# Send logs and metrics to Better Stack using Vector
[info] #### Want to collect telemetry data from your Kubernetes or Docker clusters? The [Better Stack collector](https://betterstack.com/docs/logs/collector/) is the recommended way to automatically gather logs, metrics, and traces **without code changes**, using eBPF-based auto-instrumentation. [/info] ## Start logging in 2 minutes Collect logs and metrics from your server using Vector. [vector-select-platform] [vector-platform linux-apt] Install and configure [Vector](https://vector.dev/) on Ubuntu or Debian: [/vector-platform] [vector-platform linux-yum] Install and configure [Vector](https://vector.dev/) on any Red Hat-based Linux: [/vector-platform] [vector-platform macos] Install and configure [Vector](https://vector.dev/) on macOS: [/vector-platform] [vector-platform setup-script-supported] ```bash [label Set up Vector] curl -sSL https://telemetry.betterstack.com/setup-vector/ubuntu/$SOURCE_TOKEN \ -o /tmp/setup-vector.sh && \ bash /tmp/setup-vector.sh ``` [info] **Curious about what the script does?** - Installs Vector using official package. - Configures Vector for your Better Stack source. - Enables and restarts Vector. The script will ask for confirmation before making any changes. [/info] [/vector-platform] [vector-platform windows] #### Install Install [Vector](https://vector.dev/docs/setup/installation/operating-systems/windows/) on Windows using official installer: ```powershell [label Install Vector] powershell Invoke-WebRequest https://packages.timber.io/vector/latest/vector-x64.msi -OutFile vector-latest-x64.msi msiexec /i vector-latest-x64.msi ``` #### Setup Run in Powershell as administrator to download Vector config: ```powershell [label Download Vector config using Powershell] $config_yaml_path = "C:\Program Files\Vector\config\vector.yaml" $backup_path = "C:\Program Files\Vector\config\vector-backup.yaml" Move-Item -Path "$config_yaml_path" -Destination "$backup_path" $docker_present = if ((Get-Command docker -ErrorAction SilentlyContinue) -and (docker info 2>$null)) { "true" } else { "false" } Invoke-RestMethod -Uri "https://telemetry.betterstack.com/vector-yaml/ubuntu/$SOURCE_TOKEN?docker=$docker_present" | Add-Content $config_yaml_path ``` #### Run Vector Run Vector with new configuration: ```powershell [label Start Vector] & "C:\Program Files\Vector\bin\vector" --config "C:\Program Files\Vector\config\vector.yaml" ``` [/vector-platform] [vector-platform linux-other] #### Install Install [Vector](https://vector.dev/docs/setup/installation/manual/vector-installer/) using official installer: ```sh [label Install Vector] curl --proto '=https' --tlsv1.2 -sSf https://sh.vector.dev | sh -s -- -y ``` Create a [Vector service](https://www.shubhamdipt.com/blog/how-to-create-a-systemd-service-in-linux/): ```sh [label Create a Vector service] mkdir -p /etc/vector mkdir -p /var/lib/vector/ cat <<-'SERVICE' >> /etc/systemd/system/vector.service [Unit] Description=Vector Documentation=https://vector.dev After=network-online.target Requires=network-online.target [Service] User=vector Group=vector ExecStart=/root/.vector/bin/vector ExecReload=/bin/kill -HUP $MAINPID Restart=no AmbientCapabilities=CAP_NET_BIND_SERVICE EnvironmentFile=-/etc/default/vector [Install] WantedBy=multi-user.target SERVICE ``` #### Setup Download Vector configuration for your source: ```bash [label Download Vector config] CONFIG_YAML_PATH="/etc/vector/vector.yaml" BACKUP_SUFFIX=".bak-$(date +%Y%m%d%H%M%S)" mv "${CONFIG_YAML_PATH}" "${CONFIG_YAML_PATH}${BACKUP_SUFFIX}" DOCKER_PRESENT=$(command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1 && echo "true" || echo "false") curl -o "$CONFIG_YAML_PATH" \ "https://telemetry.betterstack.com/vector-yaml/ubuntu/$SOURCE_TOKEN?docker=$DOCKER_PRESENT" ``` #### Restart Vector Restart Vector to reload the configuration: ```sh [label Restart Vector] systemctl restart vector ``` [/vector-platform] You should see your logs in [Better Stack → Live tail](https://telemetry.betterstack.com/team/0/tail ";_blank"). ## Set up Vector manually **Prefer configuring Vector manually?** Follow step-by-step instructions below. ### 1. Install [vector-select-platform] [vector-platform linux-apt] Configure the [Vector](https://vector.dev/docs/setup/installation/operating-systems/ubuntu/) APT repository and install Vector: ```sh [label Install Vector] bash -c "$(curl -L https://setup.vector.dev)" apt-get install vector ``` [/vector-platform] [vector-platform linux-yum] Configure the [Vector](https://vector.dev/docs/setup/installation/operating-systems/centos/) YUM repository and install Vector: ```sh [label Install Vector] bash -c "$(curl -L https://setup.vector.dev)" yum install vector ``` [/vector-platform] [vector-platform macos] Install [Vector](https://vector.dev/docs/setup/installation/operating-systems/macos/) using