> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sawmills.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How to send logs from Vector

> Configure Vector to send logs to the Sawmills Collector using the OTLP source and opentelemetry sink, with single-shipping and dual-shipping examples.

This guide explains how to send logs from Vector to the Sawmills Collector.
It uses the **OTLP** source in Sawmills and the **opentelemetry** sink in Vector.

For instructions on configuring external access to the Sawmills Collector, see [Configure the Sawmills Collector for External Access](/docs/send-data-to-collector).

***

## Prerequisites

* **Vector** is already collecting the logs you want to send.
* The **Sawmills Collector** is deployed and reachable from the machine or cluster where Vector is running.
* An **OTLP** source is configured in Sawmills.
* You know the **hostname** and **port** of the Sawmills Collector endpoint.

***

## Supported Data Types

| Data Type | Supported | Notes                               |
| :-------- | :-------- | :---------------------------------- |
| Logs      | Yes       | Recommended protocol for this guide |
| Metrics   | No        | This guide covers logs only         |
| Traces    | No        | This guide covers logs only         |

<Note>
  This guide is for **logs only**. If you want to send metrics or traces from
  Vector, use a different Sawmills source such as [OTLP](/docs/source-otlp).
</Note>

***

## Recommended Setup

The clearest setup is:

* **Sawmills source**: [OTLP Source](/docs/source-otlp)
* **Vector sink**: `opentelemetry`
* **Protocol**: OTLP over HTTP

This gives you the standard OTLP path and avoids the TCP receiver path.

***

## What You Need to Change in Vector

Add a new sink that sends logs to Sawmills, or update an existing sink if you want Sawmills to become the only destination.

These are the fields that matter:

* `type: opentelemetry`
* `inputs`: the source or transform that already contains your logs
* `protocol.type: http`
* `protocol.uri`: your Sawmills OTLP HTTP endpoint
* `protocol.encoding.codec: otlp`

Optional:

* use `https://` in `protocol.uri` if your Sawmills endpoint expects TLS

<Note>
  In Sawmills, the default HTTP port for the [OTLP Source](/docs/source-otlp) is
  **4318** unless you changed it.
</Note>

***

## Sawmills Configuration

Before changing Vector, make sure Sawmills has an **OTLP** source with HTTP enabled, listening on the address and port you plan to use.

If your Vector instance is outside the Kubernetes cluster, use the externally exposed hostname and port instead of the internal service address.

***

## Vector Configuration Options

* **Option 1**: Send logs only to Sawmills
* **Option 2**: Send logs to both the current destination and Sawmills

***

## Option 1: Send Logs Only to Sawmills

Use this when Sawmills should be the only destination for these logs.

### YAML Example

```yaml theme={null}
sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: http://<collector-service>.<namespace>.svc.cluster.local:4318/v1/logs
      encoding:
        codec: otlp
```

### TOML Example

```toml theme={null}
[sinks.sawmills_logs]
type = "opentelemetry"
inputs = ["my_logs"]

[sinks.sawmills_logs.protocol]
type = "http"
uri = "http://<collector-service>.<namespace>.svc.cluster.local:4318/v1/logs"

[sinks.sawmills_logs.protocol.encoding]
codec = "otlp"
```

### What to Replace

* Replace `my_logs` with the source or transform that currently feeds your log sink.
* Replace `<collector-service>.<namespace>.svc.cluster.local` with your Sawmills collector endpoint. If the collector load balancer is enabled, use the source-facing load balancer service.
* Replace `4318` with your OTLP HTTP port if it is different.

***

## Option 2: Dual Shipping

Use this when you want Vector to keep sending logs to the current destination and also send a copy to Sawmills.

In Vector, dual shipping usually means **adding one more sink** that points at the same `inputs`.

### Example

If you already have a sink like this:

```yaml theme={null}
sinks:
  existing_logs_sink:
    type: some_existing_sink
    inputs:
      - my_logs
```

Add this second sink:

```yaml theme={null}
sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: http://<collector-service>.<namespace>.svc.cluster.local:4318/v1/logs
      encoding:
        codec: otlp
```

The important part is that both sinks use the same `inputs`.

<Note>
  If you want the smallest possible change, do **not** replace the existing
  sink. Just add `sawmills_logs` as a second sink.
</Note>

***

## TLS Configuration

If your Sawmills endpoint is exposed with TLS, use an `https://` OTLP endpoint.

### YAML Example

```yaml theme={null}
sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: https://logs.example.com:4318/v1/logs
      encoding:
        codec: otlp
```

If your environment requires custom CA certificates or stricter verification settings, configure the additional TLS options in the Vector sink accordingly.

***

## Verification

After updating the Vector configuration:

1. Restart or reload Vector.
2. Check the Vector logs for connection or healthcheck errors.
3. Confirm that logs appear in Sawmills.

Useful checks:

```bash theme={null}
vector validate /etc/vector/vector.yaml
```

```bash theme={null}
journalctl -u vector -f
```

If Vector runs in Kubernetes, inspect the Vector pod logs instead.

***

## Troubleshooting

### No logs arriving in Sawmills

* Confirm the Sawmills **OTLP** source is enabled and HTTP is listening on the expected port.
* Confirm the `protocol.uri` in Vector points to the correct hostname, port, and `/v1/logs` path.
* Confirm network rules allow traffic from Vector to the Sawmills endpoint.

### Logs arrive, but fields are missing

* Use OTLP and keep the `opentelemetry` sink pointed at the final log event stream you want to ship.
* Make sure the fields you need still exist in the event before it reaches the `sawmills_logs` sink.

### TLS connection fails

* Confirm the endpoint expects HTTPS.
* Confirm Vector has the correct CA certificates if you use a private certificate authority.
* If your Sawmills endpoint is plain HTTP, use `http://...` instead of `https://...`.

### Vector config is valid, but the wrong logs are sent

* Check the `inputs` value on the `sawmills_logs` sink.
* Point it at the exact source or transform that contains the logs you want to ship.

***

## Summary

To send logs from Vector to Sawmills, the only required Vector change is usually to add a sink like this:

```yaml theme={null}
sinks:
  sawmills_logs:
    type: opentelemetry
    inputs:
      - my_logs
    protocol:
      type: http
      uri: http://<collector-service>.<namespace>.svc.cluster.local:4318/v1/logs
      encoding:
        codec: otlp
```

Replace only these values:

* `inputs`
* `protocol.uri`
* `port`
* `http` vs `https`