Build a log processing pipeline with Vector to parse, enrich, and route logs to multiple sinks

Steps

1. Install Vector and create a vector.toml configuration with a sources section; use the journald or file source to collect logs from systemd or log files
2. Add a transforms section with a remap transform using VRL (Vector Remap Language) to parse JSON or regex patterns: use parse_json() or parse_regex() functions to extract structured fields
3. Enrich logs by adding fields: use get_env_var() to add environment metadata, or use the geoip enrichment table transform to append geographic data from IP fields
4. Add a filter transform to drop noisy debug logs matching a condition on the log level field before forwarding to expensive sinks
5. Define multiple sinks: a datadog_logs sink with api_key = YOUR_KEY for operational logs, and an aws_s3 sink for long-term archive, both consuming from the same enriched transform output
6. Run vector validate --config vector.toml to check syntax and topology, then start with vector --config vector.toml and monitor via the internal_metrics source and Prometheus sink