Vector v0.54.0 release notes

Upgrading Vector
When upgrading, we recommend stepping through minor versions as these can each contain breaking changes while Vector is pre-1.0. These breaking changes are noted in their respective upgrade guides.

The Vector team is excited to announce version 0.54.0!

Release highlights

  • Enhanced vector top with new keybinds for scrolling, sorting, and filtering. Press ? to see all available keybinds.
  • The datadog_logs sink now defaults to zstd compression instead of no compression, resulting in better network efficiency and higher throughput.
  • Added component_latency_seconds histogram and component_latency_mean_seconds gauge internal metrics, exposing the time an event spends in a component.
  • Syslog encoding transform received major upgrades with improved RFC compliance, support for scalars/nested objects/arrays in structured data, and better UTF-8 safety.
  • Added a new azure_logs_ingestion sink that supports the Azure Monitor Logs Ingestion API. The existing azure_monitor_logs sink is now deprecated, and users should migrate before Microsoft ends support for the old Data Collector API (currently scheduled for September 2026).

Breaking Changes

  • The datadog_logs sink now defaults to zstd compression. You can explicitly set compression to preserve previous behavior.

Deprecation Announcements

See the deprecations page for all active and historical deprecations.

azure_monitor_logs sink

The azure_monitor_logs sink is deprecated in favor of the new azure_logs_ingestion sink, which uses the Azure Monitor Logs Ingestion API.

Users should migrate before Microsoft ends support for the old Data Collector API (scheduled for September 2026).

Vector Changelog

4 new features

  • Add support for the Azure Monitor Logs Ingestion API through a new azure_logs_ingestion sink.

    The azure_monitor_logs sink is now deprecated, and current users will need to migrate to azure_logs_ingestion before Microsoft end support for the old Data Collector API (currently scheduled for September 2026).


    Thanks to jlaundry for contributing this change!
  • Added new keybinds to vector top for scrolling, sorting and filtering. You can now press ? when using vector top to see all available keybinds.
    Thanks to esensar, Quad9DNS for contributing this change!
  • Added inode metrics to the host_metrics source filesystem collector on unix systems. The filesystem_inodes_total, filesystem_inodes_free, filesystem_inodes_used, and filesystem_inodes_used_ratio metrics are now available.
    Thanks to mushrowan for contributing this change!
  • The azure_blob sink now supports routing requests through HTTP/HTTPS proxies, enabling uploads from restricted networks that require an outbound proxy.
    Thanks to joshuacoughlan for contributing this change!

10 enhancements

  • The clickhouse sink now supports complex data types (Array, Map, and Tuple) when using the arrow_stream format.
    Thanks to benjamin-awd for contributing this change!
  • The prometheus_remote_write sink now supports the healthcheck.uri field to customize the healthcheck endpoint.
    Thanks to simonhammes for contributing this change!

  • Upgrades the syslog encoding transform with three major improvements:

    Structured Data Enhancements (RFC 5424):

    • Supports scalars
    • Handles nested objects (flattened with dot notation)
    • Serializes arrays as JSON strings, e.g., tags="["tag1","tag2","tag3"]" (RFC 5424 spec doesn’t define how to handle arrays in structured data)
    • Validates SD-ID and PARAM-NAME fields per RFC 5424
    • Sanitizes invalid characters to underscores

    UTF-8 Safety Fix:

    • Fixes panics from byte-based truncation on multibyte characters
    • Implements character-based truncation for all fields
    • Prevents crashes with emojis, Cyrillic text, etc.

    RFC 3164 Compliance Improvements:

    • Bug fix: Structured data is now properly ignored (previously incorrectly prepended)
    • TAG field sanitized to ASCII printable characters (33-126)
    • Adds debug logging when structured data is ignored

    Thanks to vparfonov for contributing this change!
  • The arrow_stream codec now uses arrow-json instead of serde_arrow for Arrow encoding.
    Thanks to benjamin-awd for contributing this change!
  • Added the component_latency_seconds histogram and component_latency_mean_seconds gauge internal metrics, exposing the time an event spends in a single transform including the transform buffer.
    Thanks to bruceg for contributing this change!
  • The datadog_logs sink now defaults to zstd compression instead of no compression. This results in better network efficiency and higher throughput. You can explicitly set compression = "none" to restore the previous behavior of no compression, or set compression = "gzip" if you were previously using gzip compression explicitly.
    Thanks to jszwedko, pront for contributing this change!
  • Add content_encoding and cache_control options to the gcp_cloud_storage sink. content_encoding overrides the Content-Encoding header (defaults to the compression scheme’s content encoding). cache_control sets the Cache-Control header for created objects.
    Thanks to benjamin-awd for contributing this change!
  • Small optimization to the websocket source performance by avoiding getting a new time for every event in an array.
    Thanks to bruceg for contributing this change!
  • The prometheus_remote_write sink now supports custom HTTP headers via the request.headers configuration option. This allows users to add custom headers to outgoing requests, which is useful for authentication, routing, or other integration requirements with Prometheus-compatible backends.
    Thanks to elohmeier for contributing this change!
  • Added internal_metrics configuration section to the tag_cardinality_limit transform to better organize internal metrics configuration. The internal_metrics.include_extended_tags option controls whether to include extended tags (metric_name, tag_key) in the tag_value_limit_exceeded_total metric to help identify which specific metrics and tag keys are hitting the configured value limit. This option defaults to false because these tags have potentially unbounded cardinality.
    Thanks to kaarolch for contributing this change!

