techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vector: current_boot_only must be true on systemd 257, and drop the redundant object! casts

Browse Source 
systemd 250-257 refuse to read past boots through journalctl, which made the source config invalid and put
the container in a restart loop with exit 78. The object!() casts were only warnings: inside the err == null
branch VRL has already narrowed the parsed value, so get() takes it directly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Brandyn / Techy
2026-11-03 16:24:46 -06:00
parent a77051c496
commit 07d6c7e924
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
observability/vector.yaml
View File

@@ -21,7 +21,9 @@ sources:
exclude_containers: [vector] # never ship our own output: it would feed itself
units:
type: journald
current_boot_only: false
# systemd 250-257 reject reading past boots through journalctl, so this stays true: only the current boot
# is shipped. Older entries are still on the host for `journalctl --boot=-1`.
current_boot_only: true
journal_directory: /var/log/journal
include_units: [dumpd, normalize-sweep, trash-purge, deploy-pending, vgdeband]
@@ -59,18 +61,18 @@ transforms:
if starts_with(text, "{") {
# caddy and authentik emit JSON
fields, err = parse_json(text)
if err == null && is_object(fields) {
if err == null {
.json = fields
.level = get(object!(fields), ["level"]) ?? get(object!(fields), ["severity"]) ?? null
.message = get(object!(fields), ["msg"]) ?? get(object!(fields), ["event"]) ?? text
.level = get(fields, ["level"]) ?? get(fields, ["severity"]) ?? null
.message = get(fields, ["msg"]) ?? get(fields, ["event"]) ?? text
}
} else if match(text, r'(^|\s)(ts|level|component|event)=') {
# our own scripts, and syncthing's key=value tail
fields, err = parse_logfmt(text)
if err == null {
.kv = fields
.level = get(object!(fields), ["level"]) ?? null
.event = get(object!(fields), ["event"]) ?? null
.level = get(fields, ["level"]) ?? null
.event = get(fields, ["event"]) ?? null
}
} else if match(text, r'^\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2} ') {
# mediamtx: 2026/11/03 05:00:00 INF [component] message