The Vector team is pleased to announce version 0.43.0!
This release contains a few notable new features along with the numerous enhancements and fixes as listed below:
opentelemetry
sink with initial support for emitting logs via OTLP over HTTP. We expect this to expand to support gRPC and emission of other data types.exclusive_route
transform to route events exclusively using an ordered set of conditionscef
encoder to emit events encoded as in Common Event Formatchunked_gelf
framing decoder to receive chunked GELF messagesfile
, which loads secrets from a JSON file, and directory
, which loads secrets from a tree of files.There are no breaking changes or deprecations with this release and so no upgrade guide.
vector-0.43.0-x86_64-apple-darwin.tar.gz
executable has the wrong architecture, see
#22129. This will be fixed in
v0.44
.VRL was updated to v0.20.0. This includes the following changes:
to_float
function to return an error instead of f64::INFINITY
when parsing non-normal numbers. (https://github.com/vectordotdev/vrl/pull/1107)decrypt
and encrypt
VRL functions now support aes-siv (RFC 5297) encryption and decryption. (https://github.com/vectordotdev/vrl/pull/1100)decode_punycode
and encode_punycode
with the validate
flag set to false should be faster now, in cases when input data needs no encoding or decoding. (https://github.com/vectordotdev/vrl/pull/1104)
Otherwise, it will return None
. (https://github.com/vectordotdev/vrl/pull/1117)encode_proto
function was enhanced to automatically convert valid string fields to numeric proto
fields. (https://github.com/vectordotdev/vrl/pull/1114)parse_groks
VRL function and Datadog grok parsing now catch the panic coming from rust-onig
on too many regex match retries and handle it as a custom error. (https://github.com/vectordotdev/vrl/pull/1079)encode_punycode
with the validate
flag set to false should be more consistent with when validate
is set to true, turning all uppercase character to lowercase as well as doing punycode encoding (https://github.com/vectordotdev/vrl/pull/1115)set_semantic_meaning
. (https://github.com/vectordotdev/vrl/pull/1148)opensearch_service_type = "serverless"
option.Allows for chunked GELF decoding in message-based sources, such as UDP sockets or unix datagram sockets. Implementation is based on Graylog’s documentation. The implementation also supports payload decompression.
This framing method can be configured via the framing.method = "chunked_gelf"
option in the source configuration.
remap
transform via the files
option.
This allows users to break down Vector remaps into smaller, more manageable units of configuration, improving organization, reusability, and maintainability of VRL code.opentelemetry
source can now be configured to enrich log events with HTTP headers received in the OTLP/HTTP request.exclusive_route
transform, which functions as a switch statement to route events based on user-defined conditions. See the release highlight for more details on how to use this new transform.The elasticsearch
sink now supports publishing events as bulk “update"s by configuring bulk.action
to update
.
While using this mode has a couple of constraints:
.doc
and have .doc_as_upsert
to true.id_key
must be set, and the encoding
field should specify doc
and doc_as_upsert
as valueshost_metrics
now supports process metrics collection, configurable via the process
option.cef
encoder (widely used in SIEM systems).sample
transform can now take in a group_by
configuration option that allows logs with unique values for the patterns passed in to be sampled independently. This can reduce the complexity of the topology, since users no longer need to create separate samplers with similar configurations to handle different log streams.Expose connection_retry_options
in the Pulsar sink configuration to allow customizing the connection retry behaviour of the pulsar client. This includes the following options:
min_backoff_ms
: Minimum delay between connection retries.max_backoff_secs
: Maximum delay between reconnection retries.max_retries
: Maximum number of connection retries.connection_timeout_secs
: Time limit to establish a connection.keep_alive_secs
: Keep-alive interval for each broker connection.http
sink now retries requests when the response is a request timeout (HTTP 408).dnstap
source now supports decoding of EDE code 30 (Invalid Query Type) (added in Compact Denial of Existence in DNSSEC) and has the correct purpose
attached to it.VECTOR_HOSTNAME
env variable to override the hostname used in the Vector events and internal metrics.
This is useful when Vector is running on a system where the hostname is not meaningful, such as in a container (Kubernetes).zstd
format is enabled by default.file
, for reading a set of
secrets from a JSON file, and directory
, for loading secrets from a list of files.gcp_chronicle_unstructured
sink. See the documentation.sample
transform now has a sample_rate_key
configuration option, which default to sample_rate
. It allows configuring which key is used to attach the sample rate to sampled events. If set to an empty string, the sample rate will not be attached to sampled events.--watch-config-method
to poll
where the interval can be configured via --watch-config-poll-interval-seconds
.exec
and http_server
sources no longer attach a redundant timestamp
field
when log namespacing is enabled.gcp_pubsub
sink now supports emitting metrics and traces.gelf
codec now correctly deserializes the subsecond portion of timestamps rather than dropping
them.expire_metrics_secs
configuration option now defaults to 300s
rather than being
disabled. To preserve the old behavior, set to a negative value to disable expiration.Sign up to receive emails on the latest Vector content and new releases
Thank you for joining our Updates Newsletter