Updated: 2026-07-07

Vector, the Datadog observability agent, reached version 1.0 in 2022 and has matured through 2023 and 2024 into a serious option against Fluent Bit, Fluentd, and Logstash. Written in Rust, with its own transformation language called VRL, and support for dozens of sources and destinations, it occupies a specific niche: complex log and metric transformations at the node, before sending to destination.

Key takeaways

  • Vector is Rust-based: typically 30-100 MB memory in operation, more than Fluent Bit but far less than Logstash (JVM).

  • VRL (Vector Remap Language) is the differentiator: expressive transformations with typing, error handling, and integrated unit testing.

  • The same agent handles logs, metrics, and traces from dozens of sources to dozens of destinations.

  • Genuinely open source (MPL 2.0) and works without a Datadog account.

  • For simple pipelines, Fluent Bit is still lighter. Vector pays off when transformations are non-trivial.

What distinguishes Vector

Vector’s proposition is threefold:

  • Performance: written in Rust, typically consuming 30-100 MB of memory in operation, more than Fluent Bit, which is even lighter, but dramatically less than Logstash with its JVM.

  • Transformations: VRL (Vector Remap Language) allows rewriting, enriching, filtering, and pivoting events with powerful declarative syntax.

  • Multi-source: the same agent handles logs, metrics, and traces from dozens of origins to dozens of destinations.

For teams needing complex observability pipelines, beyond just collecting and forwarding, Vector is the reference tool.

The VRL language

VRL is the main differentiator against Fluent Bit. While Fluent Bit uses relatively limited chained filters, Vector allows writing expressive transformations that look like code but are declarative.

The language has explicit typing, error handling, predefined functions for parsing common formats, and the ability to unit-test transformations. For teams previously writing Lua scripts in Fluent Bit for the same purpose, VRL is significantly more maintainable.

Fluent Bit comparison

Fair comparison acknowledges that both tools excel in different terrain:

  • Fluent Bit is lighter, has a solid CNCF ecosystem, and more years of production scale. It is the default choice for simple log collection in Kubernetes with high pod density.

  • Vector wins when transformations are non-trivial: several enrichment steps, varied format parsing, complex filtering, and multiple simultaneous destinations. It also wins when observability mixes logs, metrics, and traces in the same agent.

Logstash comparison

Logstash is the traditional Elastic stack agent. It works, but has a reputation for consuming quite a lot of memory — typically a gigabyte or more. For modern Kubernetes environments, Vector is the natural replacement: Rust vs JVM, modern transformations vs Ruby plugins.

Migration from Logstash to Vector is a real project but a viable one. Logstash Grok transformations have direct or adaptable VRL equivalents.

Typical use cases

Vector shines in heterogeneous-observability situations. A company with applications on Kubernetes, databases on virtual machines, serverless services, and legacy servers with syslog produces different formats from each source. A centralised Vector agent can consume all of them, normalise to a common schema, enrich with metadata, and distribute to several destinations simultaneously:

  • Loki for hot logs and interactive querying.

  • S3 for long-term archive.

  • Datadog for executive dashboards.

  • Elasticsearch for legal audit.

Without Vector unifying the flow, each pipeline has its own agent, with scattered configurations and fragmented maintenance.

Honest limitations

Vector is not a universal replacement:

  • For very simple pipelines (collect container logs and send to Loki), Fluent Bit is lighter and requires less configuration.

  • For users already deep in the Elastic ecosystem, Logstash may be more natural.

  • Vector’s support for certain sources is less mature than purpose-built alternatives.

VRL learning curve has real cost — a team used to Fluent Bit needs several weeks to master VRL fluently. The investment pays off for complex pipelines but not for trivial cases.

Integration with Datadog

Vector is an open-source project maintained by Datadog, which explains its natural integration with Datadog products. Teams already using Datadog commercially get support and tooling synergy.

That said, the project is genuinely open source under MPL 2.0. It works equally well sending data to Loki, Elasticsearch, Splunk, Kafka, or any other destination. No Datadog account required. This commercial-sponsor open source model is similar to what we covered in the context of SLSA and the Sigstore ecosystem.

Deployment in Kubernetes

Vector is typically deployed as a DaemonSet in Kubernetes, similar to Fluent Bit. The official Helm chart is available and covers common patterns. For mixed infrastructure, it can run as a systemd service on traditional virtual machines.

The recommended pattern is a per-node agent plus a centralised aggregator. Agents handle lightweight collection and forward to aggregators, which perform the heavy transformations. This reduces load on production nodes and centralises transformation logic.

Vector observability

The agent itself exposes Prometheus metrics on processed events, applied transformations, errors, and latency. A dedicated Grafana dashboard for Vector makes sense; the agent collecting logs also deserves to be monitored. This visibility into the observability infrastructure itself is the same measurement principle that applies to green software principles.

Conclusion

Vector is the right choice when observability requires non-trivial transformations and multi-source consolidation. For simple pipelines, Fluent Bit remains lighter and more pragmatic. The pragmatic decision depends on real pipeline complexity and appetite for learning VRL. For teams with mature observability already managing multiple sources and destinations, investing in Vector reduces fragmentation and improves maintainability. For teams just starting out, Fluent Bit remains a reasonable entry point. Vector comes when the complexity justifies it.