SigNoz
Docs
PricingCustomers
Get Started - Free
Docs
IntroductionContributingMigrate from DatadogSigNoz API
OpenTelemetry
What is OpenTelemetryOpenTelemetry Collector GuideOpenTelemetry Demo
Community
Support
Slack
X
Launch Week
Changelog
Dashboard Templates
DevOps Wordle
Newsletter
KubeCon, Atlanta 2025
More
SigNoz vs DatadogSigNoz vs New RelicSigNoz vs GrafanaSigNoz vs Dynatrace
Careers
AboutTermsPrivacySecurity & Compliance
SigNoz Logo
SigNoz
All systems operational
HIPAASOC-2
SigNoz Cloud - This page applies to SigNoz Cloud editions.
Self-Host - This page applies to self-hosted SigNoz editions.

Send Logs from Vector to SigNoz

Overview

Vector collects, transforms, and ships logs from various sources (syslog, files, Docker, Kubernetes) to SigNoz. SigNoz Cloud uses Vector's http sink; self-hosted SigNoz uses the opentelemetry sink.

The self-hosted path uses Vector's opentelemetry sink with a remap transform instead of the http sink. Select the Self-Hosted tab in the Configure Vector section below.

Prerequisites

  • Vector installed and running on your system
  • An instance of SigNoz (Cloud or Self-Hosted)

Configure Vector

To send logs from Vector to SigNoz Cloud, you need to use the http sink.

A VM is a virtual computer that runs on physical hardware. This includes:

  • Cloud VMs: AWS EC2, Google Compute Engine, Azure VMs, DigitalOcean Droplets
  • On-premise VMs: VMware, VirtualBox, Hyper-V, KVM
  • Bare metal servers: Physical servers running Linux/Unix directly

Use this section if you're deploying Vector directly on a server or VM without containerization.

Step 1: Install Vector

Install Vector on your VM or bare metal server. See the official Vector installation guide for your platform.

Step 2: Configure Vector

Open your Vector configuration file (usually /etc/vector/vector.yaml):

sudo nano /etc/vector/vector.yaml

Add the following configuration to collect logs from system log files and send them to SigNoz:

vector.yaml
sources:
  system_logs:
    type: file
    include:
      - /var/log/syslog
      - /var/log/messages
      - /var/log/*.log
    read_from: end

sinks:
  signoz_sink:
    type: http
    inputs:
      - system_logs
    uri: "https://ingest.<region>.signoz.cloud/logs/vector"
    encoding:
      codec: json
    request:
      headers:
        signoz-ingestion-key: "<your-ingestion-key>"

Verify these values:

  • <region>: Your SigNoz Cloud region.
  • <your-ingestion-key>: Your SigNoz ingestion key.

The http sink sends log events as JSON to SigNoz Cloud's ingestion endpoint. The signoz-ingestion-key header authenticates each request. Vector batches events before sending.

Step 3: Restart Vector

sudo systemctl restart vector

Verify Vector is running:

sudo systemctl status vector

Step 1: Install the Vector Helm chart

Deploy Vector using the official Vector Helm chart. Set role: Agent to run Vector as a DaemonSet so every node collects logs. Define the full pipeline in customConfig.

Add the Vector Helm repo and install the chart:

helm repo add vector https://helm.vector.dev
helm repo update

Step 2: Configure Vector

Create a values.yaml file with customConfig for the Vector configuration:

values.yaml
role: Agent

customConfig:
  data_dir: /vector-data-dir
  sources:
    kubernetes_logs:
      type: kubernetes_logs
  sinks:
    signoz_sink:
      type: http
      inputs:
        - kubernetes_logs
      uri: "https://ingest.<region>.signoz.cloud/logs/vector"
      encoding:
        codec: json
      request:
        headers:
          signoz-ingestion-key: "<your-ingestion-key>"

service:
  enabled: false

serviceHeadless:
  enabled: false

Verify these values:

  • <region>: Your SigNoz Cloud region.
  • <your-ingestion-key>: Your SigNoz ingestion key.

