Buying snapshot
Scroll sideways to see all columns. With a keyboard, focus this table and use the arrow keys.
| Decision point | What the project states |
|---|---|
License and maintainer | Open source. Vector is maintained by Datadog's Community Open Source Engineering team. |
Installation | A single binary for X86_64 and ARM64/v7 with no dependencies and no runtime. Install it with a one-line shell script, or choose a platform, package manager, operating system or manual install. |
Version | The Vector website announces version 0.59.0 as new. |
Components | 47 sources, 18 transforms and 61 sinks. Pipelines connect sources to transforms to sinks. |
Configuration | Examples are in YAML; Vector also supports TOML and JSON. |
Our take
Choose Vector when you want to own and run the pipeline between your systems and your observability vendors, for logs and metrics, instead of relying on each vendor's own agent.
Evaluate Vector
Comparisons
Where it stands out
One tool from host to destination. Vector deploys as a daemon, a sidecar or an aggregator, and the project documents distributed, centralized and stream-based topologies. Consolidating agents is one of its stated use cases.
Shape data before a vendor sees it. Transforms include Remap with Vector Remap Language (VRL), Filter, Dedupe, Aggregate, Log to metric and Lua. The website's own example redacts US Social Security numbers with VRL before logs reach Datadog. Vector says this lets you cut cost, enrich data and apply security where you need it.
Change destinations without rebuilding collection. Vector says it does not favor any vendor platform and lists moving between vendors without disrupting workflows as a use case. Its examples send Splunk HEC input to Datadog, Kafka to Elasticsearch, and Kubernetes logs to AWS S3.
Product screenshot
Trade-offs to weigh
Traces are not covered yet. The README lists traces as coming soon and still labels metrics beta, while the website lists logs and metrics. If one pipeline must also carry traces, plan another route for them for now.
Pipeline logic is code. Complex processing is written in VRL or Lua, so someone on the team must write, review and maintain those transforms.
Public signals
About these signals
Verified factual signals from public sources. They indicate observable activity or interest, not total adoption, product quality, or cost.
570 GitHub commits 90d22.8k GitHub stars
See all signals from 3 sources
Alternatives to Vector
The reviewed substitutes for Vector among the telemetry pipelines, and what would make each one the better answer.
Other approaches
A different approach to the same problem. Each substitutes only for the workload named beside it.
- Cribl
- Cribl is chosen instead of Vector for observability workloads that require telemetry reduction, enrichment, replay, and platform-level operating limits. **Cribl** is an observability pipeline platform for routing, reducing, enriching, and replaying logs, metrics, and traces between sources and destinations.
Related technologies
Normally used together rather than chosen between, so these are not alternatives.
- Datadog
- Vector is a telemetry pipeline that collects, transforms and routes observability data; Datadog is a platform that receives and analyses it. Vector routinely ships data into Datadog, so the pair is a pipeline-and-destination pairing rather than a substitution.Applies to: Whether a telemetry pipeline replaces the observability platform or feeds it, and where ingest cost is controlled.
- Splunk
- The two sit at different layers of one system and the documented deployments run them together, so the reader's question is which job each one does rather than which to buy.Applies to: Whether these two do the same job, or different jobs in one pipeline.