Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.sawmills.ai/llms.txt

Use this file to discover all available pages before exploring further.

This guide explains how to send logs from Vector to the Sawmills Collector. It uses the OTLP source in Sawmills and the opentelemetry sink in Vector. For instructions on configuring external access to the Sawmills Collector, see Configure the Sawmills Collector for External Access.

​
Prerequisites

  • Vector is already collecting the logs you want to send.
  • The Sawmills Collector is deployed and reachable from the machine or cluster where Vector is running.
  • An OTLP source is configured in Sawmills.
  • You know the hostname and port of the Sawmills Collector endpoint.

​
Supported Data Types

Data TypeSupportedNotes
LogsYesRecommended protocol for this guide
MetricsNoThis guide covers logs only
TracesNoThis guide covers logs only
This guide is for logs only. If you want to send metrics or traces from Vector, use a different Sawmills source such as OTLP.
The clearest setup is:
  • Sawmills source: OTLP Source
  • Vector sink: opentelemetry
  • Protocol: OTLP over HTTP
This gives you the standard OTLP path and avoids the TCP receiver path.

​
What You Need to Change in Vector

Add a new sink that sends logs to Sawmills, or update an existing sink if you want Sawmills to become the only destination. These are the fields that matter:
  • type: opentelemetry
  • inputs: the source or transform that already contains your logs
  • protocol.type: http
  • protocol.uri: your Sawmills OTLP HTTP endpoint
  • protocol.encoding.codec: otlp
Optional:
  • use https:// in protocol.uri if your Sawmills endpoint expects TLS
In Sawmills, the default HTTP port for the OTLP Source is 4318 unless you changed it.

​
Sawmills Configuration

Before changing Vector, make sure Sawmills has an OTLP source with HTTP enabled, listening on the address and port you plan to use. If your Vector instance is outside the Kubernetes cluster, use the externally exposed hostname and port instead of the internal service address.

​
Vector Configuration Options

  • Option 1: Send logs only to Sawmills
  • Option 2: Send logs to both the current destination and Sawmills

​
Option 1: Send Logs Only to Sawmills

Use this when Sawmills should be the only destination for these logs.

​
YAML Example

sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: http://sawmills-collector.sawmills.svc.cluster.local:4318/v1/logs
      encoding:
        codec: otlp

​
TOML Example

[sinks.sawmills_logs]
type = "opentelemetry"
inputs = ["my_logs"]

[sinks.sawmills_logs.protocol]
type = "http"
uri = "http://sawmills-collector.sawmills.svc.cluster.local:4318/v1/logs"

[sinks.sawmills_logs.protocol.encoding]
codec = "otlp"

​
What to Replace

  • Replace my_logs with the source or transform that currently feeds your log sink.
  • Replace sawmills-collector.sawmills.svc.cluster.local with your Sawmills hostname.
  • Replace 4318 with your OTLP HTTP port if it is different.

​
Option 2: Dual Shipping

Use this when you want Vector to keep sending logs to the current destination and also send a copy to Sawmills. In Vector, dual shipping usually means adding one more sink that points at the same inputs.

​
Example

If you already have a sink like this: 
sinks:
  existing_logs_sink:
    type: some_existing_sink
    inputs:
      - my_logs
Add this second sink: 
sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: http://sawmills-collector.sawmills.svc.cluster.local:4318/v1/logs
      encoding:
        codec: otlp
The important part is that both sinks use the same inputs.
If you want the smallest possible change, do not replace the existing sink. Just add sawmills_logs as a second sink.

​
TLS Configuration

If your Sawmills endpoint is exposed with TLS, use an https:// OTLP endpoint.

​
YAML Example

sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: https://logs.example.com:4318/v1/logs
      encoding:
        codec: otlp
If your environment requires custom CA certificates or stricter verification settings, configure the additional TLS options in the Vector sink accordingly.

​
Verification

After updating the Vector configuration:
  1. Restart or reload Vector.
  2. Check the Vector logs for connection or healthcheck errors.
  3. Confirm that logs appear in Sawmills.
Useful checks: 
vector validate /etc/vector/vector.yaml

journalctl -u vector -f
If Vector runs in Kubernetes, inspect the Vector pod logs instead.

​
Troubleshooting

​
No logs arriving in Sawmills

  • Confirm the Sawmills OTLP source is enabled and HTTP is listening on the expected port.
  • Confirm the protocol.uri in Vector points to the correct hostname, port, and /v1/logs path.
  • Confirm network rules allow traffic from Vector to the Sawmills endpoint.

​
Logs arrive, but fields are missing

  • Use OTLP and keep the opentelemetry sink pointed at the final log event stream you want to ship.
  • Make sure the fields you need still exist in the event before it reaches the sawmills_logs sink.

​
TLS connection fails

  • Confirm the endpoint expects HTTPS.
  • Confirm Vector has the correct CA certificates if you use a private certificate authority.
  • If your Sawmills endpoint is plain HTTP, use http://... instead of https://....

​
Vector config is valid, but the wrong logs are sent

  • Check the inputs value on the sawmills_logs sink.
  • Point it at the exact source or transform that contains the logs you want to ship.

​
Summary

To send logs from Vector to Sawmills, the only required Vector change is usually to add a sink like this: 
sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: http://sawmills-collector.sawmills.svc.cluster.local:4318/v1/logs
      encoding:
        codec: otlp
Replace only these values:
  • inputs
  • protocol.uri
  • port
  • http vs https