SupportConsoleDevelopersStart a trialContact

Chapter 2. Vector collector

Vector is the high-performance log collection engine in OpenShift Logging. Introduced in OpenShift Logging 6.0 as the replacement for Fluentd, Vector collects logs from all pods and containers, transforms the data, and forwards it to configured destinations.

2.1. What Vector does
Copy link

Vector is a high-performance observability data pipeline written in Rust. In OpenShift Logging, Vector serves as the log collector that runs on every node in your cluster.

Vector’s primary functions:

Collects logs
Vector runs as a DaemonSet with one pod on each node. It collects logs from all containers running on that node, including application logs, infrastructure logs, and audit logs.
Transforms log data
Vector can parse, filter, and enrich log data before forwarding. This includes extracting structured fields from JSON logs, adding Kubernetes metadata (namespace, pod name, labels), and filtering out unwanted log entries.
Routes to destinations
Vector forwards logs to one or more destinations based on your configuration. You can send logs to a local Loki instance, external log platforms such as Splunk or CloudWatch, or both simultaneously.

2.2. Vector architecture in OpenShift
Copy link

Vector is deployed as a DaemonSet in the openshift-logging namespace. This deployment pattern ensures that every node in your cluster has a Vector pod collecting logs from that node’s containers.

The Vector collector:

  • Reads container logs from /var/log/pods/ on each node
  • Automatically discovers new pods and containers as they are created
  • Extracts Kubernetes metadata from the pod specifications
  • Processes logs according to the ClusterLogForwarder configuration
  • Forwards processed logs to configured outputs

2.3. Vector in OpenShift Logging 6.0 and later
Copy link

Vector became the default log collector starting with OpenShift Logging 6.0, replacing Fluentd, which was used in Logging 5.x releases. The transition to Vector provides:

  • High performance with low resource consumption due to Rust implementation
  • Built-in support for logs and metrics in a single pipeline
  • Vector Remap Language (VRL) for powerful log transformation
  • Better backpressure handling and retry mechanisms
  • Unified configuration model

If you are using OpenShift Logging 6.0 or later, you are using Vector as your log collector.

2.4. Vector configuration
Copy link

Vector is configured through the ClusterLogForwarder custom resource (CR), which is managed by the Red Hat OpenShift Logging Operator. The ClusterLogForwarder CR defines:

  • Inputs: Which logs to collect (application, infrastructure, or audit)
  • Filters: How to transform or filter log data
  • Outputs: Where to send logs (Loki, CloudWatch, Splunk, Kafka, or other destinations)
  • Pipelines: How inputs, filters, and outputs connect together

You do not configure Vector directly. Instead, the Logging Operator reads your ClusterLogForwarder CR and generates the appropriate Vector configuration.

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top