8 bug fixes

  • Fixed a hard-to-trigger race between closing a memory buffer and outstanding sends that could rarely cause a lost event array at shutdown.
    Thanks to bruceg for contributing this change!
  • Remove the tokio-util patch override and preserve recoverable decoding behavior via DecoderFramedRead.
    Thanks to Trighap52 for contributing this change!
  • The log_to_metric transform now correctly handles aggregated histogram and aggregated summary metrics.
    Thanks to jblazquez for contributing this change!
  • Fixed recording of buffer utilization metrics to properly record on both send and receive in order to reflect the actual level and not just the “full” level.
    Thanks to bruceg for contributing this change!
  • The ClickHouse sink’s ArrowStream format now correctly handles MATERIALIZED, ALIAS, EPHEMERAL, and DEFAULT columns. MATERIALIZED, ALIAS, and EPHEMERAL columns are excluded from the fetched schema since they cannot receive INSERT data. DEFAULT columns are kept but marked nullable so events are not rejected when the server-computed value is omitted.
    Thanks to benjamin-awd for contributing this change!
  • Fixed an issue where directory secret backends failed to resolve secrets organized in subdirectories (e.g., Kubernetes mounted secrets at paths like: /secrets/my-secrets/username)
    Thanks to pront, vparfonov for contributing this change!
  • Fixed vector test printing literal \x1b escape codes instead of rendering ANSI colors when reporting VRL compilation errors.
    Thanks to thomasqueirozb for contributing this change!
  • The opentelemetry source now correctly uses Definition::any() for logs output schema when use_otlp_decoding is enabled. Users can now enable schema validation for this source.
    Thanks to pront for contributing this change!

2 chore

  • Removed the misleadingly-named default-no-vrl-cli feature flag, which did not control VRL CLI compilation. This flag was equivalent to default without api-client and enrichment-tables. Use default-no-api-client as a replacement (note: this includes enrichment-tables) or define custom features as needed.
    Thanks to thomasqueirozb for contributing this change!

  • The *buffer_utilization_mean metrics have been enhanced to use time-weighted averaging which make them more representative of the actual buffer utilization over time.

    This change is breaking due to the replacement of the existing buffer_utilization_ewma_alpha config option with buffer_utilization_ewma_half_life_seconds.


    Thanks to bruceg for contributing this change!

VRL Changelog

[0.31.0 (2026-03-05)]

New Features

  • Added a new parse_yaml function. This function parses yaml according to the YAML 1.1 spec.

authors: juchem (https://github.com/vectordotdev/vrl/pull/1602)

  • Added --quiet / -q flag to the CLI to suppress the banner text when starting the REPL.

authors: thomasqueirozb (https://github.com/vectordotdev/vrl/pull/1617)

Fixes

  • Fixed a bug where lexer parse errors would emit a generic span with 202 error code instead of the proper error. Also fixed error positions from nested lexers (e.g., string literals inside function arguments) to correctly point to the actual location in the source.

Before (generic E202 syntax error):

$ string("")

error[E202]: syntax error
┌─ :1:1
│
1 │ string("")
│ ^^^^^^^^^^^^ unexpected error: invalid escape character: 
│
= see language documentation at https://vrl.dev
= try your code in the VRL REPL, learn more at https://vrl.dev/examples

After (correct E209 invalid escape character):

$ string("")

error[E209]: invalid escape character: 
┌─ :1:10
│
1 │ string("")
│          ^ invalid escape character: a
│
= see language documentation at https://vrl.dev
= try your code in the VRL REPL, learn more at https://vrl.dev/examples

authors: thomasqueirozb (https://github.com/vectordotdev/vrl/pull/1579)

  • Fixed a bug where parse_duration panicked when large values overflowed during multiplication. The function now returns an error instead.

authors: thomasqueirozb (https://github.com/vectordotdev/vrl/pull/1618)

  • Corrected the type definition of the basename function to indicate that it can also return null. Previously the type definition indicated that the function could only return bytes (or strings).

authors: thomasqueirozb (https://github.com/vectordotdev/vrl/pull/1635)

  • Fixed incorrect parameter types in several stdlib functions:

  • md5: value parameter was typed as any, now correctly typed as bytes.

  • seahash: value parameter was typed as any, now correctly typed as bytes.

  • floor: value parameter was typed as any, now correctly typed as float | integer; precision parameter was typed as any, now correctly typed as integer.

  • parse_key_value: key_value_delimiter and field_delimiter parameters were typed as any, now correctly typed as bytes.

Note: the function documentation already reflected the correct types.

authors: thomasqueirozb (https://github.com/vectordotdev/vrl/pull/1650)

[0.30.0 (2026-01-22)]

Download Version 0.54.0

Linux
tar.gz
ARM64 ARMv7 x86_64
Linux (deb)
deb
ARM64 ARMv7 x86_64
Linux (rpm)
rpm
ARM64 ARMv7 x86_64
macOS
tar.gz
ARM64
Windows
zip
x86_64
Windows (MSI)
msi
x86_64
browse all files...