Vector

Vector is a high-performance pipeline that collects, transforms, and routes logs, metrics, and traces across your infrastructure. It's the plumbing between your applications and your observability stack (Elasticsearch, Datadog, Grafana, whatever you use).

Rust-based, MPL 2.0 license. Built by the team behind Timber (now part of Datadog). Single binary, ~10MB, handles millions of events per second on modest hardware. Supports 100+ sources and sinks: pull from syslog, Kafka, files, Kubernetes; push to S3, ClickHouse, Loki, Splunk. The transform layer lets you filter, parse, enrich, and route data using a built-in language called VRL.

Fully free. No paid tier, no hosted version. Datadog acquired Timber but kept Vector open source. MPL 2.0 means you can use it commercially. You just can't fork the modified source and close it. Solo through enterprise: free at every scale. The Rust performance means you rarely need to think about Vector's resource usage. One instance handles what would take a cluster of Logstash nodes.

The catch: VRL (Vector Remap Language) is powerful but it's a custom DSL you have to learn. If your team already knows Logstash configs or Fluentd plugins, there's a migration cost. And while Datadog keeping it open source is great, the deepest integration is naturally with Datadog's platform.