Skip to content
Osuite Osuite Docs

Forward logs from Vector to Osuite

Overview

Section titled “Overview”

If you already run Vector, add an opentelemetry sink to send its logs to Osuite over OTLP. The sink supports custom request headers, so it can carry the Osuite ingest token straight to the ingest endpoint without a Collector in between.

Prerequisites

Section titled “Prerequisites”
  • A running Vector instance with sources already configured. This example assumes a source named my_source.
  • Your Osuite ingest endpoint and token.

Vector config

Section titled “Vector config”

This sink encodes events as OTLP protobuf and posts them to the Osuite logs endpoint with the ingest token as a header.

sinks:
  osuite:
    type: opentelemetry
    inputs:
      - my_source
    protocol:
      type: http
      uri: https://ingest.<region>.osuite.io:443/v1/logs
      method: post
      encoding:
        codec: otlp
      request:
        headers:
          x-osuite-ingest-token: <your-ingest-token>

To route through a Collector instead — for central batching, enrichment, or redaction — point uri at the Collector’s OTLP/HTTP logs endpoint (for example http://<your-collector-host>:4318/v1/logs) and drop the ingest header; the Collector’s otlp/osuite exporter attaches the token on export.

Verify in Osuite

Section titled “Verify in Osuite”

What you should see

Vector events appear in the Logs Explorer within a minute, carrying the fields Vector attached to each event as attributes.

Troubleshooting

Section titled “Troubleshooting”

A 404 means the x-osuite-ingest-token header is missing or wrong — ingest matches the token at the edge, so an unrecognised token fails route matching instead of returning 401 or 403. If the sink reports encoding or batching errors, confirm codec: otlp — native batching does not work with codec: json. Run Vector with --verbose to see per-request status against the ingest endpoint, and confirm the host has outbound access on port 443.

No data in Osuite after a few minutes? Work through these checks.

  • Endpoint — confirm the exporter targets exactly ingest.<region>.osuite.io:443 for your region, over TLS.
  • Token — confirm the ingest header carries a valid <your-ingest-token> and has not been rotated.
  • Pipeline — confirm the signal you expect (traces, logs, or metrics) is wired into an active pipeline with the otlp/osuite exporter attached.
  • Export errors — check the application or Collector logs for OTLP export failures (auth, DNS, TLS, connection refused).
  • Network — confirm the host has outbound access to the ingest endpoint on port 443.
  • Timing — allow up to a minute for the first data to appear before assuming a failure.

Still stuck? Ask the Investigation Agent or contact support.

Next steps

Section titled “Next steps”