@@ -56,37 +56,44 @@ create a simple topology consisting of three components:
56
56
57
57
This configuration defines that topology:
58
58
59
- ``` toml title="vector.toml"
60
- [sources .logs ]
61
- type = " demo_logs"
62
- format = " syslog"
63
- interval = 0.1
64
-
65
- [transforms .modify ]
66
- type = " remap"
67
- inputs = [" logs" ]
68
- source = '''
69
- # Parse Syslog input. The "!" means that the script should abort on error.
70
- . = parse_syslog!(.message)
71
- '''
72
-
73
- [sinks .out ]
74
- type = " console"
75
- inputs = [" modify" ]
76
- encoding.codec = " json"
59
+ ``` yaml title="vector.yaml"
60
+ sources :
61
+ logs :
62
+ type : demo_logs
63
+ format : syslog
64
+ interval : 0.1
65
+
66
+ transforms :
67
+ modify :
68
+ type : remap
69
+ inputs :
70
+ - logs
71
+ source : |
72
+ # Parse Syslog input. The "!" means that the script should abort on error.
73
+ . = parse_syslog!(.message)
74
+
75
+ sinks :
76
+ out :
77
+ type : console
78
+ inputs :
79
+ - modify
80
+ encoding :
81
+ codec : json
77
82
` ` `
78
83
79
84
{{< info >}}
80
- Although we're using [ TOML ] [ urls.toml ] for the configuration here, Vector also
81
- supports JSON and YAML .
85
+ Although we're using [YAML ][urls.yaml ] for the configuration here, Vector also
86
+ supports [TOML][urls.toml] and [JSON][urls.json] .
82
87
83
88
[urls.toml]: https://github.com/toml-lang/toml
89
+ [urls.yaml]: https://yaml.org
90
+ [urls.json]: https://www.json.org/json-en.html
84
91
{{< /info >}}
85
92
86
93
To start Vector using this topology:
87
94
88
95
` ` ` bash
89
- vector --config-toml /etc/vector/vector.toml
96
+ vector --config /etc/vector/vector.yaml
90
97
```
91
98
92
99
You should see lines like this emitted via stdout (formatted for readability
@@ -109,31 +116,33 @@ So far, we've gotten Vector to *parse* the Syslog data but we're not yet
109
116
* modifying* that data. So let's update the ` source ` script of our ` remap `
110
117
transform to make some ad hoc transformations:
111
118
112
- ``` toml
113
- [transforms .modify ]
114
- type = " remap"
115
- inputs = [" logs" ]
116
- source = '''
117
- . = parse_syslog!(.message)
118
-
119
- # Convert the timestamp to a Unix timestamp, aborting on error
120
- .timestamp = to_unix_timestamp!(.timestamp)
121
-
122
- # Remove the "facility" and "procid" fields
123
- del(.facility); del(.procid)
124
-
125
- # Replace the "msgid" field with a unique ID
126
- .msgid = uuid_v4()
127
-
128
- # If the log message contains the phrase "Great Scott!", set the new field
129
- # "critical" to true, otherwise set it to false. If the "contains" function
130
- # errors, log the error (instead of aborting the script, as above).
131
- if (is_critical, err = contains(.message, "Great Scott!"); err != null) {
132
- log(err, level: "error")
133
- }
134
-
135
- .critical = is_critical
136
- '''
119
+ ``` yaml
120
+ transforms :
121
+ modify :
122
+ type : remap
123
+ inputs :
124
+ - logs
125
+ source : |
126
+ . = parse_syslog!(.message)
127
+
128
+ # Convert the timestamp to a Unix timestamp, aborting on error
129
+ .timestamp = to_unix_timestamp!(.timestamp)
130
+
131
+ # Remove the "facility" and "procid" fields
132
+ del(.facility)
133
+ del(.procid)
134
+
135
+ # Replace the "msgid" field with a unique ID
136
+ .msgid = uuid_v4()
137
+
138
+ # If the log message contains the phrase "Great Scott!", set the new field
139
+ # "critical" to true, otherwise set it to false. If the "contains" function
140
+ # errors, log the error (instead of aborting the script, as above).
141
+ if (is_critical, err = contains(.message, "Great Scott!"); err != null) {
142
+ log(err, level: "error")
143
+ }
144
+
145
+ .critical = is_critical
137
146
` ` `
138
147
139
148
A few things to notice about this script:
0 commit comments