What it does
Vector is a configurable telemetry pipeline that runs as a daemon, sidecar, or aggregator. Its source, transform, and sink components collect logs and metrics, reshape or filter events, and send results to destinations such as Elasticsearch, S3, or Datadog. It suits teams that need to standardize or route telemetry before it reaches a storage or monitoring product; Vector itself is the pipeline, not the downstream analysis interface.
Build a pipeline from components
Vector is configured as a graph of sources, transforms, and sinks. A source reads or receives events, transforms parse, enrich, filter, sample, or route them, and sinks deliver the results. The official configuration guide demonstrates a file source feeding a parsing transform and then separate Elasticsearch and S3 sinks. The same input can therefore be shaped for one destination while preserving a different stream for another.
A sensible first task is to choose an existing log source and destination, then connect them with the relevant components in a YAML, TOML, or JSON configuration file. For example, an operations team could parse web-server logs, remove sensitive fields, and route the cleaned events to a search store while sending another stream to an archive.
The installation guide documents a single-binary setup and notes that standard Unix builds depend on libc; static musl artifacts are available for environments without it, with a documented performance caveat for multithreaded use. Component choice and configuration are part of operating the pipeline, so check the current documentation for each source, transform, and sink you plan to use.
Collection is not analysis
Vector can collect and route telemetry across vendors, including transforming data in flight rather than tying ingestion to one analysis backend. It does not replace destination dashboards, search, or alerting. Its documented gRPC observability API is disabled by default and does not support authentication, so the API should not be exposed to untrusted clients.
The Vector repository is licensed under MPL 2.0. This record covers that open-source pipeline project, not Datadog APM or the separately marketed Datadog Observability Pipelines product.
Strengths
- Composable sources, transforms, and sinks let teams collect, reshape, and route telemetry in one pipeline.
- Configuration is supported in YAML, TOML, and JSON.
- The official project is licensed under MPL 2.0 and distributed as a single binary.
Watch out for
- The documented observability API has no authentication and must not be exposed to untrusted clients.
- Vector handles collection and routing; teams still need downstream systems for storing and analyzing routed data.
- Pipeline behavior depends on selecting and configuring the components needed for each source and destination.
Best for
- Routing application or infrastructure logs to more than one destination.
- Parsing, filtering, sampling, or redacting telemetry before storage.
- Teams that want a self-managed collection layer between telemetry sources and monitoring backends.
Sources
- Vector | A lightweight, ultra-fast tool for building observability pipelines (Oct 25, 2026)
- Configuring Vector (Oct 25, 2026)
- Install Vector (Oct 25, 2026)
- The Vector Observability API (Oct 25, 2026)
- Vector repository license (Oct 25, 2026)
- Datadog Observability Pipelines (Oct 25, 2026)