How do I remap the process name for the Papertrail sink?

[ocharles]

Hi all.

We use Papertrail as our logging database. I'm trying to run Vector as an agent in our Nomad cluster. I've got the following config:

          data_dir = "alloc/data/"
          [api]
            enabled = false
          [sources.journald]
            type = "journald"
            current_boot_only = true
            since_now = true
            include_units = []
            # Warning and above
            include_matches.PRIORITY = [ "0", "1", "2", "3", "4" ]
          [sources.docker]
            type = "docker_logs"
          [transforms.nomad_tasks]
            type = "remap"
            inputs = ["docker"]
            source = """
            # We require all Docker contains to have labels for at least the Nomad task group and
            # task itself. These form the 'process' field in Papertrail.
            .process, err = .label."com.hashicorp.nomad.task_group_name" + "-" + .label."com.hashicorp.nomad.task_name"
            if err != null {
              abort "Missing required Nomad labels: " + string!(err)
            }

            # Remap the host to be the hostname of the Nomad client (the default is the hostname
            # of this Vector agent's container, which is fairly useless)
            .host = "[[env "attr.unique.hostname"]]"
            """
          [sinks.papertrail]
            type = "papertrail"
            inputs = [ "journald", "nomad_tasks" ]
            encoding.codec = "raw_message"
            endpoint = "logsXXX.papertrailapp.com:XXX"
          [sinks.console]
            type = "console"
            inputs = ["nomad_tasks"]
            encoding.only_fields = ["message", "host", "process"]
            encoding.codec = "json"

This agent runs and produces stdout like:

{"host":"server","message":"100.77.224.145 - - [16/Jun/2025:10:38:58 +0000] \"GET /metrics HTTP/1.1\" 200 2313 \"\" \"Prometheus/3.4.1\"","process":"camera-40497385-camera"}
{"host":"server","message":"100.79.57.124 - - [16/Jun/2025:10:38:58 +0000] \"GET / HTTP/1.1\" 200 1956 \"\" \"Consul Health Check\"","process":"camera-40506414-camera"}
{"host":"server","message":"100.77.224.145 - - [16/Jun/2025:10:38:58 +0000] \"GET /metrics HTTP/1.1\" 200 2307 \"\" \"Prometheus/3.4.1\"","process":"camera-40453187-camera"}
{"host":"server","message":"100.79.57.124 - - [16/Jun/2025:10:38:59 +0000] \"GET / HTTP/1.1\" 200 1956 \"\" \"Consul Health Check\"","process":"camera-40443305-camera"}
{"host":"server","message":"100.77.224.145 - - [16/Jun/2025:10:39:00 +0000] \"GET /metrics HTTP/1.1\" 200 2306 \"\" \"Prometheus/3.4.1\"","process":"camera-40442221-camera"}
{"host":"server","message":"100.77.224.145 - - [16/Jun/2025:10:39:01 +0000] \"GET /metrics HTTP/1.1\" 200 2307 \"\" \"Prometheus/3.4.1\"","process":"camera-40506414-camera"}
{"host":"server","message":"100.93.41.109 - - [16/Jun/2025:10:39:03 +0000] \"GET /metrics HTTP/1.1\" 200 2306 \"\" \"Prometheus/2.55.0\"","process":"camera-40443303-camera"}
{"host":"server","message":"100.93.41.109 - - [16/Jun/2025:10:39:04 +0000] \"GET /metrics HTTP/1.1\" 200 2307 \"\" \"Prometheus/2.55.0\"","process":"camera-40442220-camera"}
{"host":"server","message":"100.93.41.109 - - [16/Jun/2025:10:39:04 +0000] \"GET /metrics HTTP/1.1\" 200 2307 \"\" \"Prometheus/2.55.0\"","process":"camera-40551628-camera"}

This is exactly what I want.

The problem is, the corresponding Papertrail events all get attributed to vector, and not the process field here. What am I doing wrong?

[ocharles]

Problem solved! I needed to add the process option to my sink:

          [sinks.papertrail]
            process = "{{.process}}"