2020-12-23-internal-logs-source.md

date	title	description	authors	pr_numbers	release	hide_on_release_notes	badges
2020-12-23	The `internal_logs` source	A new source for observing Vector itself	lucperkins		0.12.0	false	type sources new feature internal_logs

Vector has a new internal_logs source that you can use to process log events produced by Vector itself. Here's an example Vector log message:

{
  "*": null,
  "message": "Vector has started.",
  "metadata": {
    "kind": "event",
    "level": "TRACE",
    "module_path": "vector::internal_events::heartbeat",
    "target": "vector"
  },
  "timestamp": "2020-10-10T17:07:36+00:00"
}

internal_logs is a helpful accompaniment to the internal_metrics source, which exports Vector's own metrics and modify and ship them however you wish.

Example usage

Here's an example Vector configuration that ships Vector's logs to Splunk and allows its internal metrics to be scraped by Prometheus:

[sources.vector_logs]
type = "internal_logs"

[sources.vector_metrics]
type = "internal_metrics"

[sinks.splunk]
type = "splunk_hec"
inputs = ["vector_logs"]
endpoint = "https://my-account.splunkcloud.com"
token = "${SPLUNK_HEC_TOKEN}"
encoding.codec = "json"

[sinks.prometheus]
type = "prometheus"
inputs = ["vector_metrics"]
address = "0.0.0.0:9090"