Vector Delay in Pushing Logs to NATS

[SamyElHamass]

We are currently using Vector to collect logs from a node and push them to NATS. However, we’ve noticed a delay (sometimes several seconds) between when the logs are collected and when they are published to NATS.

Has anyone experienced this issue or know how to configure Vector to reduce the delay? Any insights or recommendations would be appreciated.

[jszwedko]

What is the source of the logs?

[SamyElHamass]

Thank you for the fast answer!

We do use the type file source. (https://vector.dev/docs/reference/configuration/sources/file/)

[jszwedko]

Thanks! I think the delay is likely to be in the file source reading the data rather than pushing to nats. You could validate this by adding a timestamp field set to now() using remap in Vector, after the file source, to determine how long the event spends in Vector itself vs. the delay in reading the line from the file.