Getting started¶

This page takes you from the AWS Marketplace listing to your first records flowing through Vector. It takes about ten minutes.

You need: an AWS account with permission to subscribe to AWS Marketplace products and launch EC2 instances.

Open the Vector Log Pipeline listing, choose View purchase options, review the terms and subscribe.

2. Launch the instance¶

Choose Launch your software and use these settings:

Instance type: t3.medium.
Storage: an encrypted gp3 root volume of at least 16 GiB.
IAM instance profile: a role with the AWS managed policy AmazonSSMManagedInstanceCore, so you can connect with Session Manager.
Security group: no inbound rules are needed. If you want SSH as well, allow port 22 only from your own administrative network.
Metadata: require IMDSv2.

3. Connect and check first boot¶

In the EC2 console, select the instance, choose Connect, then Session Manager. Switch to the ubuntu user and wait for first boot:

sudo -iu ubuntu
cloud-init status --wait
systemctl is-active sushi-vector-firstboot.service vector.service
curl http://127.0.0.1:8686/health

Both units should report active, and the health check returns a small JSON document with ok set to true.

4. Run the walkthrough¶

bash /opt/sushi/docs/demo.sh

It checks the health API, confirms that ingest refuses plain HTTP and requests without the password, sends test records over HTTPS and through a file, checks that they arrive redacted, and then runs the image's self-test. It ends with SUSHI_CUSTOMER_DEMO_PASSED.

5. Send a record through a file¶

Write one JSON object per line to a .log file in /var/lib/vector/in/. The ubuntu user can write there; the file must be readable by the vector user:

printf '%s\n' '{"level":"info","event":"hello","email":"someone@example.com"}' > /var/lib/vector/in/hello.log
chmod 0644 /var/lib/vector/in/hello.log

6. Send a record over HTTPS¶

Ingest needs the user vector and the password in /var/lib/vector/vector.env. This command reads the password from the file without printing it:

sudo python3 -c 'import base64, pathlib, ssl, urllib.request
env = pathlib.Path("/var/lib/vector/vector.env").read_text()
password = [line.split("=", 1)[1] for line in env.splitlines() if line.startswith("VECTOR_HTTP_PASSWORD=")][0]
token = base64.b64encode(f"vector:{password}".encode()).decode()
body = b"{\"level\":\"info\",\"event\":\"hello-https\"}"
request = urllib.request.Request("https://127.0.0.1:8687/ingest", data=body, method="POST", headers={"Authorization": "Basic " + token, "Content-Type": "application/json"})
print(urllib.request.urlopen(request, context=ssl.create_default_context(cafile="/etc/vector/tls/cert.pem"), timeout=15).status)'

It prints 200 when Vector accepts the record.

7. See the output¶

Delivered records go to a dated file:

sudo sh -c 'tail -n 5 /var/lib/vector/out/accepted-*.log'

The email value from step 5 reads REDACTED, and each record carries "pipeline":"sushi-vector".

Next: Configuration.