The Vector team is pleased to announce version 0.37.0!
Be sure to check out the upgrade guide for breaking changes in this release.
In addition to the usual enhancements and bug fixes, this release also includes
mqtt
sink to emit events from Vector using the MQTT protocol. A source is in the
works. Kudos to the contributors that
pushed this forward: @astro,
@zamazan4ik, and @mladedav.dnstap
source now supports reading events over TCP. Kudos to
@esensar for this contribution.mmdb
enrichment table type for loading arbitrary mmdb databases and not just GeoIP
ones. Kudos to @esensar for this contribution.pulsar
source for receiving events from Pulsar. Kudos to
@zamazan4ik and @WarmSnowy
for this contribution.geoip2
enrichment table type stopped handling GeoLite2-City
mmdb types. This is fixed in v0.37.1.parse_ddtags
setting added to the datadog_agent
source incorrectly parses the
tags into an object instead of an array. The datadog_logs
sink also fails to
reconstruct the parsed tags. This will be fixed in v0.38.0..deb
archives and container images (alpine and debian).
Thanks to
wtaylor
for contributing this change!rotate_wait_secs
was added to the file
and kubernetes_logs
sources. rotate_wait_secs
determines for how long Vector keeps trying to read from a log file that has been deleted. Once that time span has expired, Vector stops reading from and closes the file descriptor of the deleted file, thus allowing the OS to reclaim the storage space occupied by the file.
Thanks to
syedriko
for contributing this change!EXPRESS_ONEZONE
option was added to storage_class
for aws_s3
sink.
Thanks to
siavashs
for contributing this change!tls.ca_file
is no longer required for enabling TLS. Just use tls = {}
in toml configuration when your server is hosting a public CA.
Thanks to
sunng87
for contributing this change!The datadog_agent
source now contains a configuration setting parse_ddtags
, which is disabled by default.
When enabled, the ddtags
field (a comma separated list of key-value strings) is parsed and expanded into an
object in the event.
include_paths_glob_patterns
has been introduced in the Kubernetes Logs source. This option works alongside the existing exclude_paths_glob_patterns
to help narrow down the selection of logs to be considered. include_paths_glob_patterns
is evaluated before exclude_paths_glob_patterns
.
Thanks to
syedriko
for contributing this change!remap
component no longer filters out the file contents from error messages when the VRL
program is passed in via the file
option.lowercase_hostnames
option to dnstap
source, to filter hostnames in DNS records and
lowercase them for consistency.
Thanks to
esensar
for contributing this change!permit_origin
config option for all sources with TCP mode (fluent
, logstash
, statsd
, syslog
).
Thanks to
esensar
for contributing this change!The datadog_agent
source now correctly calculates the value for the metric component_received_event_bytes_total
before enriching the event with Vector metadata.
The source also now adheres to the Component Specification by incrementing component_errors_total
when a request succeeded in decompression but JSON parsing failed.
The datadog_logs
sink no longer requires a semantic meaning input definition for message
and timestamp
fields.
While the Datadog logs intake does handle these fields if they are present, they aren’t required.
The only impact is that configurations which enable the Log Namespace feature and use a Source input to this sink which does not itself define a semantic meaning for message
and timestamp
, no longer need to manually set the semantic meaning for these two fields through a remap transform.
Existing configurations that utilize the Legacy namespace are unaffected, as are configurations using the Vector namespace where the input source has defined the message
and timestamp
semantic meanings.
fingerprint.ignored_header_bytes
option on the file
source now has a default of 0
.splunk_hec_logs
sink when configured with the raw
endpoint target, was removing the timestamp from the event. This was due to a bug in the handling of the auto_extract_timestamp
configuration option, which is only supposed to apply to the event
endpoint target.We now correctly calculate the estimated JSON size in bytes for the metric component_received_event_bytes_total
for the splunk_hec
source.
Previously this was being calculated after event enrichment. It is now calculated before enrichment, for both raw
and event
endpoints.
Sign up to receive emails on the latest Vector content and new releases
Thank you for joining our Updates Newsletter