Vector manifests for ALB S3 Logs

vector-manifests-alb-s3-logs.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: vector
spec:
  replicas: 1
  selector:
  template:
    metadata:
    spec:
      serviceAccountName: vector
      dnsPolicy: ClusterFirst
      containers:
        - name: vector
          image: "timberio/vector:0.17.3-distroless-libc"
          imagePullPolicy: IfNotPresent
          args:
            - --config-dir
            - /etc/vector/
          envFrom:
            - configMapRef:
                name: vector
          ports:
            - name: api
              containerPort: 8686
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /health
              port: api
          readinessProbe:
            httpGet:
              path: /health
              port: api
          volumeMounts:
            - name: data
              mountPath: "/vector-data-dir"
            - name: config
              mountPath: "/etc/vector/"
              readOnly: true
      terminationGracePeriodSeconds: 60
      volumes:
        - name: data
          emptyDir: {}
        - name: config
          projected:
            sources:
              - configMap:
                  name: vector-config
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vector
  annotations:
    eks.amazonaws.com/role-arn: <IRSA_ROLE_ARN>

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: vector-config
data:
  config.toml: |
    data_dir = "/vector-data-dir"

    [api]
      enabled = true
      address = "0.0.0.0:8686"
      playground = false

    [log_schema]
      host_key = "host"
      message_key = "message"
      source_type_key = "source_type"
      timestamp_key = "timestamp"

    [sources.s3_alb_logs]
      compression = "gzip"
      region = "${AWS_REGION}"
      type = "aws_s3"
      [sources.s3_alb_logs.sqs]
        queue_url = "${SQS_QUEUE_URL}"

    [transforms.alb_logs]
      inputs = ["s3_alb_logs"]
      source = " . = parse_aws_alb_log!(.message)"
      type = "remap"

    [sinks.loki]
      endpoint = "http://loki:3100"
      inputs = ["alb_logs"]
      type = "loki"
      [sinks.loki.encoding]
        codec = "json"
      [sinks.loki.labels]
        event = "{{ event_field }}"
        forwarder = "vector"
        source = "alb_logs"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: vector
data:
  SQS_QUEUE_URL: https://<SQS_QUEUE_URL>
  AWS_REGION: <AWS_REGION>