spoo/vector.toml at main · spoo-me/spoo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# Vector config: docker logs → Axiom logs dataset
#                Redis prometheus metrics → Axiom metrics dataset

# Enable Vector's API server so the container's healthcheck can hit
# /health. Bound to localhost only — never exposed outside the container.
[api]
enabled = true
address = "127.0.0.1:8686"

# ─────────────────────────────────────────────────────────────────────
# LOGS pipeline
# ─────────────────────────────────────────────────────────────────────

[sources.docker]
type = "docker_logs"
include_containers = ["spoo_app", "spoo_qr"]
exclude_containers = ["spoo_vector", "spoo_redis_exporter"]

[transforms.parse_and_clean]
type = "remap"
inputs = ["docker"]
# Tag service name + lift structlog JSON without dropping bad events.
# parse_json !! null falls back to null on error (no panic).
source = '''
.service = .container_name

if .container_name == "spoo_app" || .container_name == "spoo_qr" {
    parsed = parse_json(.message) ?? null
    if parsed != null && is_object(parsed) {
        . = merge(., object!(parsed))
        del(.message)
    }
}

# Strip docker-injected metadata noise (kept the event no matter what).
del(.label)
del(.image)
del(.host)
del(.container_id)
del(.container_created_at)
del(.source_type)
del(.stream)
'''

[transforms.drop_health]
type = "filter"
inputs = ["parse_and_clean"]
condition = '''
!(exists(.http_path) && .http_path == "/health")
'''

[sinks.axiom_logs]
type = "axiom"
inputs = ["drop_health"]
token = "${AXIOM_TOKEN}"
dataset = "${AXIOM_DATASET}"

[sinks.axiom_logs.healthcheck]
enabled = true

# ─────────────────────────────────────────────────────────────────────
# REDIS METRICS pipeline (scrape redis-exporter every 15s, ship to Axiom)
# ─────────────────────────────────────────────────────────────────────

[sources.redis_metrics]
type = "prometheus_scrape"
endpoints = ["http://redis-exporter:9121/metrics"]
scrape_interval_secs = 15

[transforms.metrics_to_log]
type = "metric_to_log"
inputs = ["redis_metrics"]
host_tag = "host"

[transforms.tag_metrics]
type = "remap"
inputs = ["metrics_to_log"]
source = '''
.service = "redis"
.source_kind = "metrics"
'''

[sinks.axiom_metrics]
type = "axiom"
inputs = ["tag_metrics"]
token = "${AXIOM_TOKEN}"
dataset = "${AXIOM_METRICS_DATASET}"

[sinks.axiom_metrics.healthcheck]
enabled = true