml
[transforms.my_logfmt_parser_transform_id]
# ...
field = "message"
field = "parent.child"
field = "array[0]"
# ...

You can learn more about Vector's field notation in the field notation reference.