Step 3: Apply Configuration

helm install vector vector/vector \
  --namespace vector \
  --create-namespace \
  --values values.yaml

Step 1: Create Vector Configuration

Create a vector.yaml file:

vector.yaml
sources:
  docker_logs:
    type: docker_logs

sinks:
  signoz_sink:
    type: http
    inputs:
      - docker_logs
    uri: "https://ingest.<region>.signoz.cloud/logs/vector"
    encoding:
      codec: json
    request:
      headers:
        signoz-ingestion-key: "<your-ingestion-key>"

Verify these values:

  • <region>: Your SigNoz Cloud region.
  • <your-ingestion-key>: Your SigNoz ingestion key.

Step 2: Run Vector Container

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/lib/docker:/var/lib/docker:ro \
  -v $(pwd)/vector.yaml:/etc/vector/vector.yaml \
  --name vector \
  timberio/vector:latest

The opentelemetry sink used here is in beta. The configuration schema may change before it reaches stable.

This documentation was tested with Vector version 0.54.0.

Vector's opentelemetry sink requires events to be pre-structured as OTLP — raw log events from sources like file or docker_logs are not. The remap transform below builds the required OTLP structure and maps source metadata to OTel semantic conventions.

A VM is a virtual computer that runs on physical hardware. This includes:

  • Cloud VMs: AWS EC2, Google Compute Engine, Azure VMs, DigitalOcean Droplets
  • On-premise VMs: VMware, VirtualBox, Hyper-V, KVM
  • Bare metal servers: Physical servers running Linux/Unix directly

Use this section if you're deploying Vector directly on a server or VM without containerization.

Step 1: Install Vector

Install Vector on your VM or bare metal server. See the official Vector installation guide for your platform.

Step 2: Configure Vector

Open your Vector configuration file (usually /etc/vector/vector.yaml):

sudo nano /etc/vector/vector.yaml

Add the following configuration:

vector.yaml
sources:
  system_logs:
    type: file
    include:
      - /var/log/syslog
      - /var/log/messages
      - /var/log/*.log
    read_from: end

transforms:
  to_otlp:
    type: remap
    inputs:
      - system_logs
    source: |
      msg = del(.message)
      ts  = del(.timestamp)
      . = {
        "resourceLogs": [{
          "resource": {
            "attributes": [
              {"key": "host.name",     "value": {"stringValue": del(.host) || ""}},
              {"key": "log.file.path", "value": {"stringValue": del(.file) || ""}}
            ]
          },
          "scopeLogs": [{
            "logRecords": [{
              "timeUnixNano": to_string(to_unix_timestamp!(ts, unit: "nanoseconds")),
              "body": {"stringValue": msg},
              "attributes": [
                {"key": "source_type", "value": {"stringValue": del(.source_type) || ""}}
              ]
            }]
          }]
        }]
      }

sinks:
  signoz_sink:
    type: opentelemetry
    inputs:
      - to_otlp
    protocol:
      type: http
      uri: http://<signoz-host>:4318/v1/logs
      method: post
      encoding:
        codec: otlp

Replace <signoz-host> with the hostname or IP of your SigNoz instance.

The opentelemetry sink sends logs over OTLP HTTP to your SigNoz collector on port 4318. The remap transform above shapes each log event into the OTLP resourceLogs structure before the sink serializes it.

Step 3: Restart Vector

sudo systemctl restart vector

Verify Vector is running:

sudo systemctl status vector

Step 1: Install the Vector Helm chart

Deploy Vector using the official Vector Helm chart. Set role: Agent to run Vector as a DaemonSet so every node collects logs. Define the full pipeline in customConfig.

Add the Vector Helm repo and install the chart:

helm repo add vector https://helm.vector.dev
helm repo update

Step 2: Configure Vector

Create a values.yaml file with customConfig for the Vector configuration:

