Introducing Vector’s Global Log Schema

Set defaults for Vector’s common log key names

Page source Edit this page

Vector does not require a rigid schema for it’s log events. You are welcome to use any field names you like, such as the timestamp, message, and host. Until recently, the default names of these fields were not easily customizable. You either had to set these names within the source itself, or rename these fields using the rename_fields transform. While this works, it’s cumbersome and is not obvious to anyone reading your Vector configuration file. Enter Vector’s new global log schema. These new options allow you to change the default names for the message_key, host_key, timestamp_key, and more:

[log_schema]
  host_key = "host" # default
  message_key = "message" # default
  timestamp_key = "timestamp" # default

Why is this useful?

  1. Many Vector users already have a schema in-place and this makes it easy for Vector to adopt that schema.
  2. Components often times need to coordinate. For example, the host_key is used in a variety of sinks to ensure that Vector’s internal “host” field is mapped to the downstream service’s “host” field.