# Vector: tail all Docker container logs on this host and ship them to VictoriaLogs
# via the Elasticsearch bulk API (the VM-recommended Vector sink). Endpoint + host
# label come from the environment (see .env / compose.yaml).
sources:
  docker:
    type: docker_logs

transforms:
  enrich:
    type: remap
    inputs: [docker]
    source: |
      .host = get_env_var!("HOST_LABEL")

sinks:
  vlogs:
    type: elasticsearch
    inputs: [enrich]
    endpoints:
      - "${VLOGS_ENDPOINT}"      # e.g. https://vlogs.tail7e769.ts.net/insert/elasticsearch/
    mode: bulk
    api_version: v8
    compression: gzip
    healthcheck:
      enabled: false
    query:
      _msg_field: message
      _time_field: timestamp
      # Group log streams by host + container so LogsQL stream filters work well.
      _stream_fields: host,container_name