Skip to content

Conversation

aramperes
Copy link
Contributor

@aramperes aramperes commented Sep 5, 2025

Summary

Implements the GELF Chunking specification when the gelf codec is used with the socket sink in udp mode. This increases the possible message size from 8KiB to 1MiB to Graylog UDP server, and up to 8MiB when used to bridge to another Vector instance over UDP.

Implementation notes

  • The new Chunking trait can be used to implement any chunking method. It requires the contract chunk(Bytes) -> Vec<Bytes>
  • Passing a Chunking implementation (Chunker) to the UDP sink is optional, as to skip a Vec heap allocation when chunking is not needed, with the goal of maintaining performance for all other codecs that do not use chunking.
  • Chunking is only ever called for the socket sink in UDP mode, but this could later be supported by any other sink that could benefit from it.

Vector configuration

Client side Vector (sink):

sources:
  in:
    type: http_server
    address: 0.0.0.0:8000
    codec: json

transforms:
  remap:
    type: remap
    inputs:
      - in
    source: .host = "vector"

sinks:
  sink_socket:
    type: socket
    inputs:
      - remap
    mode: udp
    address: 127.0.0.1:7008
    encoding:
      codec: gelf
      gelf:
        max_chunk_size: 65507  # localhost limit

Server side Vector (source):

sources:
  in_udp:
    type: socket
    mode: udp
    address: 127.0.0.1:7008
    decoding:
      codec: gelf
    framing:
      method: chunked_gelf

sinks:
  sink_console:
    type: console
    inputs:
      - in_udp
    encoding:
      codec: json

How did you test this PR?

Tested using the configs above, Vector-to-Vector. Confirmed that data sent through the "client" Vector (gelf sink) is replicated on the "server" side Vector (gelf source).

My main motivation for implementing this feature is to support Vector-to-Vector event bridging over UDP, for events larger than 64KiB.

Change Type

  • Bug fix
  • New feature
  • Non-functional (chore, refactoring, docs)
  • Performance

Is this a breaking change?

  • Yes
  • No

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the no-changelog label to this PR.

References

@aramperes aramperes requested review from a team as code owners September 5, 2025 02:55
@github-actions github-actions bot added domain: sinks Anything related to the Vector's sinks domain: external docs Anything related to Vector's external, public documentation labels Sep 5, 2025
@aramperes
Copy link
Contributor Author

@pront (Sorry for the nudge) is there any chance this could get reviewed before the merge freeze for 0.50? Thanks 😊

Copy link
Member

@pront pront left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @aramperes, this PR looks good to me. Left a few comments, but nothing major.

@pront pront enabled auto-merge September 17, 2025 13:21
@pront
Copy link
Member

pront commented Sep 17, 2025

A few checks are failing. We can merge once those are fixed.

auto-merge was automatically disabled September 17, 2025 23:02

Head branch was pushed to by a user without write access

@pront pront enabled auto-merge September 18, 2025 13:26
@pront pront added this pull request to the merge queue Sep 18, 2025
Merged via the queue into vectordotdev:master with commit a98693c Sep 18, 2025
53 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
domain: external docs Anything related to Vector's external, public documentation domain: sinks Anything related to the Vector's sinks
Projects
None yet
Development

Successfully merging this pull request may close these issues.

GELF codec needs to support chunking
3 participants