vector-log-forwarder

Tiny log/metric shipper for fleets (HTTP/MQTT/Syslog → S3/HTTP)

arm64amd64

LoggingMetricsVectorObservability

Request access Back to Marketplace

Overview

Primary hardware

Generic Edge (arm64/amd64)

What it does

Uses Vector to tail container logs, parse JSON, and forward to your backend or cloud object storage.

Why it saves time

Batteries-included log pipeline with structured parsing and backpressure—no custom agents needed.

Get access

Use StreamDeploy to manage OTA updates, versioned configs, and rollbacks across fleets.

Request access

Dockerfile

ARG BASE_IMAGE
FROM ${BASE_IMAGE:-"timberio/vector:0.38.0-debian"}
USER root
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENV VECTOR_CONFIG=/etc/vector/vector.yaml \
    SINK_URL="" \
    HOSTNAME=edge-node
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
  CMD nc -z localhost 8686 || exit 0
ENTRYPOINT ["/entrypoint.sh"]

entrypoint.sh

#!/usr/bin/env bash
set -euo pipefail
: "${SINK_URL:=}"
mkdir -p /etc/vector
cat > /etc/vector/vector.yaml <<'YML'
sources:
  docker_logs:
    type: docker_logs
    include_containers: ["*"]
transforms:
  to_json:
    type: remap
    inputs: [docker_logs]
    source: |
      .hostname = get_env!("HOSTNAME")
      if exists(.message) && is_string(.message) {
        .parsed, err = parse_json(.message)
        if err == null { . = .parsed }
      }
sinks:
  http_out:
    type: http
    inputs: [to_json]
    uri: "${SINK_URL}"
    encoding:
      codec: json
YML
exec /usr/local/bin/vector -c /etc/vector/vector.yaml -w /var/lib/vector