Vector

Vector can collect logs from files, Kubernetes, journald, syslog, and several other sources, then transform those events before sending them onward. Use the HTTP sink when Parseable is the destination for that pipeline.

Prerequisites

You need Vector installed, a Parseable ingest endpoint, an API key, and a dataset name. The example below writes Kubernetes logs to vector-logs.

Configure Vector

Create or update vector.toml with a source and an HTTP sink for Parseable.

[sources.kubernetes_logs]
type = "kubernetes_logs"

[transforms.add_parseable_fields]
type = "remap"
inputs = ["kubernetes_logs"]
source = '''
.source_agent = "vector"
.cluster = "production"
'''

[sinks.parseable]
type = "http"
inputs = ["add_parseable_fields"]
uri = "http://<parseable-ingestor-endpoint>:8000/api/v1/ingest"
method = "post"
compression = "gzip"

[sinks.parseable.encoding]
codec = "json"

[sinks.parseable.request.headers]
Content-Type = "application/json"
X-API-Key = "<parseable-api-key>"
X-P-Stream = "vector-logs"

If you are reading from a different source, keep the same sink and change only the source and transform blocks. For example, file logs can use sources.file, while host logs may come from journald or syslog.

Verify Logs

Start Vector and check its internal logs for HTTP response codes from Parseable. Then open vector-logs in Parseable and confirm that events include the fields you expect from Vector and your transform.

If ingestion fails, check that the API key can write to the dataset, the ingest endpoint is reachable from the Vector host, and the sink is sending JSON records rather than plain text.