Modern applications generate tons of logs. Efficient log collection, transformation, and forwarding are essential — and that’s where Vector comes in. This blog walks you through setting up Vector inside Docker to collect logs from containers and ship them to a destination like a file or Elasticsearch.
What is Vector?
Vector is a high-performance observability data pipeline that allows you to collect logs, transform them, and send them anywhere — all with minimal resource usage.
Key features:
- Lightweight and fast (written in Rust)
- Works with logs and metrics
- Can run as an agent (on each host) or aggregator (central collector)
Why Use Vector with Docker?
- Automatically collect container logs
- Easily scale in containerized environments
- Consistent logging configuration for all containers
Setup: Vector with Docker
Step 1: Create vector.toml Configuration
# vector.toml
[sources.docker_logs]
type = "docker_logs"
[transforms.json_parser]
type = "remap"
inputs = ["docker_logs"]
source = '''
structured = parse_json!(.message) ?? {}
'''
[sinks.console]
type = "console"
inputs = ["json_parser"]
encoding.codec = "json"This config:
- Pulls logs from Docker containers
- Parses JSON if present
- Prints logs to the console (you can change this to a file, Elasticsearch, etc.)
Step 2: Run Vector in Docker
docker run -d --name vector \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $(pwd)/vector.toml:/etc/vector/vector.toml:ro \
timberio/vector:latest
docker.sock allows Vector to collect logs from running containers.
The vector.toml file is mounted as read-only into the container.
Test It Out
Spin up another container that generates logs:
docker run --rm busybox sh -c "while true; do echo '{\"message\":\"Hello from BusyBox\"}'; sleep 1; done"
Now check the logs:
docker logs -f vectorYou should see structured JSON logs!
Real-World Sink Options
You can replace the console sink with:
file— Store logs on diskelasticsearch— Forward logs for search & analyticskafkaorclickhouse— For big data pipelines
Conclusion
Vector + Docker is a powerful combo for scalable, lightweight log collection and processing. You can extend this setup with transforms, multiple sinks, and even metrics collection.