Q&A: How to create access log format which isn't in json output

[git001]

Question

I would like to create a JSON based access log output to an text file similar to apache combined access log.
When I use codec = "text" is the output empty with codec = "json" are the fields shown but only in json format.

Where is the proper way to set the format for the output line?

• transform?
• sink?
• ??

I think the template could look like that with {{ and }} right?

"request.client_ip - user_id - accesslog_timefmt "request.request.client_ip request.uri request.proto" status bytes_read "request.headers.User-Agent"

Vector Config

data_dir = "/datadisk/Downloads/vector/data"

[sources.source0]
max_length = 102400
type = "stdin"

[sources.source0.decoding]
codec = "bytes"

[sources.source0.framing]
method = "newline_delimited"

[transforms.transform0]
inputs = ["source0"]
type = "remap"
#drop_field = true
#drop_invalid = false
#type = "json_parser"
source='''
  . = parse_json!(.message)
  del(.resp_headers."Content-Security-Policy")
  #parsed_time=parse_timestamp!(.ts,format: "%+")
  .accesslog_timefmt=format_timestamp!(parse_timestamp!(.ts,format: "%+"), format: "%d/%b/%Y:%H:%M:%S %z")
  '''

#"Content-Security-Policy"

[sinks.sink0]
inputs = ["transform0"]
target = "stdout"
type = "console"

[sinks.sink0.encoding]
codec = "json"
#codec = "text"
only_fields=["request.client_ip","user_id","status","accesslog_timefmt","request.headers.User-Agent"]
#                                                       "ts": "2025-09-10T13:29:07.623Z",
# "request.client_ip - user_id - accesslog_timefmt "request.request.client_ip request.uri request.proto" status bytes_read "request.headers.User-Agent"


[sinks.sink0.healthcheck]
enabled = true

[sinks.sink0.buffer]
type = "memory"
max_events = 500
when_full = "block"

Vector Logs

Json encoding

alex@alex-tuxedoinfinitybooks1517gen7 on 10/09/2025 at 17:30:00_CEST /datadisk/Downloads/vector $
# jq -c < caddy-access.json |./vector-x86_64-unknown-linux-gnu/bin/vector -v -c test-stdin-json.toml
2025-09-10T15:32:18.683416Z  INFO vector::app: Log level is enabled. level="vector=debug,codec=debug,vrl=debug,file_source=debug,tower_limit=trace,rdkafka=debug,buffers=debug"
2025-09-10T15:32:18.683478Z  INFO vector::app: Loading configs. paths=["test-stdin-json.toml"]
2025-09-10T15:32:18.684866Z  INFO vector::sources::stdin: Capturing STDIN.
2025-09-10T15:32:18.685164Z  INFO vector::topology::running: Running healthchecks.
2025-09-10T15:32:18.685212Z  INFO vector::topology::running: Starting source. key=source0
2025-09-10T15:32:18.685239Z  INFO vector::topology::builder: Healthcheck: Passed.
2025-09-10T15:32:18.685250Z  INFO vector::topology::running: Starting transform. key=transform0
2025-09-10T15:32:18.685294Z  INFO vector::topology::running: Starting sink. key=sink0
2025-09-10T15:32:18.685322Z  INFO vector: Vector has started. debug="false" version="0.20.0" arch="x86_64" build_id="2a706a3 2022-02-11"
2025-09-10T15:32:18.685331Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
2025-09-10T15:32:18.685385Z  INFO vector::shutdown: All sources have finished.
2025-09-10T15:32:18.685388Z  INFO vector: Vector has stopped.
2025-09-10T15:32:18.685416Z  INFO source{component_kind="source" component_id=source0 component_type=stdin component_name=source0}: vector::sources::stdin: Finished sending.
2025-09-10T15:32:18.685436Z DEBUG source{component_kind="source" component_id=source0 component_type=stdin component_name=source0}: vector::topology::builder: Finished.
2025-09-10T15:32:18.685672Z DEBUG transform{component_kind="transform" component_id=transform0 component_type=remap component_name=transform0}: vector::topology::builder: Finished.
2025-09-10T15:32:18.685805Z DEBUG sink{component_kind="sink" component_id=sink0 component_type=console component_name=sink0}: vector::topology::builder: Finished.
{"accesslog_timefmt":"10/Sep/2025:13:29:07 +0000","request":{"client_ip":"77.237.62.132","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36"]}},"status":200,"user_id":""}

text encoding

alex@alex-tuxedoinfinitybooks1517gen7 on 10/09/2025 at 17:04:14_CEST /datadisk/Downloads/vector $
# jq -c < caddy-access.json |./vector-x86_64-unknown-linux-gnu/bin/vector -v -c test-stdin-json.toml
2025-09-10T15:05:38.049621Z  INFO vector::app: Log level is enabled. level="vector=debug,codec=debug,vrl=debug,file_source=debug,tower_limit=trace,rdkafka=debug,buffers=debug"
2025-09-10T15:05:38.049690Z  INFO vector::app: Loading configs. paths=["test-stdin-json.toml"]
2025-09-10T15:05:38.050978Z  INFO vector::sources::stdin: Capturing STDIN.
2025-09-10T15:05:38.051208Z  INFO vector::topology::running: Running healthchecks.
2025-09-10T15:05:38.051237Z  INFO vector::topology::running: Starting source. key=source0
2025-09-10T15:05:38.051263Z  INFO vector::topology::running: Starting transform. key=transform0
2025-09-10T15:05:38.051252Z  INFO vector::topology::builder: Healthcheck: Passed.
2025-09-10T15:05:38.051272Z  INFO vector::topology::running: Starting sink. key=sink0
2025-09-10T15:05:38.051293Z  INFO vector: Vector has started. debug="false" version="0.20.0" arch="x86_64" build_id="2a706a3 2022-02-11"
2025-09-10T15:05:38.051300Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
2025-09-10T15:05:38.051505Z  INFO vector::shutdown: All sources have finished.
2025-09-10T15:05:38.051509Z  INFO vector: Vector has stopped.
2025-09-10T15:05:38.051531Z  INFO source{component_kind="source" component_id=source0 component_type=stdin component_name=source0}: vector::sources::stdin: Finished sending.
2025-09-10T15:05:38.051573Z DEBUG source{component_kind="source" component_id=source0 component_type=stdin component_name=source0}: vector::topology::builder: Finished.
2025-09-10T15:05:38.051830Z DEBUG transform{component_kind="transform" component_id=transform0 component_type=remap component_name=transform0}: vector::topology::builder: Finished.
2025-09-10T15:05:38.051974Z DEBUG sink{component_kind="sink" component_id=sink0 component_type=console component_name=sink0}: vector::topology::builder: Finished.