Skip to content

Add support for vault-enterprise container image in log pipeline #22565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dkirov-dd wants to merge 3 commits into
base: master
Choose a base branch
from
+6 −3
Open

Add support for vault-enterprise container image in log pipeline #22565

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3b6f31f
Add support for vault-enterprise container image in log pipeline
dkirov-dd Feb 6, 2026
d1de237
Add vault-enterprise to installation-sources
dkirov-dd Feb 6, 2026
a813aef
Fix query format
dkirov-dd Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions vault/assets/logs/vault.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
id: vault
metric_id: vault
backend_only: false
installation_sources:
- vault
- vault-enterprise
facets:
- groups:
- Web Access
Expand Down Expand Up @@ -128,16 +131,16 @@ pipeline:
name: Vault
enabled: true
filter:
query: source:vault
query: source:(vault OR vault-enterprise)
processors:
- type: grok-parser
name: Parsing Vault Server logs
enabled: true
source: message
samples:
- 2019-11-04T17:48:44.226-0800 [WARN] no `api_addr` value specified in config or in VAULT_API_ADDR; falling back to detection if possible, but this value should be manually set
- '2019-11-04T17:48:58.967-0800 [DEBUG] core: starting cluster listeners'
- '2019-11-04T17:48:58.967-0800 [INFO] core.cluster-listener: starting listener: listener_address=0.0.0.0:8201'
- "2019-11-04T17:48:58.967-0800 [DEBUG] core: starting cluster listeners"
- "2019-11-04T17:48:58.967-0800 [INFO] core.cluster-listener: starting listener: listener_address=0.0.0.0:8201"
grok:
supportRules: |
_date %{date("yyyy-MM-dd'T'HH:mm:ss.SSSZ"):timestamp}
Expand Down
Loading