VictoriaMetrics Vector

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
API	Application Programming Interface	应用程序编程接口
CPU	Central Processing Unit	中央处理器
URL	Uniform Resource Locator	统一资源定位符，通常指访问地址
VRL	Vector Remap Language	Vector 事件转换语言

1. Important Points#

这里的 Vector 指 Datadog Vector，不是 PromQL 里的 vector 类型。它是 observability pipeline agent，可以收集 metrics / logs / traces，再转发到不同后端。

只需要 Prometheus scrape + remote_write 时优先评估 vmagent；需要日志/事件变换与多目的地路由时再评估 Vector，避免重复采集。

Vector -> VictoriaMetrics:
    source collects metrics
    optional transform filters / rewrites data
    prometheus_remote_write sink writes to VictoriaMetrics

use for:
    host metrics collection: 
        can collect basic host metrics, but not a full default replacement for node_exporter
    scrape Prometheus exporters:
        Vector 可以去访问已经暴露了 Prometheus 格式 /metrics 的服务，然后把这些 metrics 再转发到 VictoriaMetrics
        它不是替代这些 exporter，而是代替 Prometheus/vmagent 去 scrape 它们
    one agent sends metrics to VictoriaMetrics and logs to VictoriaLogs
    edge buffering / routing / transform before ingest

do not confuse with:
    vmagent: VictoriaMetrics native scrape + remote_write agent
    MetricsQL vector: query result data type

简单判断：

only Prometheus scrape + remote_write:
    vmagent is usually simpler

metrics + logs + transform + multiple sinks:
    Vector can be useful

2. Data Flow#

host / exporter / app
    -> Vector source
        -> optional transform
            -> prometheus_remote_write sink
                -> VictoriaMetrics /api/v1/write

常见 source：

Source	Use For
`host_metrics`	host CPU / memory / disk / network metrics
`prometheus_scrape`	scrape node_exporter / app `/metrics` / other exporters
`internal_metrics`	Vector self metrics
`journald`	logs, usually sent to VictoriaLogs instead of VictoriaMetrics

VictoriaMetrics sink：

Sink	Use For
`prometheus_remote_write`	send metrics to VictoriaMetrics remote write endpoint

3. How To Choose type#

Vector 配置里的 type 不是随便写的名字，而是 Vector component 类型。先判断这个 block 是 sources、transforms 还是 sinks，再去选对应 component 的 type。

sources:
    从哪里读数据
    type 选择 input 类型

transforms:
    中间如何处理数据
    type 选择处理方式

sinks:
    输出到哪里
    type 选择 output 类型

本文用到的 type：

Block	type	Meaning
`sources`	`prometheus_scrape`	scrape Prometheus 格式 `/metrics`，例如 process_exporter
`sources`	`file`	tail 本机文件日志，例如 nginx / Node.js log
`transforms`	`remap`	用 VRL 脚本解析、改字段、加字段
`sinks`	`prometheus_remote_write`	用 Prometheus remote_write 协议写 metrics 到 VictoriaMetrics
`sinks`	`elasticsearch`	用 Elasticsearch bulk API 写 logs 到 VictoriaLogs

配置时可以按这个顺序选：

我要读什么:
    /metrics endpoint -> sources type: prometheus_scrape
    local log file -> sources type: file

我要怎么处理:
    parse text / add source / normalize fields -> transforms type: remap

我要写到哪里:
    VictoriaMetrics metrics -> sinks type: prometheus_remote_write
    VictoriaLogs logs -> sinks type: elasticsearch

注意 inputs 写的是上游 component name，不是 type。例如 inputs: [nodejs_access_log] 表示接收 sources.nodejs_access_log 的输出。

4. remap / VRL Notes#

type: remap 表示这个 transform 会执行一段 VRL 脚本。这里的 source: |- 是 remap transform 的脚本内容，不是日志来源。

例子：

parsed = parse_regex(.message, r'^(?P<level>\w+)\((?P<pid>\d+)\)\s+(?P<trace_id>\S+)') ?? {}
. = merge(., parsed)
.source = "nodejs_access"

解释：

.message:
    当前 log event 的原始日志内容

parse_regex(.message, r'...'):
    用 regex 解析 .message
    (?P<level>\w+) 这种 named capture group 会变成字段 level
    (?P<pid>\d+) 会变成字段 pid
    (?P<trace_id>\S+) 会变成字段 trace_id

?? {}:
    如果 parse_regex 失败，就用空 object {}
    避免一行解析失败导致 transform 报错中断

parsed:
    保存解析出来的字段 object

merge(., parsed):
    把 parsed 里的字段合并回当前 event 根对象
    这样日志进入 VictoriaLogs 后可以按 level / pid / trace_id 查询

.source = "nodejs_access":
    手动注入 source 字段
    用来区分日志来自 nginx、nodejs_pipe 还是 nodejs_access

简单理解：

before:
    .message = "info(437747) 8f89f1b8... Jan-13-2026 00:00:07 access_request method:GET url:/health payload:{}"

after parse_regex + merge:
    .level = "info"
    .pid = "437747"
    .trace_id = "8f89f1b8-1b56-44e2-92fb-41c6d86e6b99"
    .event = "access_request"
    .method = "GET"
    .url = "/health"
    .source = "nodejs_access"

5. Full Config Example#

单机 VictoriaMetrics 默认 remote write endpoint：http://<victoriametrics>:8428/api/v1/write。VictoriaLogs 常用 Elasticsearch-compatible ingest endpoint：http://<victorialogs>:9428/insert/elasticsearch/。

