Vector v0.56.0 release notes

HTTP-based sinks that use the shared retry helpers now support a retry_strategy configuration option to control which HTTP response codes are retried. The http sink also includes a new example showing how to retry only specific transient status codes.

Issue: https://github.com/vectordotdev/vector/issues/10870

HTTP-based sinks using the shared retry logic now classify transport-layer failures with HttpError::is_retriable: connection and TLS connector issues may be retried, while failures such as invalid HTTP request construction or an invalid proxy URI are not. Setting retry_strategy to none disables retries for these transport errors and for request timeouts, in addition to status-code-based retries.

Issue: https://github.com/vectordotdev/vector/issues/10870

The vector sink now supports zstd compression in addition to gzip. This provides better compression ratios and performance for Vector-to-Vector communication.

The compression configuration has been enhanced to support multiple algorithms while maintaining full backward compatibility:

Legacy boolean syntax (still supported)

sinks:
  my_vector:
    type: vector
    address: "localhost:6000"
    compression: true   # Uses gzip (default)
    # or
    compression: false  # No compression

New string syntax

sinks:
  my_vector:
    type: vector
    address: "localhost:6000"
    compression: "zstd"  # Use zstd compression
    # Supported values: "none", "gzip", "zstd"

The Vector source automatically accepts both gzip and zstd compressed data, enabling seamless communication between Vector instances using different compression algorithms.

The splunk_hec source now accepts optional per-endpoint codec configuration via event: { framing, decoding } and raw: { framing, decoding }. When decoding is set on an endpoint, Vector applies a second decoding pass after the HEC envelope is parsed: on /services/collector/event the envelope’s event field is fed through the codec, and on /services/collector/raw the request body is fed through the codec directly. A single payload can fan out to multiple events.

For example, to decode JSON payloads in /event requests while splitting /raw bodies on newlines:

sources:
  hec:
    type: splunk_hec
    address: 0.0.0.0:8088
    event:
      decoding:
        codec: json
    raw:
      framing:
        method: newline_delimited
      decoding:
        codec: bytes

The tag_cardinality_limit transform gained two new configuration capabilities:

• Per-tag overrides (per_tag_limits): configure cardinality limits per tag key within a metric, or exclude individual tags from tracking.
• Metric exclusion: opt entire metrics out of cardinality tracking via mode: excluded in per_metric_limits.

The tag_cardinality_limit transform gained two new settings:

• tracking_scope: isolate tag tracking per metric (per_metric) instead of sharing a single bucket across all metrics (global, the default).
• max_tracked_keys: cap the total number of tag keys tracked to bound memory usage.

The default /etc/vector/vector.yaml config file is no longer installed by the Debian, RPM, Alpine, and distroless-static Docker packages. The previous default ran a demo_logs source and printed synthesized syslog lines to stdout, which then surfaced in journald or /var/log/ on hosts running Vector as a service and was a common source of confusion.

New installs will now have no active config on disk. Provide your own configuration at /etc/vector/vector.yaml (or pass --config <path>) before starting Vector. A reference example is shipped at /usr/share/vector/examples/vector.yaml, and more sample configs remain at /etc/vector/examples/.

Existing installs are unaffected on upgrade: package managers preserve the on-disk /etc/vector/vector.yaml if you already had one.

Fixed a CPU regression introduced in 0.50.0 affecting all sinks that use metric normalization such as prometheus_remote_write, aws_cloudwatch_metrics, statsd, and others.

The only exception is the incremental_to_absolute transform when max_bytes or max_events are configured, where the overhead is expected and necessary for eviction to work correctly.

The aggregate transform now correctly passes through or ignores metrics whose kind is not supported by the configured mode. Prior to this change, these metrics would be silently dropped, contrary to the officially documented behavior. For example, absolute metrics flowing through a sum-mode aggregate transform are now forwarded to the next step in the pipeline unchanged rather than being dropped:

{kind: incremental, type: counter, name: "http.requests", value: 10}  → summed into aggregate
{kind: absolute,    type: gauge,   name: "cpu.usage",     value: 0.83} → previously dropped, now passes through unchanged
{kind: incremental, type: counter, name: "http.requests", value: 5}   → summed into aggregate

If you want to preserve the previous drop behavior, add a filter transform before the aggregate transform to discard the unwanted metric kind.

Fixed a bug in the topology builder causing component metrics registered at build time to miss the component tags if the component build function awaits non-trivially.

This notably affected sinks using a disk buffer, and sources or sinks performing IO work in the build function.

TCP-based sources that emit acknowledgements (fluent, logstash) no longer log a spurious Error writing acknowledgement, dropping connection. at ERROR level when the ack write fails because the peer cleanly closed its TLS session (for example, during a rolling pod restart). These graceful shutdowns now log at WARN and no longer increment component_errors_total{error_code="ack_failed", ...}, preventing operator dashboards/alerts from firing on routine peer disconnects. Genuine ack write failures are still logged at ERROR and continue to increment component_errors_total.

The connection_shutdown_total{mode="tcp"} counter is now incremented exactly once per accepted source connection when its per-connection task exits, pairing with ConnectionOpen — regardless of cause (TLS handshake failure, shutdown signal during handshake, graceful peer EOF, decoder failure, downstream closed, ack write failure, tripwire, max connection duration). Previously it was not emitted by TCP sources at all.