Vector (by Datadog)
High-performance observability data pipeline tool (Rust-based) for collecting, transforming, and routing logs, metrics, and traces.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Secrets for sink credentials should use environment variables or secret backends — never hardcode in vector.toml.
⚡ Reliability
Best When
Best for complex multi-source/multi-sink log pipelines that need transformation, enrichment, and cost optimization.
Avoid When
Avoid when simple log forwarding without transformation is needed — Fluentd or Fluent Bit are simpler.
Use Cases
- • Build agent log pipelines that transform, enrich, and route to multiple sinks (S3, Elasticsearch, Datadog)
- • Reduce logging costs by filtering and sampling logs before they reach expensive SaaS destinations
- • Parse unstructured log formats using Vector's VRL (Vector Remap Language) before indexing
- • Aggregate metrics from multiple sources and convert between formats (StatsD to Prometheus)
- • Fan-out single log stream to multiple destinations with different filtering per sink
Not For
- • Full SIEM or log analytics — Vector is a pipeline tool, not a search/visualization platform
- • Simple one-hop log forwarding where Fluent Bit's lighter footprint is sufficient
- • Teams without configuration expertise — Vector's TOML config is powerful but complex
Interface
Authentication
Vector itself has no auth for its API (enable with caution). Auth is configured per sink destination.
Pricing
MPL 2.0 licensed. Used by Datadog internally and open source since 2019.
Agent Metadata
Known Gotchas
- ⚠ VRL (Vector Remap Language) is a domain-specific language — Python/JavaScript knowledge doesn't transfer directly
- ⚠ Source-to-sink data type mismatches cause silent drops — enable logging and validate schema with vector test before deployment
- ⚠ Buffer types matter: in-memory buffers lose data on crash; disk buffers add latency but are crash-safe — choose based on requirements
- ⚠ Vector's API endpoint is unauthenticated by default — never expose it to the internet without network-level access control
- ⚠ Hot-reload (SIGHUP) reloads config without restart but some changes (topology changes) require full restart to take effect
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Vector (by Datadog).
Scores are editorial opinions as of 2026-03-06.