Vector

6 min

Vector

Edition: Enterprise only

The Vector integration scans logs forwarded from Vector via the HTTP sink, enabling real-time secret detection on log streams.

Configuration

The Vector integration is configured via a local configuration file. Web configuration in TruffleHog is not available for this source.

Setup requires configuration in two places: a TruffleHog source that listens for incoming logs, and a Vector HTTP sink that forwards logs to it.

Local configuration

TruffleHog source configuration

sources: - connection: "@type": type.googleapis.com/sources.Webhook listenAddress: ":8080" header: key: Authorization # The value must be prefixed with 'Bearer ' as shown. value: "Bearer your-secret-value" vector: # Specify a field to extract using JQ-style syntax. # The extracted field can be used to format a link # back to your logging system in the TruffleHog dashboard. locator_field: "metadata.request_id" link_format: "https://your-logging-system.com/logs/{locator}" name: Vector logs type: SOURCE_TYPE_WEBHOOK verify: true

Vector HTTP sink configuration

If present in the incoming log payload, the following fields are surfaced as metadata in the TruffleHog dashboard: host, hostname, timestamp, source_type. See the Vector HTTP sink documentation for the full set of sink options.

sinks: webhook: type: http inputs: - "in" # Customize the URI to point to whatever host:port # you are running TruffleHog on. uri: http://localhost:8080/v1/vector method: "post" encoding: codec: "json" auth: strategy: "bearer" token: "your-secret-value"

Configuration options

Field	Type	Required	Description
listenAddress	string	Yes	The address and port the webhook listener binds to (e.g., :8080).
header.key	string	Yes	The HTTP header used for authentication. Typically Authorization.
header.value	string	Yes	The expected header value. For bearer tokens, prefix the secret with Bearer .
vector.locator_field	string	No	A jq-style path to a field in the incoming log used to build a link back to your logging system.
vector.link_format	string	No	A URL template containing {locator}, replaced with the value extracted via locator_field.

Capabilities

Feature	Supported
Real-time scanning	✅
Scan log streams	✅
Scan base64-encoded data	✅

Notes

TruffleHog scans logs forwarded by Vector but does not block log delivery when credentials are detected. Detection is observe-only.