Syslog over HTTP with Vector

Use timberio/vector:0.46.1-debian. Set EPOK_INGEST_KEY in its process environment and make /var/lib/vector writable. Point your RFC5424 sender at the Vector TCP listener on port 1514 using newline-delimited messages. Vector forwards the original RFC5424 or RFC3164 envelope as HTTP text with X-API-Key, preserving the priority, app name and message for Epok to parse.

Configuration

yaml

data_dir: /var/lib/vector
sources:
  syslog:
    type: socket
    address: 0.0.0.0:1514
    mode: tcp
    decoding:
      codec: bytes
    framing:
      method: newline_delimited
sinks:
  epok:
    type: http
    inputs: [syslog]
    uri: https://ingest.getepok.dev/api/v1/syslog
    method: post
    encoding:
      codec: text
    framing:
      method: newline_delimited
    request:
      headers:
        Content-Type: text/plain
        X-API-Key: ${EPOK_INGEST_KEY}
    batch:
      timeout_secs: 1
    healthcheck:
      enabled: false

Keep your ingest key private. Missing keys return 401; unknown keys return 403. A successful HTTP response alone is not proof of stored data.

Real-agent acceptance

The rig sends a unique RFC5424 message to the real Vector TCP source and requires the exact message and service p2-syslog in the seeded workspace and project. Real-agent acceptance is pending the coordinator run. The HTTP endpoint is not a raw TCP or UDP syslog listener.

From a source checkout with Docker Compose, run the isolated acceptance rig. It uses a fresh key and run marker, publishes no host ports, and removes its stack on exit. Every required stored-data check must pass.

bash

scripts/p2_agent_acceptance.sh

Vector JSON logs · All install guides