这个例子做三件事：

metrics:
    Vector scrape process_exporter /metrics
    Vector remote_write to VictoriaMetrics
    注意: Vector 不是替代 process_exporter，而是代替 Prometheus / vmagent 去 scrape process_exporter

logs:
    read local nginx access log
    read two local Node.js text log files
    transform 时注入 source 字段
    write to VictoriaLogs through elasticsearch sink

Node.js text log 例子：

2026-01-13T07:03:23.847Z | info | [539578] | 2bd42150-7bf5-435a-abba-2b027d45669e | ctx.headers.authorization: Bearer..
info(437747) 8f89f1b8-1b56-44e2-92fb-41c6d86e6b99 Jan-13-2026 00:00:07 access_request method:GET url:/health payload:{}

# /etc/vector/vector.yaml
sources:
  process_exporter_metrics:
    type: prometheus_scrape
    endpoints:
      - "http://127.0.0.1:9256/metrics"

  nginx_access_log:
    type: file
    include:
      - /var/log/nginx/access.log

  nodejs_pipe_log:
    type: file
    include:
      - /var/log/nodejs/pipe.log

  nodejs_access_log:
    type: file
    include:
      - /var/log/nodejs/access.log

transforms:
  nginx_access_log_normalized:
    type: remap
    inputs:
      - nginx_access_log
    source: |-
      parsed = parse_nginx_log(.message, "combined") ?? {}
      . = merge(., parsed)
      .source = "nginx"
      .log_type = "access"

  nodejs_pipe_log_normalized:
    type: remap
    inputs:
      - nodejs_pipe_log
    source: |-
      parsed = parse_regex(.message, r'^(?P<timestamp>[^|]+)\s+\|\s+(?P<level>[^|]+)\s+\|\s+\[(?P<pid>\d+)\]\s+\|\s+(?P<trace_id>[^|]+)\s+\|\s+(?P<message_text>.*)$') ?? {}
      . = merge(., parsed)
      .source = "nodejs_pipe"
      .log_type = "application"

  nodejs_access_log_normalized:
    type: remap
    inputs:
      - nodejs_access_log
    source: |-
      parsed = parse_regex(.message, r'^(?P<level>\w+)\((?P<pid>\d+)\)\s+(?P<trace_id>\S+)\s+(?P<timestamp>[A-Za-z]{3}-\d{2}-\d{4}\s+\d{2}:\d{2}:\d{2})\s+(?P<event>\S+)\s+method:(?P<method>\S+)\s+url:(?P<url>\S+)\s+payload:(?P<payload>.*)$') ?? {}
      . = merge(., parsed)
      .source = "nodejs_access"
      .log_type = "application"

sinks:
  victoriametrics_metrics:
    type: prometheus_remote_write
    inputs:
      - process_exporter_metrics
    endpoint: "http://victoria-metrics:8428/api/v1/write"
    healthcheck:
      enabled: false

  victorialogs_logs:
    type: elasticsearch
    inputs:
      - nginx_access_log_normalized
      - nodejs_pipe_log_normalized
      - nodejs_access_log_normalized
    endpoints:
      - "http://victorialogs:9428/insert/elasticsearch/"
    mode: bulk

6. Authentication#

basic auth#

sinks:
  victoriametrics_sink:
    type: prometheus_remote_write
    inputs:
      - host_metrics_source
    endpoint: "https://<victoriametrics_url>/api/v1/write"
    auth:
      strategy: basic
      user: "<user>"
      password: "<password>"
    healthcheck:
      enabled: false

bearer token#

sinks:
  victoriametrics_sink:
    type: prometheus_remote_write
    inputs:
      - host_metrics_source
    endpoint: "https://<victoriametrics_url>/api/v1/write"
    auth:
      strategy: bearer
      token: "<token>"
    healthcheck:
      enabled: false

7. VictoriaMetrics Cluster#

Cluster 模式写入 vminsert，不是直接写 vmstorage。

single-node:
    http://victoria-metrics:8428/api/v1/write

cluster:
    http://vminsert:8480/insert/<accountID>/prometheus/api/v1/write

8. Validate And Run#

vector validate --config /etc/vector/vector.yaml
vector --config /etc/vector/vector.yaml

写入后用 VictoriaMetrics 查：

curl "http://victoria-metrics:8428/api/v1/query?query=up"
curl "http://victoria-metrics:8428/api/v1/label/__name__/values" | head

9. Common Pitfalls#

wrong endpoint path:
    VictoriaMetrics remote write path is /api/v1/write for single-node
    cluster writes to vminsert /insert/<accountID>/prometheus/api/v1/write

using Vector when vmagent is enough:
    if only scrape + remote_write, vmagent is usually simpler and more native

high cardinality:
    avoid user_id / request_id / full URL / dynamic labels

healthcheck confusion:
    official examples often disable sink healthcheck for VictoriaMetrics remote write

logs and metrics mixed up:
    prometheus_remote_write sink is for metrics
    logs should go to VictoriaLogs or another log backend

10. References#

VictoriaMetrics Vector ingestion: https://docs.victoriametrics.com/victoriametrics/data-ingestion/vector/
Vector prometheus_remote_write sink: https://vector.dev/docs/reference/configuration/sinks/prometheus_remote_write/
Vector components: https://vector.dev/docs/reference/configuration/
Vector Remap Language: https://vector.dev/docs/reference/vrl/