How to integrate query TRINO logs with Vector using Trino-operator

[dshershov]

Hello everyone! Thanks for awesome product!
I have a some question about logging system with vector. Sorry if my question is trivial
So I created a trino cluster on 455 of the trino version and 24.11.1 version of operator, turned it on vector parameter here:

  coordinators:
    config:
      logging:
        enableVectorAgent: true
        containers:
          trino:
            loggers:
              io.trino:
                level: INFO

The next step was deploying vector-aggregator with elasic sink module with the next parameter:

        event-listener.config-files: "/stackable/external-properties/http-event-listener.properties"

and ConfigMap:

data:
  ADDRESS: vector-aggregator.vector.svc.cluster.local:6000

logs moving to ES correctly - it's working fine
After that, I needed to enable QUERY LOGS with http-event-listner (https://trino.io/docs/current/admin/event-listeners-http.html#http-event-listener-configuration)
with mounting the next configmap

data:
  http-event-listener.properties: |
    event-listener.name: http
    http-event-listener.log-created: true
    http-event-listener.connect-ingest-uri: http://localhost:6000 # because I have a vector trino sidecar with port:6000
    http-event-listener.log-completed: true

but I getting this error:

2025-06-16T12:11:42.988Z	ERROR	http-event-listener-0	io.trino.plugin.httpquery.HttpEventListener	QueryId = "20250616_121142_00001_6xj7x", attempt = 1/1, URL = http://localhost:6000 | Error sending HTTP request
java.io.UncheckedIOException: Server refused connection: http://localhost:6000

PS This parameter was enabled : http-server.log.enabled = true
Could anyone help me with this issue?
Thanks a lot!

[dshershov]

@sbernauer hello Sebastian!
Sorry for mentioning
I hope you are doing well
Could u help me with my question?
Thanks

[sbernauer]

Hi @dshershov!
I have to admit I'm a bit confused. Do you want to collect the normal logs of Trino or do you want the HTTP event listener?
These are entirely different things, the HTTP event listener sends you JSON objects for everything that happens to a query.
Do I understand it correctly that you also want the queries events in addition to the normal logs to end up in Vector?

If never heard of someone doing that, and I'm not sure what Vector would do with these HTTP calls.

[dshershov]

Correct, I try to get logs about everything that happens to query and trino logs and push that via vector to elastic
okay, so I will try to find any solutions with storing query logs

[dshershov]

So, I found a tool that helped me
if anyone needs it:
https://github.com/hassanahmadkhani/trino-querylog

[sbernauer]

Sorry for missing your reply! Looks like the simple tool registers itself as event listener and simply logs all events using log4j.
I think that is likely the answer to your problem, thanks for following up with your solution, much appreciated!