# Where Vector persists file-source checkpoint state (which lines it's
# already read). Without this, Vector falls back to /var/lib/vector/, a
# Unix path that doesn't exist on Windows, and refuses to start. Vector
# doesn't create this directory itself, run `mkdir vector-data` once
# before the first run.
data_dir = "./vector-data"
# --- Source: tail your application's log files (swap for your real source) ---
[sources.app_logs]
type = "file"
include = ["/var/log/myapp/*.log"]
# --- Optional: parse each line into structured fields ObsidianLog indexes on ---
# ObsidianLog reads `timestamp`, `service`, `level`, `host`, `trace_id` when
# present, and tolerates anything missing.
[transforms.structure]
type = "remap"
inputs = ["app_logs"]
source = '''
. = object!(parse_json(.message) ?? { "message": .message })
.service = .service || "myapp"
'''
# --- Sink: POST batches to the ObsidianLog ingest endpoint ---
[sinks.obsidianlog]
type = "http"
inputs = ["structure"]
uri = "http://localhost:7080/ingest"
method = "post"
encoding.codec = "json" # sends each batch as a JSON array of events
# Retry on ObsidianLog's 5xx (durable-write failures); Vector buffers meanwhile.
request.retry_attempts = 10
batch.max_bytes = 10485760 # 10 MiB
batch.timeout_secs = 5
