Data Model

Event

All payloads passing through Vector are known as an "event", which is a generalized type. In practice an event is either a log or metric at any given moment, depending on how it was consumed and how it has been transformed by Vector.

Whether a transform or sink can work with a log, metric or both depends on the individual component and is made clear in it's documentation.

Log

Metric

FAQ

Why Not Just Events?

People change, why can't event types?

We like the idea of unifying observability tools under a single event type a lot, but we also want to play nice with existing tooling, which unfortunately are currently at odds.

By starting simple (from an integration perspective) and evolving our data model as we encounter the specific needs of new sources/sinks/transforms, we hope to be both pragmatic and flexible as the industry evolves.