[opensourcedex]

Vector is a free, open source monitoring & observability project written in Rust and released under MPL-2.0. It has 22,579 GitHub stars, 2,286 forks and 2,512 open issues, and was last pushed 3 hours ago. On this registry it ranks #13 of 97 tracked projects in Monitoring & Observability, with 5 head-to-head comparisons available. It gained 33 stars over the last 6 tracked days.

Vector — Collect, transform, and route logs and metrics in one tool

What is Vector?

What it is

Vector is an open-source observability data pipeline written in Rust and licensed under MPL-2.0. It operates as an end-to-end system for collecting, transforming, and routing logs and metrics within the cloud-native monitoring ecosystem. The project is maintained by Datadog's Community Open Source Engineering team, and its topics include agent, cloud-native, data-transformation, datadog, etl, events, forwarder, logs, metrics, and monitoring.

The problem it solves is a loss of control over observability data once it is generated by applications and infrastructure. Instead of sending all logs and metrics directly to a vendor collector, teams can use Vector as a pipeline that enriches, transforms, and routes data to one or more destinations. This supports cost reduction, vendor migration, agent consolidation, data quality work, and security controls closer to the source or aggregator.

Key capabilities

  • Vector collects logs and metrics through sources and routes them to sinks, so teams can send data to current and future vendors without replacing the whole pipeline.
  • It provides transformation and ETL-style processing for observability events, enabling enrichment and data-quality work before data reaches downstream systems.
  • It can be deployed as an agent near the data source or as an aggregator in a central location, giving operators two distinct roles for the same pipeline.
  • It uses a unified data model for logs and metrics, with metrics marked as beta and traces listed as coming soon, so teams can consolidate some agent and routing responsibilities.
  • It includes benchmark comparisons against Filebeat, FluentBit, FluentD, Logstash, SplunkUF, and SplunkHF for TCP and file-to-TCP workloads.

Who uses it and how

  • Startups and enterprises use Vector to reduce total observability costs and to transition between vendors without disrupting existing collection workflows.
  • Operators with large data volumes use it as an agent or aggregator, and the README states that its largest user processes over 500TB daily.
  • Security and data quality teams use it to apply enrichment and transformation rules before sending logs and metrics to external vendors.

Getting started

The README points new users to the quickstart guide and installation instructions, and it lists downloads, container images, and Rust crate documentation as entry points for running or embedding Vector.

When to use it — and when not to

Use Vector when a self-hosted pipeline can collect, transform, and route logs and metrics across agent and aggregator roles, especially when vendor switching, cost control, or agent consolidation matters. It is benchmarked against Filebeat, FluentBit, FluentD, Logstash, SplunkUF, and SplunkHF, but the provided facts do not describe a hosted or managed replacement for those products. Avoid it when non-beta metrics or traces are required, because metrics are beta and traces are coming soon; the 2,512 open issues also indicate a broad surface that operators should test carefully.

project readme (upstream, from github) — read inline

Nightly Integration/E2E Test Suite Component Features

Quickstart  •   Docs  •   Guides  •   Integrations  •   Chat  •   Download  •   Container Images  •   Rust Crate Docs

What is Vector?

Vector is a high-performance, end-to-end (agent & aggregator) observability data pipeline that puts you in control of your observability data. [Collect][docs.sources], [transform][docs.transforms], and [route][docs.sinks] all your logs and metrics to any vendors you want today and any other vendors you may want tomorrow. Vector enables dramatic cost reduction, novel data enrichment, and data security where you need it, not where it is most convenient for your vendors. Additionally, it is open source and up to 10x faster than every alternative in the space.

To get started, follow our [quickstart guide][docs.quickstart] or [install Vector][docs.installation].

Vector is maintained by Datadog's Community Open Source Engineering team.

Principles

  • Reliable - Built in [Rust][urls.rust], Vector's primary design goal is reliability.
  • End-to-end - Deploys as an [agent][docs.roles#agent] or [aggregator][docs.roles#aggregator]. Vector is a complete platform.
  • Unified - [Logs][docs.data-model.log], [metrics][docs.data-model.metric] (beta), and traces (coming soon). One tool for all of your data.

