Number do not match for log entries and log to metrics count.

[LewisWWEX]

Sending 2 log entries to datadog and converting one of them to a metrics using vector (would like to stop sending log entries to datadog).
When comparing the count between the two, there are 13k log enties and only 2k metrics. Trying to understand why the difference.
Wondering if vector is rate limiting anything that I do not see.

Snippet from vector config file.

customConfig:
  sources:
    datadog_agent:
      type: datadog_agent
      address: 0.0.0.0:8282
      multiple_outputs: true

  transforms: 
    filter_for_tp_stop:
      type: filter
      inputs:
        - datadog_agent.logs
      condition: 'contains!(.message, "tp-stop")'

    tp_log_remap:
      type: remap
      inputs:
        - filter_for_tp_stop
      source: |-
        .message = replace!(.message,"<","")
        .message = replace(.message,">","")
        .message = replace(.message,"-","_")
        .message = replace(.message,"{"," ")
        .message = replace(.message,"}"," ")
        .message = replace(.message,","," ")
        .message = parse_key_value!(.message, field_delimiter: " ", key_value_delimiter: ":")
        .message.message = parse_key_value!(.message.message, field_delimiter: " ", key_value_delimiter: ":")

    filter_tp_stop:
      type: filter
      inputs:
        - tp_log_remap
      condition: 'exists(.message.message.stop)'

    filter_logs_ex0:
      type: filter
      inputs:
        - filter_tp_stop
      condition: '.message.message.ex == "0"'

    datadog_logs_to_metrics_ex0:
      type: log_to_metric
      inputs:
        - filter_logs_ex0
      metrics:
        - type: counter
          field: .message.message
          name: wwex.metric.tp.ex_none
          tags:
            act: |-
              {{ print "{{.message.message.act}}" }}
            service: |-
              {{ print "{{.service}}" }}
            ex: |-
              {{ print "{{.message.message.ex}}" }}

    metric_add_tags:
      type: remap
      inputs:
        - datadog_logs_to_metrics_ex0
      source: |-
        .tags.processed_by = "vector"

  sinks:
    datadog_metrics:
      type: datadog_metrics
      inputs:
        - metric_add_tags
      default_api_key: ${DATADOG_API_KEY}

Attaching sample log entries.
logs.json

[pront]

Wondering if vector is rate limiting anything that I do not see.

There's no secret rate limiting. But there's a number of things that might cause events to be dropped (filters, VRL abort etc).

I would start inspecting the component metrics. You can add the following to your config:

sources:

  # ...

  sourceX:
    type: "internal_metrics"

# ...

sinks:
  console:
    type: console
    inputs:
      - sourceX
    target: stdout
    encoding:
      codec: json
      json:
        pretty: true

[LewisWWEX]

This is great... getting lots of information. Not sure what I'm looking for. Thanks
captured-internal-metrics.json

[pront]

The metrics are defined here:

• https://vector.dev/docs/reference/configuration/transforms/filter/#telemetry-metrics
• https://vector.dev/docs/reference/configuration/transforms/remap/#telemetry-metrics

First you can check if events are discarded by inspecting component_discarded_events_total. And then you can also see component_sent_events_total to determine how many events are forwarded from your Remap transform to the sink.