Vector v0.38.0 release notes

Upgrading Vector
When upgrading, we recommend stepping through minor versions as these can each contain breaking changes while Vector is pre-1.0. These breaking changes are noted in their respective upgrade guides.

The Vector team is pleased to announce version 0.38.0!

Be sure to check out the upgrade guide for breaking changes in this release.

This release just contains a mix of small enhancements and bug fixes. See the changelog below.

Vector Changelog

4 new features

  • Support was added for additional config options for length_delimited framing.
    Thanks to esensar, Quad9DNS for contributing this change!
  • The clickhouse sink now has a new configuration option, insert_random_shard, to tell Clickhouse to insert into a random shard (by setting insert_distributed_one_random_shard). See the Clickhouse Distributed Table Engine docs for details.
    Thanks to rguleryuz for contributing this change!
  • The Elasticsearch sink is now able to use external versioning for documents. To use it set bulk.version_type to external and then set bulk.version to either some static value like 123 or use templating to use an actual field from the document {{ my_document_field }}.
    Thanks to radimsuckr for contributing this change!
  • Support was added for loading secrets from AWS Secrets Manager (AWS SSM).

8 enhancements

  • The Google Chronicle Unstructured Log sink now supports adding a namespace to the log events for indexing within Chronicle.
    Thanks to ChocPanda for contributing this change!

  • A new histogram metric was added, component_received_bytes, that measures the byte-size of individual events received by the following sources:

    • socket
    • statsd
    • syslog
    Thanks to pabloem for contributing this change!
  • A new option, max_number_of_messages, was added to the SQS configuration of the aws_s3 source.
    Thanks to fdamstra for contributing this change!
  • Support was added for expiration_ms on the amqp sink, to set an expiration on messages sent.
    Thanks to sonnens for contributing this change!
  • The previous inner databend client was changed to client provided by databend rust driver in https://github.com/datafuselabs/bendsql/. With the new client, the endpoint config supports both HTTP URI like http://localhost:8000 as well as DSN like databend://root:@localhost:8000/mydatabase?sslmode=disable&arg=value which could provide more customization for the inner client.
    Thanks to everpcpc for contributing this change!
  • The distroless images have changed their base from Debian 11 to Debian 12.
  • The Google Chronicle Unstructured Log sink now supports adding labels to the log events for indexing within Chronicle.
    Thanks to bwerthmann for contributing this change!
  • A new config field missing_field_as was added to the databend sink to specify the behavior when fields are missing. Previously the behavior was the same as setting this new configuration option to ERROR. The new default value is NULL.
    Thanks to everpcpc for contributing this change!

7 bug fixes

  • The kafka source again emits received bytes and event counts correctly.
    Thanks to jches for contributing this change!
  • An issue was fixed where the log_to_metric transform with all_metrics set to true failed to convert properly-formatted ‘set’-type events into metrics.
    Thanks to pabloem for contributing this change!
  • Vector would panic when attempting to use a combination af access_key_id and assume_role authentication with the AWS components. This error has now been fixed.
    Thanks to StephenWakely for contributing this change!
  • A message semantic meaning was added to the Splunk HEC source. This only applies to the Vector log namespace.
  • The datadog_logs sink was not re-constructing ddtags that may have been parsed upstream by the datadog_agent source’s parse_ddtags setting. The sink log encoding was fixed to re-assemble the tags into a unified string that the Datadog logs intake expects.
  • The prometheus_exporter sink is now able to correctly handle a mix of both incremental and absolute valued gauges arriving for the same metric series.
    Thanks to RussellRollins for contributing this change!

  • Previously, when the auto_extract_timestamp setting in the splunk_hec_logs Sink was enabled, the sink was attempting to remove the existing event timestamp. This would throw a warning that the timestamp type was invalid.

    This has been fixed to leave the timestamp on the event if auto_extract_timestamp is enabled, since this setting indicates that Vector should let Splunk remove it.

4 chore

  • The protobuf decoder will no longer set fields on the decoded event that are not set in the incoming byte stream. Previously, it would set the default value for the field even if it wasn’t in the event. This change ensures that the encoder will return the exact same bytes for the same given event.
  • Previously the datadog_agent setting parse_ddtags parsed the tag string into an Object. It is now parsed into an Array of key:value strings, which matches the behavior of the Datadog logs backend intake.
  • The deprecated --strict-env-vars flag has been removed. The previous behavior of defaulting unset environment variables can be accomplished by syntax like ${FOO-} (which will default FOO to empty string if unset). See the configuration environment variables docs for more about this syntax.
  • The enterprise global configuration has been deprecated and will be removed in a future version. This corresponds to a deprecation for “Vector Enterprise” by the Datadog Observability Pipelines product.

Download Version 0.38.0

Linux
tar.gz
ARM64 ARMv7 x86_64
Linux (deb)
deb
ARM64 ARMv7 x86_64
Linux (rpm)
rpm
ARM64 ARMv7 x86_64
macOS
tar.gz
x86_64
Windows
zip
x86_64
Windows (MSI)
msi
x86_64