Vector Integration

The most common use case: aggregate syslogs on a central rsyslog host, then forward to LogTide via Vector. This is especially useful when omhttp is not available in your rsyslog package (common on Debian 13+).

sources:
  rsyslog:
    type: syslog
    address: 0.0.0.0:514
    mode: tcp

transforms:
  format_logs:
    type: remap
    inputs:
      - rsyslog
    source: |
      # Extract and normalize fields
      .message = string!(.message)
      .level = downcase(string(.severity) ?? "info")
      .service = string(.appname) ?? string(.hostname) ?? "syslog"

      # Preserve useful metadata
      .metadata = {}
      .metadata.hostname = string(.hostname) ?? null
      .metadata.facility = string(.facility) ?? null
      .metadata.procid = string(.procid) ?? null

      # Remove raw syslog fields (already extracted above)
      del(.severity)
      del(.appname)
      del(.hostname)
      del(.facility)
      del(.procid)
      del(.source_type)
      del(.timestamp)
      del(.version)
      del(.msgid)
      del(.host)

sinks:
  logtide:
    type: http
    inputs:
      - format_logs
    uri: https://<LOGTIDE_URL>/api/v1/ingest/single
    encoding:
      codec: json
    framing:
      method: newline_delimited
    request:
      headers:
        X-API-Key: "<YOUR_API_KEY>"
        Content-Type: "application/x-ndjson"

# /etc/rsyslog.d/99-forward-to-vector.conf
# Forward all logs to Vector on localhost:514 via TCP
*.* @@127.0.0.1:514

Collect logs from Docker containers using Vector's docker_logs source:

sources:
  docker:
    type: docker_logs
    docker_host: unix:///var/run/docker.sock

transforms:
  format_docker:
    type: remap
    inputs:
      - docker
    source: |
      .service = string(.container_name) ?? "unknown"
      .level = downcase(string(.level) ?? "info")
      .message = string!(.message)

      .metadata = {}
      .metadata.container_id = string(.container_id) ?? null
      .metadata.container_name = string(.container_name) ?? null
      .metadata.image = string(.image) ?? null

      del(.container_id)
      del(.container_name)
      del(.container_created_at)
      del(.image)
      del(.label)
      del(.source_type)
      del(.stream)
      del(.timestamp)
      del(.host)

sinks:
  logtide:
    type: http
    inputs:
      - format_docker
    uri: https://<LOGTIDE_URL>/api/v1/ingest/single
    encoding:
      codec: json
    framing:
      method: newline_delimited
    request:
      headers:
        X-API-Key: "<YOUR_API_KEY>"
        Content-Type: "application/x-ndjson"

Tail log files and forward them to LogTide:

sources:
  app_logs:
    type: file
    include:
      - /var/log/myapp/*.log
    read_from: beginning

transforms:
  format_app:
    type: remap
    inputs:
      - app_logs
    source: |
      .service = "myapp"
      .level = "info"
      .message = string!(.message)

      # Parse JSON logs if applicable
      parsed, err = parse_json(.message)
      if err == null {
        .level = downcase(string(parsed.level) ?? "info")
        .service = string(parsed.service) ?? .service
        .message = string(parsed.message) ?? string(parsed.msg) ?? .message
        .metadata = parsed
      }

      del(.source_type)
      del(.timestamp)
      del(.host)
      del(.file)

sinks:
  logtide:
    type: http
    inputs:
      - format_app
    uri: https://<LOGTIDE_URL>/api/v1/ingest/single
    encoding:
      codec: json
    framing:
      method: newline_delimited
    request:
      headers:
        X-API-Key: "<YOUR_API_KEY>"
        Content-Type: "application/x-ndjson"

LogTide's /api/v1/ingest/single endpoint auto-normalizes incoming fields. Here's how Vector fields map to LogTide:

Level Normalization

LogTide accepts 5 log levels. Incoming levels are automatically mapped:

Vector batches multiple events into a single HTTP request by default. You can tune this for your throughput needs:

sinks:
  logtide:
    type: http
    inputs:
      - format_logs
    uri: https://<LOGTIDE_URL>/api/v1/ingest/single
    encoding:
      codec: json
    framing:
      method: newline_delimited
    batch:
      max_bytes: 1049000    # ~1MB per request
      max_events: 1000      # Up to 1000 logs per request
      timeout_secs: 1       # Flush at least every second
    request:
      concurrency: 10       # Up to 10 parallel requests
      rate_limit_num: 200   # Max 200 requests per second
      headers:
        X-API-Key: "<YOUR_API_KEY>"
        Content-Type: "application/x-ndjson"