Vector: product and architecture
Vector is an open-source, high-performance observability data pipeline built in Rust that collects, transforms, and routes logs, metrics, and traces across your entire infrastructure. In this Vector review, we evaluate how this tool from Datadog handles the demanding requirements of modern observability pipelines. Now at version 0.55.0, Vector has matured into a serious contender for teams that need a single, reliable binary to move telemetry data from any source to any destination. With over 13,000 GitHub stars, 300+ contributors, and 30 million downloads across 40 countries, Vector has earned strong community backing in the observability space.
Overview
Vector positions itself as a lightweight, ultra-fast observability data pipeline that replaces the patchwork of tools organizations typically deploy to collect, transform, and route telemetry data. Built entirely in Rust, it delivers memory-safe, high-throughput data processing without requiring a runtime environment or external dependencies.
The tool operates across three deployment models: as a daemon running on each host, as a sidecar alongside application containers, or as a centralized aggregator processing data from multiple sources. This flexibility lets teams adopt Vector incrementally, starting with a single role and expanding as their observability architecture grows.
Vector is vendor-neutral by design. It does not favor any specific platform, instead providing a fair, open ecosystem that prevents vendor lock-in. Teams can route data to Datadog, Elasticsearch, AWS S3, Splunk, or dozens of other destinations without restructuring their pipeline. The project ships as a single static binary supporting both x86_64 and ARM64/v7 architectures, making deployment straightforward across Linux, macOS, Kubernetes, and container environments.
Key Features and Architecture
Vector's architecture follows a sources-transforms-sinks model. Data enters through sources, gets processed by transforms, and exits through sinks. The current release supports 47 sources, 18 transforms, and 61 sinks, covering a wide range of observability use cases.
Sources include integrations for AMQP, Apache Metrics, AWS ECS metrics, AWS Kinesis Firehose, AWS S3, AWS SQS, Datadog Agent, Docker logs, Kubernetes logs, and dnstap, among others. This breadth means Vector can ingest data from virtually any infrastructure component without additional adapters.
Transforms provide the data processing layer. The standout feature here is VRL (Vector Remap Language), a purpose-built language for transforming observability data. VRL supports operations like JSON parsing, field redaction (including built-in filters for sensitive data like US Social Security numbers), log-to-metric conversion, deduplication, aggregation, and routing. The programmable transform layer gives teams full control over data shaping without the limitations of rigid, GUI-based configuration. Additional transforms include Lua scripting support, exclusive routing for conditional pipelines, and metric-to-log conversion for cross-signal analysis.
Sinks route processed data to 61 destinations including AWS CloudWatch, AWS Kinesis, AWS S3, AWS SNS, AWS SQS, Axiom, AppSignal, AMQP, Datadog, Elasticsearch, and Splunk HEC. Teams can fan out data to multiple destinations simultaneously from a single pipeline.
Configuration uses YAML by default, with TOML and JSON also supported. The composable configuration format lets teams define flexible pipelines where any source can feed into any transform, and any transform can output to any sink. Vector supports distributed, centralized, and stream-based deployment topologies, each suited to different organizational requirements and scale.
Ideal Use Cases
Vector fits best in environments where observability data volume is high and reliability is non-negotiable. Infrastructure teams running large Kubernetes clusters benefit from Vector's native Kubernetes log collection and its ability to compress, batch, and route logs directly to object storage like AWS S3.
Organizations migrating between observability vendors find Vector valuable as a neutral routing layer. Teams moving from Splunk to Datadog, for example, can run both sinks simultaneously during the transition period without modifying application-level instrumentation.
Security-conscious teams use Vector's VRL transforms to redact sensitive data at the pipeline level before it reaches any destination. This ensures PII and other regulated data never lands in log storage, regardless of what applications emit.
Vector also serves teams that need to reduce observability costs by filtering, sampling, or aggregating data before it reaches usage-based platforms, cutting ingestion volumes without losing critical signal. Multi-cloud organizations benefit particularly, since Vector's single binary runs identically across AWS, GCP, Azure, and on-premise environments.
Pros and Cons
Pros:
- Built in Rust for exceptional performance and memory safety, handling the most demanding workloads without garbage collection pauses
- Single binary with zero runtime dependencies simplifies deployment across any platform or architecture
- 47 sources, 18 transforms, and 61 sinks cover the vast majority of integration needs out of the box
- VRL provides powerful, purpose-built data transformation with built-in redaction filters for sensitive data
- Vendor-neutral design prevents lock-in and supports routing to multiple destinations simultaneously
- Active open-source community with 22.5k GitHub stars, 300+ contributors, and 30 million downloads
- Supports YAML, TOML, and JSON configuration formats for team flexibility
Cons: - VRL has a learning curve compared to simpler configuration-only pipeline tools - Backed by Datadog, which may raise neutrality concerns for teams evaluating competing observability platforms - No built-in graphical interface for pipeline design, visualization, or real-time monitoring - Tracing support is a recent capability compared to the log and metric handling capabilities - Community support only; enterprise support requires engagement with Datadog's commercial offerings