Use cases

  • Reduce total observability costs.
  • Transition vendors without disrupting workflows.
  • Enhance data quality and improve insights.
  • Consolidate agents and eliminate agent fatigue.
  • Improve overall observability performance and reliability.

Community

  • Vector is relied on by startups and enterprises like Atlassian, T-Mobile, Comcast, Zendesk, Discord, Fastly, CVS, Trivago, Tuple, Douban, Visa, Mambu, Blockfi, Claranet, Instacart, Forcepoint, and [many more][urls.production_users].
  • Vector is downloaded over 100,000 times per day.
  • Vector's largest user processes over 500TB daily.
  • Vector has over 500 contributors and growing.

Documentation

All user documentation is available at vector.dev/docs.

Other Resources:

  • [Vector Calendar][urls.vector_calendar]
  • Policies:
    • [Code of Conduct][urls.vector_code_of_conduct]
    • [Contributing][urls.vector_contributing_policy]
    • [Privacy][urls.vector_privacy_policy]
    • [Releases][urls.vector_releases_policy]
    • [Versioning][urls.vector_versioning_policy]
    • [Security][urls.vector_security_policy]

Comparisons

Performance

The following performance tests demonstrate baseline performance between common protocols with the exception of the Regex Parsing test.

Test Vector Filebeat FluentBit FluentD Logstash SplunkUF SplunkHF
TCP to Blackhole 86mib/s n/a 64.4mib/s 27.7mib/s 40.6mib/s n/a n/a
File to TCP 76.7mib/s 7.8mib/s 35mib/s 26.1mib/s 3.1mib/s 40.1mib/s 39mib/s
Regex Parsing 13.2mib/s n/a 20.5mib/s 2.6mib/s 4.6mib/s n/a 7.8mib/s
TCP to HTTP 26.7mib/s n/a 19.6mib/s <1mib/s 2.7mib/s n/a n/a
TCP to TCP 69.9mib/s 5mib/s 67.1mib/s 3.9mib/s 10mib/s 70.4mib/s 7.6mib/s

To learn more about our performance tests, please see the [Vector test harness][urls.vector_test_harness].

Correctness

The following correctness tests are not exhaustive, but they demonstrate fundamental differences in quality and attention to detail:

Test Vector Filebeat FluentBit FluentD Logstash Splunk UF Splunk HF
Disk Buffer Persistence ✓ ✓ ⚠ ✓ ✓
File Rotate (create) ✓ ✓ ✓ ✓ ✓ ✓ ✓
File Rotate (copytruncate) ✓ ✓ ✓
File Truncation ✓ ✓ ✓ ✓ ✓ ✓ ✓
Process (SIGHUP) ✓ ⚠ ✓ ✓
JSON (wrapped) ✓ ✓ ✓ ✓ ✓ ✓ ✓

To learn more about our correctness tests, please see the [Vector test harness][urls.vector_test_harness].

Features

Vector is an end-to-end, unified, open data platform.

Vector Beats Fluentbit Fluentd Logstash Splunk UF Splunk HF Telegraf
End-to-end ✓ ✓
Agent ✓ ✓ ✓ ✓ ✓
Aggregator ✓ ✓ ✓ ✓ ✓
Unified ✓ ✓
Logs ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
Metrics ✓ ⚠ ⚠ ⚠ ⚠ ⚠ ⚠ ✓
Traces 🚧
Open ✓ ✓ ✓ ✓
Open-source ✓ ✓ ✓ ✓ ✓ ✓

readme truncated — read the full docs on github

Frequently asked questions

Is Vector free to use?

Vector is open source under the MPL-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Vector do?

Collect, transform, and route logs and metrics in one tool

What is Vector written in?

Vector is primarily written in Rust. Its source is publicly available at https://github.com/vectordotdev/vector, and it has 22,579 GitHub stars.