Vector

Use Vector when you already collect logs from files, containers, or other services and want to shape them before they reach Squasher. Vector posts each event to the Squasher event endpoint.

Prerequisites

Vector installed where your logs are.
An ingest key and project ID, saved as SQUASHER_API_KEY and SQUASHER_PROJECT_ID in Vector’s environment. See Create an ingest key.

Add the Squasher sink

Shape each event

The event endpoint needs a string message. Without a level, it stores the event as an error and opens an issue. Add a remap transform that parses JSON lines and sets both fields.

vector.toml

[transforms.squasher_shape]
type = "remap"
inputs = ["app_logs"]
source = '''
parsed, err = parse_json(.message)
if err == null && is_object(parsed) {
  . = merge(., object!(parsed))
}
.message = string(.message) ?? encode_json(.)
.level = downcase(string(.level) ?? "info")
.tags.service = "checkout-api"
'''

Replace app_logs with the name of your source, and checkout-api with your service name.

Add the HTTP sink

Send newline-delimited JSON without compression. The event endpoint does not read gzip bodies.

vector.toml

[sinks.squasher]
type = "http"
inputs = ["squasher_shape"]
uri = "https://ingest.squasher.ai/v1/ingest/${SQUASHER_PROJECT_ID}"
method = "post"
compression = "none"
encoding.codec = "json"
framing.method = "newline_delimited"
request.headers.content-type = "application/x-ndjson"
request.headers.x-squasher-key = "${SQUASHER_API_KEY}"

Validate and restart Vector

vector validate vector.toml

Restart Vector so it loads the new configuration.

What Squasher keeps from each event

Vector field	Squasher field
`message`	Log body and issue title
`level`	Level. `error` and `fatal` create issues.
`timestamp`	Event time
`tags.service`	Service name
`tags`, `attributes`, `extra`	Attributes
`environment`, `release`	Environment and release
Any other top-level field	Dropped

See Event fields for the full list.

Verify

Write one JSON line with "level":"error" and "message":"Squasher test error" to a file or stream that Vector reads.
Select Issues in the sidebar in Squasher. The test error is at the top of the list.
Select Logs in the sidebar to see the info-level lines as logs.

If the error does not arrive, run Vector with --verbose and look for 4xx responses from the sink. A 400 response names the event that has no string message.

Limits

Each project can send 10,000 records per minute by default. Above that, Squasher returns 429, and Vector retries.
If Vector already sends to another log product, add Squasher as a second sink first. Remove the old sink only after you compare the data.

Next steps

HTTP API

See every event field and the drain endpoint.

Docker

Collect container logs with an OpenTelemetry Collector.

Design queryable logs

Choose fields that stay easy to search.

Set up notifications

Send new issues to Slack, PagerDuty, or email.

Get started

Guides

Prerequisites

Add the Squasher sink

What Squasher keeps from each event

Verify

Limits

Next steps

HTTP API

Docker

Design queryable logs

Set up notifications

​Prerequisites

​Add the Squasher sink

​What Squasher keeps from each event

​Verify

​Limits

​Next steps

HTTP API

Docker

Design queryable logs

Set up notifications

Prerequisites

Add the Squasher sink

What Squasher keeps from each event

Verify

Limits

Next steps