Homebrew: ```sh [label Install Vector] brew tap vectordotdev/brew && brew install vector ``` [/vector-platform] [vector-platform windows] Install [Vector](https://vector.dev/docs/setup/installation/operating-systems/windows/) on Windows using official installer: ```powershell [label Install Vector] powershell Invoke-WebRequest https://packages.timber.io/vector/latest/vector-x64.msi -OutFile vector-latest-x64.msi msiexec /i vector-latest-x64.msi ``` [/vector-platform] [vector-platform linux-other] Install [Vector](https://vector.dev/docs/setup/installation/manual/vector-installer/) using official installer: ```sh [label Install Vector] curl --proto '=https' --tlsv1.2 -sSf https://sh.vector.dev | sh -s -- -y ``` Create a [Vector service](https://www.shubhamdipt.com/blog/how-to-create-a-systemd-service-in-linux/): ```sh [label Create a Vector service] mkdir -p /etc/vector mkdir -p /var/lib/vector/ cat <<-'SERVICE' >> /etc/systemd/system/vector.service [Unit] Description=Vector Documentation=https://vector.dev After=network-online.target Requires=network-online.target [Service] User=vector Group=vector ExecStart=/root/.vector/bin/vector ExecReload=/bin/kill -HUP $MAINPID Restart=no AmbientCapabilities=CAP_NET_BIND_SERVICE EnvironmentFile=-/etc/default/vector [Install] WantedBy=multi-user.target SERVICE ``` [/vector-platform] ### 2. Setup Download Vector configuration for your source, for example Ubuntu: [vector-platform linux] ```bash [label Download Vector config] CONFIG_YAML_PATH="/etc/vector/vector.yaml" BACKUP_SUFFIX=".bak-$(date +%Y%m%d%H%M%S)" mv "${CONFIG_YAML_PATH}" "${CONFIG_YAML_PATH}${BACKUP_SUFFIX}" DOCKER_PRESENT=$(command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1 && echo "true" || echo "false") curl -o "$CONFIG_YAML_PATH" \ "https://telemetry.betterstack.test/vector-yaml/ubuntu/$SOURCE_TOKEN?docker=$DOCKER_PRESENT" ``` [/vector-platform] [vector-platform macos] ```bash [label Download Vector config] CONFIG_YAML_PATH="/opt/homebrew/etc/vector/vector.yaml" BACKUP_SUFFIX=".bak-$(date +%Y%m%d%H%M%S)" mv "${CONFIG_YAML_PATH}" "${CONFIG_YAML_PATH}${BACKUP_SUFFIX}" DOCKER_PRESENT=$(command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1 && echo "true" || echo "false") curl -o "$CONFIG_YAML_PATH" \ "https://telemetry.betterstack.test/vector-yaml/ubuntu/$SOURCE_TOKEN?docker=$DOCKER_PRESENT" ``` [/vector-platform] [vector-platform windows] ```powershell [label Download Vector config using Powershell] $config_yaml_path = "C:\Program Files\Vector\config\vector.yaml" $backup_path = "C:\Program Files\Vector\config\vector-backup.yaml" Move-Item -Path "$config_yaml_path" -Destination "$backup_path" $docker_present = if ((Get-Command docker -ErrorAction SilentlyContinue) -and (docker info 2>$null)) { "true" } else { "false" } Invoke-RestMethod -Uri "https://telemetry.betterstack.test/vector-yaml/ubuntu/$SOURCE_TOKEN?docker=$docker_present" | Add-Content $config_yaml_path ``` [/vector-platform] [info] #### Want another config than for Ubuntu? Our Ubuntu config collects logs for common databases and services. Pick a different config from [available configs](#available-configs) or [set it up manually](#vector-sink-setup). [/info] ### 3. [vector-platform unix]Restart[/vector-platform][vector-platform windows]Run Vector[/vector-platform] [vector-platform unix] Restart Vector to reload the configuration: [/vector-platform] [vector-platform linux] ```sh [label Restart Vector] systemctl restart vector ``` [/vector-platform] [vector-platform macos] ```sh [label Restart Vector] brew services restart vector ``` [/vector-platform] [vector-platform windows] Run Vector with new configuration: ```powershell [label Start Vector] & "C:\Program Files\Vector\bin\vector" --config "C:\Program Files\Vector\config\vector.yaml" ``` [/vector-platform] You should see your logs in [Better Stack → Live tail](https://telemetry.betterstack.com/team/0/tail ";_blank"). ## Need help? Please let us know at hello@betterstack.com. We're happy to help! 🙏 ## Additional information ### Vector sink setup **Want to manually configure Better Stack Vector sink?** Open your Vector config in [vector-platform linux]`/etc/vector/vector.yaml`[/vector-platform][vector-platform macos]`/opt/homebrew/etc/vector/vector.yaml`[/vector-platform][vector-platform windows]`C:\Program Files\Vector\config\vector.yaml`[/vector-platform] and add Better Stack sink. It will automatically use all your [Vector sources](https://vector.dev/docs/reference/configuration/sources/) as inputs. [code-tabs] ```yaml [label vector.yaml] transforms: better_stack_transform: type: "remap" inputs: - "*" source: | .dt = del(.timestamp) sinks: better_stack: type: "http" method: "post" inputs: - "better_stack_transform" uri: "https://$INGESTING_HOST/" encoding: codec: "json" compression: "gzip" auth: strategy: "bearer" token: "$SOURCE_TOKEN" ``` ```toml [label vector.toml] [transforms.better_stack_transform] type = "remap" inputs = [ "*" ] source = ''' .dt = del(.timestamp) ''' [sinks.better_stack] type = "http" method = "post" inputs = [ "better_stack_transform" ] uri = "https://$INGESTING_HOST/" encoding.codec = "json" compression = "gzip" auth.strategy = "bearer" auth.token = "$SOURCE_TOKEN" ``` [/code-tabs] [vector-platform unix] Restart Vector to reload the configuration: [/vector-platform] [vector-platform linux] ```sh [label Restart Vector] systemctl restart vector ``` [/vector-platform] [vector-platform macos] ```sh [label Restart Vector] brew services restart vector ``` [/vector-platform] [vector-platform windows] Run Vector with new configuration: ```powershell [label Start Vector] & "C:\Program Files\Vector\bin\vector" --config "C:\Program Files\Vector\config\vector.yaml" ``` [/vector-platform] ### Filtering logs and metrics You can use Vector's [Filter transform](https://vector.dev/docs/reference/configuration/transforms/filter/) to selectively forward logs and metrics based on their content. This is useful for reducing noise, controlling costs, or isolating specific event types. [code-tabs] ```yaml [label Filter logs in vector.yaml] sources: # existing sources... transforms: # existing transforms... [highlight] my_logs_filtering: type: "filter" # As inputs, use all inputs from better_stack_http_sink_$SOURCE_TOKEN inputs: ["better_stack_nginx_parser_$SOURCE_TOKEN", ...] # Here is your filtering condition in VRL condition: '.level != "debug" && .context.path != "/heath-check"' [/highlight] sinks: better_stack_http_sink_$SOURCE_TOKEN: # ... [highlight] inputs: ["my_logs_filtering"] [/highlight] better_stack_http_metrics_sink_$SOURCE_TOKEN: # ... ``` ```yaml [label Filter metrics in vector.yaml] sources: # existing sources... transforms: # existing transforms... [highlight] my_metrics_filtering: type: "filter" # As inputs, use all inputs from better_stack_http_metrics_sink_$SOURCE_TOKEN inputs: ["better_stack_apache_metrics_parser_$SOURCE_TOKEN", ...] # Here is your filtering condition in VRL condition: 'includes(["cpu_ratio", "memory_usage"], .name) && .tags.namespace = "production"' [/highlight] sinks: better_stack_http_sink_$SOURCE_TOKEN: # ... better_stack_http_metrics_sink_$SOURCE_TOKEN: # ... [highlight] inputs: ["my_metrics_filtering"] [/highlight] ``` [/code-tabs] [vector-platform unix] Restart Vector to reload the configuration: [/vector-platform] [vector-platform linux] ```sh [label Restart Vector] systemctl restart vector ``` [/vector-platform] [vector-platform macos] ```sh [label Restart Vector] brew services restart vector ``` [/vector-platform] [vector-platform windows] Run Vector with new configuration: ```powershell [label Start Vector] & "C:\Program Files\Vector\bin\vector" --config "C:\Program Files\Vector\config\vector.yaml" ``` [/vector-platform] ### Available configs We provide ready-to-use Vector configs for databases, web servers, and other services. Download any config we provide from URLs listed below: [code-tabs] ```bash [label DBs] https://telemetry.betterstack.com/vector-yaml/elasticsearch/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/elasticsearch_with_metrics/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/mongodb/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/mysql/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/mysql_with_metrics/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/postgresql/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/postgresql_with_metrics/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/redis/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/redis_with_metrics/$SOURCE_TOKEN ``` ```bash [label Queues] https://telemetry.betterstack.com/vector-yaml/rabbitmq/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/rabbitmq_with_metrics/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/redis/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/redis_with_metrics/$SOURCE_TOKEN ``` ```bash [label Webservers] https://telemetry.betterstack.com/vector-yaml/apache/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/nginx/$SOURCE_TOKEN ``` ```bash [label Proxies] https://telemetry.betterstack.com/vector-yaml/haproxy/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/traefik/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/traefik_with_metrics/$SOURCE_TOKEN ``` ```bash [label System] https://telemetry.betterstack.com/vector-yaml/auth_log/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/docker/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/kubernetes/$SOURCE_TOKEN https://telemetry.betterstack.com/vector-yaml/ubuntu/$SOURCE_TOKEN?docker=true https://telemetry.betterstack.com/vector-yaml/ubuntu/$SOURCE_TOKEN?docker=false https://telemetry.betterstack.com/vector-yaml/ufw/$SOURCE_TOKEN ``` [/code-tabs]