values.yaml
role: Agent

customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 127.0.0.1:8686
    playground: false
  sources:
    kubernetes_logs:
      type: kubernetes_logs
  transforms:
    to_otlp:
      type: remap
      inputs:
        - kubernetes_logs
      source: |
        msg = del(.message)
        ts  = del(.timestamp)
        . = {
          "resourceLogs": [{
            "resource": {
              "attributes": [
                {"key": "k8s.pod.name",       "value": {"stringValue": del(.kubernetes.pod_name) || ""}},
                {"key": "k8s.namespace.name",  "value": {"stringValue": del(.kubernetes.pod_namespace) || ""}},
                {"key": "k8s.container.name",  "value": {"stringValue": del(.kubernetes.container_name) || ""}},
                {"key": "k8s.node.name",       "value": {"stringValue": del(.kubernetes.pod_node_name) || ""}}
              ]
            },
            "scopeLogs": [{
              "logRecords": [{
                "timeUnixNano": to_string(to_unix_timestamp!(ts, unit: "nanoseconds")),
                "body": {"stringValue": msg},
                "attributes": [
                  {"key": "stream",      "value": {"stringValue": del(.stream) || ""}},
                  {"key": "source_type", "value": {"stringValue": del(.source_type) || ""}}
                ]
              }]
            }]
          }]
        }
  sinks:
    signoz_sink:
      type: opentelemetry
      inputs:
        - to_otlp
      protocol:
        type: http
        uri: http://<signoz-host>:4318/v1/logs
        method: post
        encoding:
          codec: otlp

service:
  enabled: false

serviceHeadless:
  enabled: false

Replace <signoz-host> with the hostname or IP of your SigNoz instance.

Step 3: Apply Configuration

helm install vector vector/vector \
  --namespace vector \
  --create-namespace \
  --values values.yaml

Step 1: Create Vector Configuration

Create a vector.yaml file:

vector.yaml
sources:
  docker_logs:
    type: docker_logs

transforms:
  to_otlp:
    type: remap
    inputs:
      - docker_logs
    source: |
      msg = del(.message)
      ts  = del(.timestamp)
      . = {
        "resourceLogs": [{
          "resource": {
            "attributes": [
              {"key": "container.name",       "value": {"stringValue": del(.container_name) || ""}},
              {"key": "container.image.name", "value": {"stringValue": del(.image) || ""}},
              {"key": "container.id",         "value": {"stringValue": del(.container_id) || ""}}
            ]
          },
          "scopeLogs": [{
            "logRecords": [{
              "timeUnixNano": to_string(to_unix_timestamp!(ts, unit: "nanoseconds")),
              "body": {"stringValue": msg},
              "attributes": [
                {"key": "stream",      "value": {"stringValue": del(.stream) || ""}},
                {"key": "source_type", "value": {"stringValue": del(.source_type) || ""}}
              ]
            }]
          }]
        }]
      }

sinks:
  signoz_sink:
    type: opentelemetry
    inputs:
      - to_otlp
    protocol:
      type: http
      uri: http://<signoz-host>:4318/v1/logs
      method: post
      encoding:
        codec: otlp

Replace <signoz-host> with the hostname or IP of your SigNoz instance.

Step 2: Run Vector Container

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/lib/docker:/var/lib/docker:ro \
  -v $(pwd)/vector.yaml:/etc/vector/vector.yaml \
  --name vector \
  timberio/vector:0.54.0-debian

This documentation was tested with Vector 0.54.0-debian. As opentelemetry sink is in beta, other versions may work but are not actively tested.

Log Mapping for SigNoz

SigNoz expects logs in a specific JSON format. You can either transform logs at the Vector level or use SigNoz pipelines later.

Supported Fields

FieldTypeDescription
timestampint64Nanoseconds since Unix epoch (e.g., 1704061984975797000)
bodystringLog message (also accepts message)
trace_idstring32-character hex string
span_idstring16-character hex string
trace_flagsintInteger (0 or 1 for sampled)
severity_textstringLog level: TRACE, DEBUG, INFO, WARN, ERROR, FATAL
severity_numberintOTel severity number: TRACE=1-4, DEBUG=5-8, INFO=9-12, WARN=13-16, ERROR=17-20, FATAL=21-24
attributesobjectCustom attributes
resourcesobjectResource attributes

Example

{
  "timestamp": 1704061984975797000,
  "body": "Request processed successfully",
  "trace_id": "000000000000000018c51935df0b93b9",
  "span_id": "18c51935df0b93b9",
  "trace_flags": 0,
  "severity_text": "info",
  "severity_number": 9,
  "attributes": {
    "method": "GET",
    "path": "/api/users"
  },
  "resources": {
    "host": "myhost",
    "namespace": "prod"
  }
}

Note: Any fields not in this schema are automatically added to log attributes.

