Define a sources block in vector.toml with a file or socket source ingesting raw log lines
Add a transforms block using the remap transform type and write a VRL program to parse JSON, extract fields, and add metadata
Use the route transform to split events by a field value into named outputs, each routable to a different sink
Configure multiple sinks (such as a Loki sink and an S3 sink) and reference the route transform outputs as inputs
Run vector validate --config vector.toml and then vector top to monitor throughput and error rates per component
Known gotchas
VRL is strictly typed; accessing a field that may be absent without using the optional chaining operator .field? causes a runtime abort that drops the event
The route transform outputs are named by the route conditions; the _unmatched output must be explicitly wired to a sink or events are dropped silently
Vector's Loki sink requires log events to have a timestamp field; events without a valid timestamp are rejected by Loki with a 400 error
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp