Vector

Forward logs from your own Vector with the opentelemetry sink over OTLP/HTTP. The sink expects OTLP-shaped events, so a remap builds the log record. Needs an ingestion key with ingest:logs; set WT_OTLP_ENDPOINT (for example https://ingest.example.com) and WT_INGEST_KEY.

sources:
  app:
    type: file
    include: [/var/log/app/*.log]
transforms:
  to_otlp:
    type: remap
    inputs: [app]
    source: |
      ts = to_unix_timestamp!(.timestamp, unit: "nanoseconds")
      msg = string!(.message)
      . = {"resourceLogs": [{
        "resource": {"attributes": [{"key": "service.name", "value": {"stringValue": "my-app"}}]},
        "scopeLogs": [{"logRecords": [{"timeUnixNano": to_string(ts), "body": {"stringValue": msg}}]}]
      }]}
sinks:
  watchtower:
    type: opentelemetry
    inputs: [to_otlp]
    protocol:
      type: http
      uri: ${WT_OTLP_ENDPOINT}/v1/logs
      method: post
      encoding:
        codec: json
      framing:
        method: bytes
      batch:
        max_events: 1
      request:
        headers:
          Content-Type: application/json
          Authorization: "Bearer ${WT_INGEST_KEY}"

The gateway accepts OTLP/JSON at /v1/logs. With codec: json each HTTP request body must be exactly one OTLP request, so batch.max_events: 1 is required: larger batches would send several JSON documents in one body, which is not valid OTLP. To send bigger batches, switch to codec: otlp (protobuf, Content-Type: application/x-protobuf) and raise max_events; the gateway accepts OTLP/protobuf too. Do not set wt.* attributes; the gateway deletes them.

Status: structure-checked, not yet run against the real agent. The config is syntax- and wiring-checked in CI only; check the sink options against your Vector version.