---
title: Vector
slug: docs/vector
icon: {"faIcon":"fa-solid fa-v"}
docTags: 
createdAt: 2024-04-17T16:33:26.498Z
---

# Vector

:::BlockQuote
**Edition:** Enterprise only
:::

The Vector integration scans logs forwarded from Vector via the HTTP sink, enabling real-time secret detection on log streams.

## Configuration

The Vector integration is configured via a local configuration file. Web configuration in TruffleHog is not available for this source.

Setup requires configuration in two places: a TruffleHog source that listens for incoming logs, and a Vector HTTP sink that forwards logs to it.

### Local configuration

**TruffleHog source configuration**

:::BlockQuote
sources:
  \- connection:
      "@type": type.googleapis.com/sources.Webhook
      listenAddress: ":8080"
      header:
        key: Authorization
        \# The value must be prefixed with 'Bearer ' as shown.
        value: "Bearer your-secret-value"
      vector:
        \# Specify a field to extract using JQ-style syntax.
        \# The extracted field can be used to format a link
        \# back to your logging system in the TruffleHog dashboard.
        locator\_field: "metadata.request\_id"
        link\_format: "https\://your-logging-system.com/logs/{locator}"
    name: Vector logs
    type: SOURCE\_TYPE\_WEBHOOK
    verify: true
:::

**Vector HTTP sink configuration**

If present in the incoming log payload, the following fields are surfaced as metadata in the TruffleHog dashboard: host, hostname, timestamp, source\_type. See the Vector HTTP sink documentation for the full set of sink options.

:::BlockQuote
sinks:
  webhook:
    type: http
    inputs:
      \- "in"
    \# Customize the URI to point to whatever host\:port
    \# you are running TruffleHog on.
    uri: http\://localhost:8080/v1/vector
    method: "post"
    encoding:
      codec: "json"
    auth:
      strategy: "bearer"
      token: "your-secret-value"
:::

## Configuration options

| Field                 | Type   | Required | Description                                                                                      |
| --------------------- | ------ | -------- | ------------------------------------------------------------------------------------------------ |
| listenAddress         | string | Yes      | The address and port the webhook listener binds to (e.g., :8080).                                |
| header.key            | string | Yes      | The HTTP header used for authentication. Typically Authorization.                                |
| header.value          | string | Yes      | The expected header value. For bearer tokens, prefix the secret with Bearer .                    |
| vector.locator\_field | string | No       | A jq-style path to a field in the incoming log used to build a link back to your logging system. |
| vector.link\_format   | string | No       | A URL template containing {locator}, replaced with the value extracted via locator\_field.  |

## Capabilities

| Feature                  | Supported |
| ------------------------ | --------- |
| Real-time scanning       | ✅         |
| Scan log streams         | ✅         |
| Scan base64-encoded data | ✅         |

## Notes

- TruffleHog scans logs forwarded by Vector but does not block log delivery when credentials are detected. Detection is observe-only.