Self-Hosted

The Vector remap transform in the config above already maps fields to OTel format. Resource attributes (like host.name, k8s.pod.name) follow OTel semantic conventions.

Validate

After configuring Vector, navigate to Logs → Logs Explorer in SigNoz. You should see incoming log entries within a few minutes. Filter by source_type to confirm the logs are from Vector.

Vector logs in SigNoz Logs Explorer
Vector logs in SigNoz Logs Explorer

For more details on querying logs, see the Logs Explorer documentation.

Setup OpenTelemetry Collector (Optional)

What is the OpenTelemetry Collector?

Think of the OTel Collector as a middleman between your app and SigNoz. Instead of your application sending data directly to SigNoz, it sends everything to the Collector first, which then forwards it along.

Why use it?

  • Cleaning up data — Filter out noisy traces you don't care about, or remove sensitive info before it leaves your servers.
  • Keeping your app lightweight — Let the Collector handle batching, retries, and compression instead of your application code.
  • Adding context automatically — The Collector can tag your data with useful info like which Kubernetes pod or cloud region it came from.
  • Future flexibility — Want to send data to multiple backends later? The Collector makes that easy without changing your app.

See Switch from direct export to Collector for step-by-step instructions to convert your setup.

For more details, see Why use the OpenTelemetry Collector? and the Collector configuration guide.

Troubleshooting

Logs are not appearing in SigNoz

  • Symptom: No log entries in Logs Explorer after configuring Vector.
  • Likely cause: Vector is not running, or endpoint/key is misconfigured.
  • Fix:
    1. Check Vector status: sudo systemctl status vector (VM) or docker ps (Docker)
    2. Check Vector logs: sudo journalctl -u vector -f (VM) or docker logs vector (Docker)
    3. Verify endpoint and credentials (see below)
  • Verify: After fixing, confirm new logs appear in Logs → Logs Explorer within a few minutes.

Endpoint and credentials check:

  • Cloud: https://ingest.<region>.signoz.cloud/logs/vector with valid <your-ingestion-key>
  • Self-Hosted: http://<signoz-host>:4318/v1/logs with collector reachable on port 4318
  • Ensure no firewall is blocking the connection.

Self-Hosted: OTLP serialization error

If Vector logs show:

Failed serializing frame. error=Log event does not contain OTLP top-level fields (resourceLogs or resourceMetrics)

The remap transform is missing or its inputs field does not match the source name. Verify the transform's inputs matches the source component ID in your config.

Vector configuration validation

Validate your Vector configuration before restarting:

vector validate --config-yaml /etc/vector/vector.yaml

Next Steps

  • Log Query/Filtering guides
  • Alerts setup for logs
  • Log Pipelines for processing and transforming logs

Get Help

If you need help with the steps in this topic, please reach out to us on SigNoz Community Slack.

If you are a SigNoz Cloud user, please use in product chat support located at the bottom right corner of your SigNoz instance or contact us at cloud-support@signoz.io.

Last updated: May 4, 2026

Edit on GitHub

Was this page helpful?

Your response helps us improve this page.

Prev
Tomcat
Next
Working with Log Explorer
On this page
Overview
Prerequisites
Configure Vector
Step 1: Install Vector
Step 2: Configure Vector
Step 3: Restart Vector
Step 1: Install the Vector Helm chart
Step 2: Configure Vector
Step 3: Apply Configuration
Step 1: Create Vector Configuration
Step 2: Run Vector Container
Step 1: Install Vector
Step 2: Configure Vector
Step 3: Restart Vector
Step 1: Install the Vector Helm chart
Step 2: Configure Vector
Step 3: Apply Configuration
Step 1: Create Vector Configuration
Step 2: Run Vector Container
Log Mapping for SigNoz
Supported Fields
Example
Self-Hosted
Validate
Setup OpenTelemetry Collector (Optional)
What is the OpenTelemetry Collector?
Why use it?
Troubleshooting
Logs are not appearing in SigNoz
Self-Hosted: OTLP serialization error
Vector configuration validation
Next Steps
Get Help

Is this page helpful?

Your response helps us improve this page.