moving from logstash to vector

[agorkiy]

Hi
I'm want to move from logstash to vector and now trying to transform existing logstash config into vector one.
Here is lsome part of it:
input {
udp {
port => 5042
type => "rsyslog"
tags => ["container"]
}
}

filter {
mutate {
remove_field => ["host"]
add_field => {"host" => "localhost"}
}
if "container" in [tags] {
grok {
match => { "message" => "(?!\<%{NONNEGINT}\>)%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{USERNAME:container}/%{WORD:hash}\[%{NONNEGINT:syslog_version}]:%{SPACE}%{GREEDYDATA:parsed_message}" }
}
if ![container] {
mutate {
add_field => {"container" => "unknown"}
}
}
if "_grokparsefailure" not in [tags] { mutate { remove_field => ["message"] } mutate { rename => ["parsed_message", "message"] } } if "traefik" in [container] { json { source => "message" } json { source => "Request" }..... if [ClientHost] { geoip { source => "ClientHost" } } } } }`

output {
elasticsearch {
hosts => ["elasticsearch:9200"]
....
index => "logstash-container-%{container}-%{+YYYY.MM.dd}"
}
}

The question is - can I add tags with vector and perform operations based on that tags? Does anyone have such config example that can be shared? I saw somewhere that tags can be added only as key-value pairs, is that true?

[jszwedko]

Hi @agorkiy !

I think you should be able to replicate all of the transformation functionality you are using here with remap.

Example of adding and using tags:

[transforms.my_transform_id]
type = "remap"
inputs = [ "my-source-or-transform-id" ]
source = '''
.host = "localhost"
if .foo == "bar" {
  .baz = 1234
}
'''

You'll probably be interested in the parse_grok function as well: https://vector.dev/docs/reference/vrl/examples/#parse_grok

Let me know if that helps!