Vector v0.31.0 release notes

The Vector team is pleased to announce version 0.31.0!

Be sure to check out the upgrade guide for breaking changes in this release.

In addition to the usual smaller enhancements and bug fixes, this release includes an opt-in beta of a new log event data model that we think will make it easier to process logs by moving event metadata out of the log event itself. We are looking for feedback on this new feature before beginning towards making it the default and eventually removing the old log event data model.

By way of example, an example event from the datadog_agent source currently looks like:

{
	"ddsource": "vector",
	"ddtags": "env:prod",
	"hostname": "alpha",
	"foo": "foo field",
	"service": "cernan",
	"source_type": "datadog_agent",
	"bar": "bar field",
	"status": "warning",
	"timestamp": "1970-02-14T20:44:57.570Z"
}

Will now look like:

{
	"foo": "foo field",
	"bar": "bar field"
}

(just the event itself)

with additional buckets for source added metadata:

{
	"ddsource": "vector",
	"ddtags": "env:prod",
	"hostname": "alpha",
	"service": "cernan",
	"status": "warning",
	"timestamp": "1970-02-14T20:44:57.570Z"
}

accessible via %<datadog_agent>.<field>, and Vector added metadata:

{
	"source_type": "datadog_agent",
	"ingest_timestamp": "1970-02-14T20:44:58.236Z"
}

accessible via %vector.<field>.

We think this new organization will be easier to reason about for users as well as avoid key conflicts between event fields and metadata.

You can opt into this feature by setting schema.log_namespace as a global setting or the log_namespace option now available on each source itself. See the blog post for an expanded explanation and details. Let us know what you think on this issue.