Ship logs with Vector to UptimeEye

curl --proto '=https' --tlsv1.2 -sSfL https://sh.vector.dev | bash
# or: apt/yum packages and Docker images at vector.dev/docs/setup/installation/

# The ingest key is read from /etc/vector/secrets/key through Vector's
# secret backend; ${ENV} placeholders are not expanded in the config.
secret:
  local:
    type: directory
    path: /etc/vector/secrets

sources:
  app_files:
    type: file
    include: [/var/log/myapp/*.log]
    ignore_older_secs: 86400
  journal:
    type: journald
    include_units: [nginx.service, postgresql.service]

transforms:
  enrich:
    type: remap
    inputs: [app_files, journal]
    source: |
      .host = get_hostname!()
      .env  = "prod"
      # files: service from the path; journald: from the unit
      if exists(.file) { .service = replace(basename!(string!(.file)), r'\.log$', "") }
      if exists(._SYSTEMD_UNIT) { .service = replace(string!(._SYSTEMD_UNIT), ".service", "") }
      parsed, err = parse_json(string!(.message))
      if err == null { . = merge(., parsed) }

sinks:
  uptimeeye:
    type: elasticsearch
    inputs: [enrich]
    endpoints: ["https://logs.uptimeeye.com/v1/ingest/elasticsearch/"]
    api_version: v8
    compression: gzip
    healthcheck: { enabled: false }
    request:
      headers:
        Authorization: "Bearer SECRET[local.key]"
    query:
      _msg_field: message
      _time_field: timestamp
      _stream_fields: service,host,env
    buffer:
      type: disk
      max_size: 268435488
      when_full: block

install -d -m 700 -o vector /etc/vector/secrets
printf '%s' 'ue_ingest_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' > /etc/vector/secrets/key
chown vector /etc/vector/secrets/key && chmod 600 /etc/vector/secrets/key
vector validate /etc/vector/vector.yaml
systemctl enable --now vector
vector top   # live view of events per component