Vector
6 min
vector edition enterprise only the vector integration scans logs forwarded from vector via the http sink, enabling real time secret detection on log streams configuration the vector integration is configured via a local configuration file web configuration in trufflehog is not available for this source setup requires configuration in two places a trufflehog source that listens for incoming logs, and a vector http sink that forwards logs to it local configuration trufflehog source configuration sources \ connection "@type" type googleapis com/sources webhook listenaddress " 8080" header key authorization \# the value must be prefixed with 'bearer ' as shown value "bearer your secret value" vector \# specify a field to extract using jq style syntax \# the extracted field can be used to format a link \# back to your logging system in the trufflehog dashboard locator field "metadata request id" link format "https //your logging system com/logs/{locator}" name vector logs type source type webhook verify true vector http sink configuration if present in the incoming log payload, the following fields are surfaced as metadata in the trufflehog dashboard host, hostname, timestamp, source type see the vector http sink documentation for the full set of sink options sinks webhook type http inputs \ "in" \# customize the uri to point to whatever host\ port \# you are running trufflehog on uri http //localhost 8080/v1/vector method "post" encoding codec "json" auth strategy "bearer" token "your secret value" configuration options field type required description listenaddress string yes the address and port the webhook listener binds to (e g , 8080) header key string yes the http header used for authentication typically authorization header value string yes the expected header value for bearer tokens, prefix the secret with bearer vector locator field string no a jq style path to a field in the incoming log used to build a link back to your logging system vector link format string no a url template containing {locator}, replaced with the value extracted via locator field capabilities feature supported real time scanning ✅ scan log streams ✅ scan base64 encoded data ✅ notes trufflehog scans logs forwarded by vector but does not block log delivery when credentials are detected detection is observe only
