Configure Vector to parse, transform, and route log events using VRL (Vector Remap Language) with multiple sinks
domain: vector.dev · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Define a sources block in vector.toml with a file or socket source ingesting raw log lines
Add a transforms block using the remap transform type and write a VRL program to parse JSON, extract fields, and add metadata
Use the route transform to split events by a field value into named outputs, each routable to a different sink
Configure multiple sinks (such as a Loki sink and an S3 sink) and reference the route transform outputs as inputs
Run vector validate --config vector.toml and then vector top to monitor throughput and error rates per component
Known gotchas
VRL is strictly typed; accessing a field that may be absent without using the optional chaining operator .field? causes a runtime abort that drops the event
The route transform outputs are named by the route conditions; the _unmatched output must be explicitly wired to a sink or events are dropped silently
Vector's Loki sink requires log events to have a timestamp field; events without a valid timestamp are rejected by Loki with a 400 error
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?