Vector transforms

vector.toml transforms.parse_log

Configures Vector (Datadog's log pipeline) transformations to parse, enrich, and normalize events before sending them to the SIEM.

Use it when you need to normalize logs at the edge of the pipeline: Vector collects from sources (files, journald, syslog, Docker), and the transforms parse raw messages into structured fields, add context (geoip, hostname), or discard what's extra — before the event reaches the destination (Elastic, Loki, Kafka, Datadog). The parse_log transform is the one that turns a log line into JSON with fields: without it, the SIEM receives text and field-based searches don't work. It's the data quality piece that decides whether SIEM detections see anything.

Don't use it without knowing your log format: a parse_log with the wrong pattern generates empty fields or partial parses that poison searches — validate each transform with real data (vector vrl playground) before deploying. Poorly designed transforms (catastrophic regex, too many fields) consume agent CPU on high-volume hosts. And watch out for pipeline order: transform → sink is the flow, but a failing remap (VRL with error) silently drops the event — configure agent error logs to see them. Vector is powerful, but each added stage is a failure point in the log chain.