Ingesting with Vector

Nginx primary key

The primary key above assumes typical access patterns in the ClickStack UI for Nginx logs, but may need to be adjusted depending on your workload in production environments.

Copy Vector configuration

### Copy Vector configuration[​](#copy-vector-configuration-nginx-oss "Direct link to Copy Vector configuration")

Ingestion to ClickStack for Vector should occur directly to ClickHouse, bypassing the OTLP endpoint exposed by the collector.

Copy the vector configuration and create a file `nginx.yaml`.

```
data_dir: ./.vector-data
sources:
  nginx_logs:
    type: file
    include:
      - access.log
    read_from: beginning

transforms:
  decode_json:
    type: remap
    inputs:
      - nginx_logs
    source: |
      . = parse_json!(to_string!(.message))
      ts = parse_timestamp!(.time_local, format: "%d/%b/%Y:%H:%M:%S %z")
      # ClickHouse-friendly DateTime format
      .time_local = format_timestamp!(ts, format: "%F %T")

sinks:
  clickhouse:
    type: clickhouse
    inputs:
      - decode_json
    endpoint: "http://localhost:8123"
    database: logs
    format: json_each_row
    table: nginx_logs
    skip_unknown_fields: true
    auth:
      strategy: "basic"
      user: "api"
      password: "api"
```

Note

The example above uses the `api` user for ClickStack Open Source. For production deployments, we recommend [creating a dedicated ingestion user](/docs/use-cases/observability/clickstack/ingesting-data/otel-collector#creating-an-ingestion-user) with appropriate permissions and limits. The above configuration also assumes that Vector is running on the same host as ClickStack. In production deployments, this is likely to be different. We would recommend sending data over the secure HTTPS port 8443.

Start Vector

### Start Vector[​](#start-vector-oss-nginx "Direct link to Start Vector")

Start Vector with the following command.

```
mkdir ./.vector-data
vector --config nginx-local.yaml
```

Create a datasource

### Create a datasource[​](#create-a-datasource-nginx-oss "Direct link to Create a datasource")

Create a logs data source via `Team -> Sources`

The configuration assumes the Nginx schema with a `time_local` column used as the timestamp. This is the timestamp column declared in the primary key. This column is mandatory.

We have also specified the default select to be `time_local, remote_addr, status, request`, which defines which columns are returned in the logs view.

In the example above, a `Body` column doesn't exist in the data. Instead, it is defined as the SQL expression:

```
concat(
  remote_addr, ' ',
  remote_user, ' ',
  '[', formatDateTime(time_local, '%d/%b/%Y:%H:%M:%S %z'), '] ',
  '"', request, '" ',
  toString(status), ' ',
  toString(body_bytes_sent), ' ',
  '"', http_referer, '" ',
  '"', http_user_agent, '" ',
  '"', http_x_forwarded_for, '" ',
  toString(request_time), ' ',
  toString(upstream_response_time), ' ',
  '"', http_host, '"'
)
```

This reconstructs the log line from the structured fields.

For other possible options, see the [configuration reference](/docs/use-cases/observability/clickstack/config).

Navigate to the ClickStack UI

### Navigate to the ClickStack UI[​](#navigate-to-clickstack-ui-nginx-oss "Direct link to Navigate to the ClickStack UI")

Navigate to the ClickStack UI at <http://localhost:8080>. Create a user if you haven't completed the onboarding.

Explore the data

### Explore the data[​](#explore-the-data-nginx-oss "Direct link to Explore the data")

Navigate to the search view for `October 20th, 2025` to explore the data and begin using ClickStack.

- [Sending data with Vector](#sending-data-with-vector)- [Example dataset with Vector](#example-dataset-with-vector)

Was this page helpful?